# How to get an App Store Connect API key

SEO title: How to Get an App Store Connect API Key (.p8)

Source: https://webnativeapp.com/app-store-connect-api-key

Description: Get an App Store Connect API key, Issuer ID, Key ID, and .p8 file. Choose the right key type and fix missing download or permission issues.

To get an App Store Connect API key, sign in to App Store Connect, open **Users and Access**, select **Integrations**, choose **App Store Connect API**, and generate a Team Key. Save the Issuer ID and Key ID, then download the private `AuthKey_XXXXXXXXXX.p8` file immediately. Apple lets you download that private key only once.

Those three credentials—the `.p8` private key, Issuer ID, and Key ID—allow a trusted build service or backend to authenticate without your Apple Account password or two-factor authentication code. This guide explains the current Apple workflow, the difference between Team and Individual keys, which access level to choose, and what to do when an option is missing. Apple documentation checked September 15, 2026.

## What is an App Store Connect API key?

An App Store Connect API key is a credential used to automate authorized work in App Store Connect and parts of the Apple Developer website. Depending on its access, a tool can use it to work with apps, builds, TestFlight, metadata, certificates, identifiers, profiles, and other supported resources.

The key does not replace your Apple Developer membership. It gives software a controlled way to act within an existing App Store Connect team.

A Team Key setup normally contains three values:

| Credential | What it is | Is it secret? |
| --- | --- | --- |
| Private key | A file named like `AuthKey_ABC123DEFG.p8` that signs authentication tokens | Yes. Treat it like a password and never expose it publicly. |
| Key ID | A short identifier such as `ABC123DEFG` that tells Apple which key signed the request | No, but keep it associated with the correct private key. |
| Issuer ID | A UUID that identifies the App Store Connect API issuer for your team | No, but share it only where the integration requires it. |

The three values must belong to the same team and key. Combining a `.p8` file from one key with another Key ID produces an authentication error.

Apple's API uses the private key to sign a JSON Web Token, or JWT. Most managed build platforms create that temporary token for you after you provide the credentials. You should not need to generate a JWT manually just to connect a supported service.

## Before generating the key, check your access.

Sign in at [App Store Connect](https://appstoreconnect.apple.com/) with the Apple Account connected to the correct developer team. If your Apple Account belongs to several teams, confirm the selected organization before creating anything.

You also need the correct permissions:

- The **Account Holder** must request initial access to the App Store Connect API if the team has not enabled it yet.
- An **Account Holder or Admin** can generate a Team Key.
- Other eligible App Store Connect users can generate an Individual Key when the team has left the **Generate Individual API Keys** permission enabled for them.
- Two-factor authentication is required to sign in to App Store Connect.

If **Users and Access → Integrations** shows a **Request Access** button instead of key controls, ask the Account Holder to accept the API terms and submit that request. Apple says access requests are reviewed case by case. Generating keys becomes possible after access is approved.

## Should you create a Team Key or an Individual Key?

Use the key type required by the tool you are connecting. They have different paths, permissions, and authentication fields.

| | Team Key | Individual Key |
| --- | --- | --- |
| Created by | Account Holder or Admin | The individual App Store Connect user |
| Location | Users and Access → Integrations → App Store Connect API → Team Keys | User profile → Edit Profile → Individual API Key |
| Access | Role-based access across the team's apps | Follows that user's app access and permissions |
| Issuer ID | Required | Not used for App Store Connect API JWTs |
| Active-key limit | A team can generate multiple keys | One active key per user |
| Important limitation | Cannot be restricted to one specific app | Cannot use Provisioning endpoints, Sales and Finance, or `notaryTool` |

A service that asks for **Issuer ID + Key ID + `.p8` file** is normally asking for a **Team Key**. An Individual Key does not use the Issuer ID in its App Store Connect API token and may not support workflows that create or manage signing resources.

For iOS build and release automation, verify the provider's requirements before generating the key. Do not assume that an Individual Key will work simply because it is called an App Store Connect API key.

## How to generate an App Store Connect Team API key.

Follow these steps in the team that owns the app:

1. Sign in to [App Store Connect](https://appstoreconnect.apple.com/).
2. Open **Users and Access**.
3. Select the **Integrations** tab.
4. Select **App Store Connect API** in the left column.
5. Open **Team Keys**.
6. Click **Generate API Key**. If another active key already exists, click the add button (`+`).
7. Enter a descriptive internal name, such as `WebNativeApp builds` or `CI release automation`.
8. Choose the required access role.
9. Click **Generate**.

The active-key table will display the new key's name, Key ID, access level, and download action. The key name is only a label for your team; it is not included in API authentication.

Apple does not let you edit the name or access level after generation. If either is wrong, revoke the key and create a replacement rather than continuing with unnecessary permissions.

## Where do you find the Issuer ID?

For a Team Key, go to **Users and Access → Integrations → App Store Connect API**. The Issuer ID appears near the top of the page. Use the adjacent **Copy** action to avoid transcription mistakes.

An Issuer ID looks like a UUID:

`00000000-0000-0000-0000-000000000000`

The Issuer ID identifies the team-level API issuer; it is not the Team ID, Apple ID, Bundle ID, Vendor Number, or Key ID. These identifiers can appear in nearby Apple workflows but are not interchangeable.

If you are viewing an Individual Key, you may not see an Issuer ID because individual App Store Connect API tokens use a different subject field. Return to **Integrations → App Store Connect API → Team Keys** if the integration specifically asks for an Issuer ID.

## Where do you find the Apple API Key ID?

On the **Team Keys** page, find the new key under **Active**. Its Key ID appears in the table. Hover next to it and use **Copy Key ID** when available.

A Key ID usually looks like this:

`ABC123DEFG`

The filename of the downloaded private key normally includes the same value:

`AuthKey_ABC123DEFG.p8`

That filename is a useful check, but copy the Key ID from App Store Connect rather than relying only on a renamed local file. When several keys exist, confirm that the selected Key ID matches the `.p8` private key you intend to use.

## How do you download the AuthKey .p8 file?

Immediately after generating the Team Key:

1. Stay on **Users and Access → Integrations → App Store Connect API → Team Keys**.
2. Find the new key under **Active**.
3. Click **Download API Key**.
4. Confirm the download when Apple displays the warning.
5. Store the resulting `AuthKey_XXXXXXXXXX.p8` file in a secure location.

The `.p8` file contains the private half of the API key. Apple does not retain a downloadable copy and allows the private key to be downloaded only once.

If the download link is no longer present, you cannot recover the same private key from Apple. First check whether the original file is stored in your password manager, secrets vault, encrypted team storage, or approved build environment. If it is genuinely lost, revoke the old key, create a new one, and update every integration that used it.

Do not open the file and paste its contents into a chat, support ticket, public form, screenshot, or source-code repository. Upload it only through the dedicated secret or credential field of a service you trust.

## Which access role should an App Store Connect key use?

Choose the lowest role that supports the complete workflow. A read-only analytics integration should not receive the same authority as a release system that uploads builds or manages signing assets.

The correct choice depends on what the integration performs:

- **Reporting or metadata tools** may work with narrower access.
- **Build upload and TestFlight automation** needs access to the relevant apps and build operations.
- **Signing automation** may also require access to Certificates, Identifiers & Profiles endpoints.
- **User administration** requires broad authority and should not be granted to an ordinary build integration.

Check the provider's documentation for its required role, then compare that requirement with Apple's current role permissions. Avoid choosing **Admin** merely to bypass an unexplained authorization error. First confirm that you selected the right team, key type, app access, and matching credential values.

Team Keys are role-based across the team's apps and cannot be limited to a single app. This makes key scope and revocation planning especially important. If a provider only needs one app, evaluate whether its workflow supports an Individual Key or another app-scoped authorization model before granting wider access.

## How to generate an Individual App Store Connect API key.

An Individual Key follows the access of a specific App Store Connect user:

1. Sign in to App Store Connect.
2. Click your username in the upper-right corner.
3. Select **Edit Profile**.
4. Scroll to **Individual API Key**.
5. Click **Generate Key**.
6. Download the private key immediately and keep its Key ID.

If the button is missing, an Account Holder or Admin may have disabled **Generate Individual API Keys** for your user. They can review that permission under **Users and Access → People → your user → Additional Resources**.

Each user can have only one active Individual Key at a time. Revoking it is permanent. Individual keys also cannot use the Provisioning endpoints, access Sales and Finance, or work with `notaryTool`, so they are not a drop-in replacement for every Team Key integration.

## How should you provide the credentials to a build platform?

A trusted platform that uses a Team Key will generally present three separate fields:

1. **Auth key `.p8`:** upload the private file downloaded from Apple.
2. **Issuer ID:** paste the team issuer UUID from the API page.
3. **Key ID:** paste the identifier belonging to that exact private key.

Keep the browser on the correct Apple team while copying the values. A common mistake is downloading the key from one organization and copying the Issuer ID from another organization selected under the same Apple Account.

Before submitting the credentials:

- Confirm the service actually needs App Store Connect access.
- Verify its domain and credential-handling documentation.
- Use a purpose-specific key with the least sufficient role.
- Record who created the key, why it exists, and where it is used.
- Plan how to revoke or rotate it if access is no longer required.

Never give a service your Apple Account password or two-factor authentication code as a substitute for API credentials. A properly designed App Store Connect integration should use the key to authenticate its supported automated operations.

## Why is the App Store Connect API option missing?

The visible symptom usually identifies the cause.

### The Integrations tab shows Request Access

The team has not enabled the App Store Connect API. The Account Holder must request access and accept Apple's terms. Other roles cannot complete the initial request.

### The Team Keys page has no Generate API Key button

Your user is probably not the Account Holder or an Admin, or the team's API access is not active yet. Ask an authorized team member to generate the key or correct your role.

### Your profile has no Individual API Key button

The team may have removed the **Generate Individual API Keys** permission from your user. Individual keys can also be unavailable for program types or workflows that do not support them.

### The private-key download button disappeared

The `.p8` file has already been downloaded. Apple will not provide it again. Locate the securely stored original or revoke the credential and create a replacement.

### You cannot find an Issuer ID

You may be looking at an Individual Key, the wrong Integrations section, or another Apple key type. A Team Key's Issuer ID appears near the top of the App Store Connect API page.

## Why does the API key return a 401 authentication error?

A `401` response means Apple could not accept the authentication token. When a third-party service creates the token, verify the inputs before changing the key's role:

- The Key ID belongs to the uploaded `.p8` file.
- The Issuer ID belongs to the same App Store Connect team.
- The key is active and has not been revoked.
- You created an **App Store Connect API Team Key**, not an APNs, Sign in with Apple, or In-App Purchase key.
- The integration supports the selected key type.
- The system generating the JWT has an accurate clock.

For direct App Store Connect API requests, Apple requires an ES256-signed JWT with the correct `kid`, audience, timestamps, and Team Key issuer. Standard App Store Connect API tokens generally cannot expire more than 20 minutes after creation, apart from specific resources for which Apple documents a longer lifetime. [Apple's token-generation documentation](https://developer.apple.com/documentation/appstoreconnectapi/generating-tokens-for-api-requests).

A role problem more commonly produces an authorization failure after authentication. Do not automatically issue a broader key when the actual problem is a mismatched Issuer ID, Key ID, or private file.

## Do not confuse the App Store Connect API key with other Apple keys.

Apple uses `.p8` private keys for several unrelated services. The matching file extension does not make the credentials interchangeable.

| Credential | Created in | Main purpose |
| --- | --- | --- |
| App Store Connect API Team Key | App Store Connect → Users and Access → Integrations | Automate supported App Store Connect and developer-resource operations |
| Individual App Store Connect API Key | App Store Connect user profile | Authenticate with the permissions of one user |
| Sign in with Apple key | Apple Developer → Certificates, Identifiers & Profiles → Keys | Sign developer tokens for Sign in with Apple |
| APNs authentication key | Apple Developer → Certificates, Identifiers & Profiles → Keys | Authenticate a provider server with Apple Push Notification service |
| In-App Purchase key | App Store Connect → Users and Access → Integrations → In-App Purchase | Sign supported App Store server requests |
| Distribution certificate | Apple Developer or managed signing workflow | Sign an app binary for distribution; it is not an API key |

If a form asks for an Issuer ID, Key ID, and App Store Connect Auth Key, create the credential in **App Store Connect Integrations**, not in the general **Certificates, Identifiers & Profiles → Keys** area.

## Secure, rotate, and revoke Apple API keys.

Treat the `.p8` file as a production secret:

- Do not commit it to Git, even in a private repository.
- Do not bundle it in an iOS app, website JavaScript, or other client-side code.
- Do not send it through ordinary email or messaging.
- Store it in a secrets manager or the protected credential storage of the integration using it.
- Restrict access to the people and systems that operate the release workflow.
- Revoke unused, lost, or exposed keys immediately.

To revoke a Team Key, return to **Users and Access → Integrations → App Store Connect API → Team Keys**, edit the active keys, select the credential, and choose **Revoke Key**. Revocation cannot be undone. Create and deploy a replacement before revoking an in-use key when continuity matters.

Because Team Keys apply across the team's apps, give each external system its own key where practical. Separate keys make it possible to remove one integration without interrupting every release tool.

## App Store Connect API key FAQ

### Where do I find my App Store Connect API key?

Open App Store Connect, then go to **Users and Access → Integrations → App Store Connect API → Team Keys**. Active keys, their Key IDs, roles, and download status appear there. The Issuer ID is displayed near the top of the API page.

### How do I download an Apple AuthKey .p8 file?

Generate a Team Key under App Store Connect's API Integrations page, then click **Download API Key** next to the new active key. Save the `AuthKey_XXXXXXXXXX.p8` file immediately because Apple permits only one download.

### Can I download the same App Store Connect private key again?

No. Apple does not store a recoverable copy of the private key. If the original `.p8` file is lost, revoke that key, generate a new one, and replace the credentials in every connected system.

### Where is the App Store Connect Issuer ID?

For Team Keys, the Issuer ID appears near the top of **Users and Access → Integrations → App Store Connect API**. It is a UUID and is different from the Team ID, Bundle ID, Apple ID, and Key ID.

### Is the Key ID inside the AuthKey filename?

The downloaded file is normally named `AuthKey_<KEY_ID>.p8`, so its filename usually identifies the associated key. Still, copy the Key ID from the active-key table in App Store Connect to avoid errors caused by renamed files.

### Why is Generate API Key missing in App Store Connect?

For Team Keys, you need the Account Holder or Admin role and active API access for the team. For an Individual Key, your user needs the Generate Individual API Keys permission. The Account Holder must complete the team's initial API access request.

### Is an App Store Connect API key the same as a Sign in with Apple key?

No. An App Store Connect API key authorizes App Store Connect automation. A Sign in with Apple key signs developer tokens for the authentication service and is created in a different Apple Developer section. The two keys cannot replace one another.

### Should I use a Team Key or Individual Key for app builds?

Use the type required by the build provider. If it asks for an Issuer ID, Key ID, and `.p8` file or needs Provisioning API access, it is normally designed for a Team Key. Individual keys do not use the Team Key Issuer ID and cannot access Provisioning endpoints.

### Is it safe to share an App Store Connect API key?

Share it only with a trusted service through protected credential fields and grant the lowest sufficient role. Never publish the `.p8` file, commit it to source control, place it in client-side code, or send it in an ordinary support message.

### Can an App Store Connect Team Key be limited to one app?

No. Apple states that Team Keys can access all apps according to their assigned role; their access cannot be limited to one app. Use a dedicated key, the least sufficient role, and a clear revocation plan.

## Official Apple sources for App Store Connect API keys.

- [App Store Connect API access and key management](https://developer.apple.com/help/app-store-connect/get-started/app-store-connect-api)
- [Creating API keys for the App Store Connect API](https://developer.apple.com/documentation/appstoreconnectapi/creating-api-keys-for-app-store-connect-api)
- [Generating tokens for API requests](https://developer.apple.com/documentation/appstoreconnectapi/generating-tokens-for-api-requests)
- [App Store Connect accounts and roles](https://developer.apple.com/help/app-store-connect/manage-your-team/overview-of-accounts-and-roles)
- [Creating a Sign in with Apple private key](https://developer.apple.com/help/account/capabilities/create-a-sign-in-with-apple-private-key)
- [Creating keys for Apple services such as APNs](https://developer.apple.com/help/account/keys/create-a-private-key)

## Continue your iOS release setup.

:::related
- [App Store submission checklist for web apps](https://webnativeapp.com/app-store-submission-checklist-web-apps)
- [How to put a web app on the App Store](https://webnativeapp.com/web-app-to-app-store)
- [Convert a web app to iOS without Xcode](https://webnativeapp.com/convert-web-app-to-ios-without-xcode)
- [Why WebView apps get rejected](https://webnativeapp.com/app-store-webview-rejection)
- [Fix an App Store Guideline 4.2 rejection](https://webnativeapp.com/app-store-guideline-4-2-minimum-functionality)
- [How WebNativeApp works](https://webnativeapp.com/documentation)
:::

## Turn your existing web app into an App Store-ready project.

WebNativeApp guides you from your production URL through iOS packaging, Apple credentials, signing, TestFlight, and store submission. You keep control of the website, source project, and Apple Developer account while using App Store Connect API credentials instead of sharing your Apple Account password.