How to Create an App Store Connect API Key (.p8)
An App Store Connect API key is the credential Apple issues so that a tool can act on your developer account without ever seeing your Apple ID password. It comes in three parts that only work together: a .p8 private key file you download exactly once, a Key ID that names it, and an Issuer ID that identifies your team. You create it in App Store Connect under Users and Access, give it the narrowest role that can do the job, and revoke it there the moment you no longer trust it. Every serious iOS automation tool — CI systems, upload utilities, submission services including AscAuto — authenticates this way. This guide covers where the key lives, which role to pick, what to do when the .p8 is lost, and the two errors that mean you chose wrong.
By the AscAuto team — engineers who automate App Store submissions and rejection fixes daily. · Last updated: July 2026
Before you start
- An active Apple Developer Program membership (99 USD/year). Keys exist per team, not per app.
- The Admin role in App Store Connect for the team you're creating the key in. Without it, the API key section is read-only or absent.
- A safe place to put the file. Treat the .p8 like a password, not like a config file.
How do I create an App Store Connect API key?
-
Open Users and Access in App Store ConnectSign in at appstoreconnect.apple.com with an Admin account and open Users and Access from the top navigation.
-
Find the App Store Connect API sectionIt lives under the Integrations tab. Apple has renamed this area more than once — if the wording differs from what you see here, look for "Keys", "Integrations" or "App Store Connect API" inside Users and Access. Team keys and individual keys are listed separately; a service that automates builds and submissions for your whole team wants a team key.
-
Generate the key with a roleCreate a new key, name it after where it will be used ("AscAuto production", "GitHub Actions") so you can revoke the right one later, and pick a role. Role selection is the part people get wrong — see the table below.
-
Download the .p8 immediatelyThe file arrives as
AuthKey_<KEYID>.p8and can be downloaded only once. Do it now, before you navigate away. -
Copy the Key ID and Issuer IDThe Key ID is shown next to the key in the list. The Issuer ID is a UUID displayed once at the top of the same page and is identical for every team key you ever create.
-
Store all three together, encryptedA secrets manager, your CI provider's encrypted secret store, or a service that encrypts keys at rest. Never a repository, never a shared drive, never a chat message.
Which role should the key have?
Give the key the least privilege that completes the job. You can always create a second key with more access if something returns 403; you cannot un-leak an over-privileged one.
| Role | Typically enough for | Notes |
|---|---|---|
| Developer | Uploading builds to TestFlight | Narrowest useful role. Not enough for editing listing metadata or submitting for review. |
| App Manager | Build upload, listing metadata, version submission | The usual choice for a submission pipeline, including AscAuto. |
| Admin | Account-level work: certificates, identifiers, user management | Only if a narrower role returns 403 for something you genuinely need — for example generating a distribution certificate from scratch. |
The three values and where they go
| Value | Looks like | Scope |
|---|---|---|
| Issuer ID | A UUID, e.g. 69a6de70-… | One per team — same for all your keys. |
| Key ID | A 10-character string, e.g. 2X9R4HXF34 | One per key. Also appears in the filename. |
| .p8 private key | AuthKey_2X9R4HXF34.p8 | Downloadable once. This is the secret. |
Tools sign a short-lived JSON Web Token with the .p8 and send it as a bearer token on every App Store Connect API request. That's why all three parts are required and why the file alone is not enough.
Two errors that mean you picked wrong
| What you see | What it usually means |
|---|---|
401 Unauthorized / "Authentication credentials are missing or invalid" | Wrong Issuer ID or Key ID, a mangled .p8 (line breaks lost when pasted into an environment variable), or a system clock far enough off that the signed token is already expired. |
403 Forbidden | The key is valid but its role is too narrow for the endpoint — the classic case being certificate or identifier creation with a non-Admin key. |
Keeping it safe — and how AscAuto handles it
An API key is dramatically safer than handing a tool your Apple ID password: it is scoped to a role, it cannot sign in to your Apple account, it carries no two-factor session, and you can revoke it in App Store Connect at any moment without changing anything else. If a tool asks for your Apple ID password rather than an API key, that is a reason to walk away.
AscAuto only ever asks for the key. It is encrypted at rest with AES-256-GCM, used solely to make the App Store Connect API calls your approvals authorise, and you can revoke it from Apple's side whenever you like — removing it in AscAuto does not revoke it at Apple, so do both if you want it dead everywhere. The full data handling is written up in the privacy policy.
FAQ
Where do I create an App Store Connect API key?
In App Store Connect, under Users and Access, in the Integrations tab for the App Store Connect API. You need the Admin role to create a team key. Apple periodically renames these screens, so if the wording differs, look for API keys or Integrations under Users and Access.
Which role should an App Store Connect API key have?
The least-privileged role that can do the work. App Manager covers uploading builds, editing listing metadata and submitting for review — what a submission pipeline needs. Developer is narrower and can be enough for build upload alone. Admin is only for account-level work such as creating certificates, and should be avoided unless a 403 proves it's needed.
Can I download the .p8 private key again?
No. Apple allows the download once, at creation. If the file is lost there's no recovery path: revoke the key, create a new one, and update wherever the old key was configured.
What is the difference between the Issuer ID and the Key ID?
The Issuer ID identifies your App Store Connect team and is the same for every team key. The Key ID identifies one specific key. Both are needed, together with the .p8 file, to sign API requests.
Is an API key safer than sharing my Apple ID password?
Yes, substantially. It's scoped to a role, revocable at any moment without touching your Apple ID, carries no two-factor session access, and cannot be used to sign in to your account. A tool that asks for your password instead is asking for far more access than it needs.