.p8 key

A .p8 file is the private key half of an Apple API credential, downloaded from Apple exactly once at creation, with no second chance and no recovery path.

It arrives named after its own Key ID, as AuthKey_ABC1234DEF.p8, and inside it is a PEM block starting -----BEGIN PRIVATE KEY-----. That is the whole file. It is a few hundred bytes of text, which is why it is so easy to lose in a Downloads folder.

Apple uses the same file format for more than one thing, so check which you are holding. App Store Connect API keys sign requests to the console API. APNs auth keys sign push notifications. MusicKit keys sign Apple Music requests. They look identical and are not interchangeable.

A .p8 on its own is not enough to authenticate. You also need its Key ID and your team's Issuer ID, and neither is stored in the file. Save all three together the moment you create the key.

If you lose it, there is no reissue of the same key. Revoke it in App Store Connect and create a new one, then update every pipeline that used it. Anything still holding the old key fails immediately on revocation, so do this in an order you control rather than mid release.

Do not commit it. It is a credential with your team's permissions attached, and unlike a password it has no expiry and no login notification.

See also: App Store Connect API key, App Store Connect, Transporter.