How to create an App Store Connect API key

Updated 2026-08-04

App Store Connect keys are more involved than a typical API key — you need three pieces of information, and one of them can only be downloaded once.

Creating one

Sign in to App Store Connect.
Go to Users and Access → Integrations.
Under App Store Connect API, click +.
Name it and choose a role.
Click Generate.
Download the .p8 private key file immediately.

⚠️ The one-download rule

Apple lets you download the .p8 file exactly once. There is no way to retrieve it later. If you lose it, your only option is to revoke the key and generate a new one.

Save it somewhere durable — a password manager works well — the moment you download it.

The three values you need

Value	Where	Looks like
Issuer ID	Top of the Keys tab	A UUID
Key ID	The key's row	A short alphanumeric string
Private key	The `.p8` download	A PEM-formatted text file

All three are required. The issuer ID is easy to miss — it sits above the key list rather than next to any individual key.

Which role

Sales and Reports. It grants access to sales and financial reports without administrative control over your apps, builds or team members.

Do not use Admin for a reporting integration. It grants far more than reading numbers requires.

Why Apple's API is harder than Stripe's

Worth understanding, because it explains why App Store revenue tooling is generally weaker than Stripe tooling:

Authentication uses an ES256-signed JWT built from your .p8 key, not a bearer token you can paste into a header.
Revenue comes from Sales and Trends reports — gzipped TSV files on Apple's schedule, typically a day behind — not a live endpoint.
There is no simple "what are my active subscriptions right now" call.

This is why no tool, including Apple's own dashboard, shows genuinely real-time App Store revenue.

Using it with FRGMNT

You can add your credentials now. Be aware of the current state:

FRGMNT validates App Store Connect credentials and signs the required JWT today. Sales reporting is still in development, so App Store revenue does not yet contribute to your figures. The app shows this status honestly rather than a misleading zero.

Full detail: the App Store integration.

Revoking

Users and Access → Integrations, then revoke the key. Anything using it stops immediately.

Frequently asked

Where do I create an App Store Connect API key?

App Store Connect, then Users and Access, then the Integrations tab. Create a key there and assign it a role.

Can I download the .p8 private key again?

No. Apple allows exactly one download. If you lose it you must revoke the key and create a new one.

Which role should a reporting key have?

Sales and Reports. It grants access to sales and financial reports without administrative permissions over your apps or team.