How to create an App Store Connect API key
Shipcue reads review status and releases versions through Apple's App Store Connect API. For that it needs an API key from each account you want to follow. Here is how to make one, step by step.
Team key or Individual key?
App Store Connect has two kinds of API keys. Shipcue works with both.
- Team key (recommended). Made by an Admin of the team. It can see every app of the team, with the role you pick for the key. It comes with an Issuer ID.
- Individual key. Made in your own user profile. It has the same role and app access as your user, so it sees only the apps you can see. It has no Issuer ID. You need the "Generate Individual API Keys" permission, which a team Admin can give you.
If you work for clients, an Individual key is often the easier route: you don't need the Admin to make a key for you, only that permission.
Which role should the key have?
Pick the smallest role that does what you need:
- App Manager: the best fit for Shipcue. It can release and withdraw versions, control phased releases and set up the webhooks that push needs, but it can't manage users.
- Admin: works too, but it can also add and remove users. Avoid it for a key that lives on your phone.
- Developer: view only. Shipcue shows the current status when you open it or pull to refresh, but it can't set up push and can't release or withdraw.
Make a new key just for Shipcue. Don't reuse a key your CI or other tools depend on, so you can revoke one without breaking the other.
Create a Team key
-
Open the API keys page
Sign in to App Store Connect in a browser as an Admin. Open Users and Access, choose the Integrations tab, then App Store Connect API in the left column. If the page shows a Request Access button, the Account Holder has to request API access once.
-
Generate the key
Make sure Team Keys is selected and click Generate API Key (or the + button). Name it so you recognise it later, for example "Shipcue". Under Access, choose App Manager. Click Generate.
-
Download the .p8 file
Click Download API Key next to the new key. Apple lets you download it only once and doesn't keep a copy. The file is called AuthKey_ followed by the Key ID, for example AuthKey_ABCD123456.p8. Keep it somewhere safe, like your password manager.
-
Copy the Issuer ID
The Issuer ID is shown above the list of keys. It looks like 69a6de8f-3c2e-47e3-e053-5b8c7c11a4d1. Shipcue needs it for a Team key.
Create an Individual key
-
Open your profile
In App Store Connect, open your user profile and scroll down to Individual API Key. If there is no Generate API Key button, ask a team Admin for the "Generate Individual API Keys" permission.
-
Generate and download
Click Generate API Key, then Download API Key. As with Team keys, the .p8 file can be downloaded only once. An Individual key has no Issuer ID.
Add the key to Shipcue
-
Start Add Account
In Shipcue, tap Add Account. Choose the .p8 file from Files, AirDrop it from your Mac and pick Shipcue, or paste the key text.
-
Check the details
If the file still has its AuthKey_ name, Shipcue fills in the Key ID for you. Paste the Issuer ID for a Team key, or leave it empty for an Individual key. Give the account a name you will recognise, such as "Client: Acme".
-
Let Shipcue check it with Apple
Shipcue asks App Store Connect which apps the key can see. A brand-new key can take a minute or two to start working; Shipcue keeps trying.
-
Pick your apps
Choose the apps to follow. With Shipcue Pro, Shipcue adds one webhook per app at Apple so status changes reach you as push. Apple allows 10 webhooks per app, and Shipcue uses 1.
Good to know
- By default the key is saved in your iCloud Keychain, end-to-end encrypted by Apple, so your iPhone and iPad can both use it. You can keep a key on one device only instead. In Private mode it never reaches our server.
- Each App Store Connect account you add needs its own key.
- To stop a key everywhere, revoke it in App Store Connect: Users and Access › Integrations › App Store Connect API, select the key, Revoke. That is also the first step if you lose a device (see Lost a device?).
- Never send your .p8 file or its contents to anyone, including us.
Questions
Can I download the .p8 file again?
No. Apple offers the download only once. If you lost the file, revoke that key in App Store Connect and create a new one. In Shipcue, use Replace Key on the account so its apps and settings stay.
Where do I find the Issuer ID?
In App Store Connect under Users and Access › Integrations › App Store Connect API, above the list of Team keys. Individual keys don't have one.
Can I use a key with the Developer role?
Yes, but only to see status. Developer keys can't create webhooks, so there is no push for those apps, and they can't release or withdraw. Use App Manager for the full set.
Does Shipcue need my Apple Account password?
No. Shipcue uses only the API key. There is no sign-in with your Apple Account and no two-factor code.
Related
Follow every account in one place
Shipcue sends a push when App Review changes status, for every App Store Connect account you add. Free for 14 days.
See how Shipcue works