Create an App Store Connect API key

Three pieces make up an App Store Connect API key, and they come from three different places in the interface. That is why the setup trips people up:

Piece	What it looks like	Where it comes from
Issuer ID	57246542-96fe-1a63-e053-0824d011072a	One value for your whole team, shown above the keys table
Key ID	2X9R4HXF34	10 characters, one per key, in the keys table row
Private key	AuthKey_2X9R4HXF34.p8	Downloaded once, at creation time only

All three are required. A tool that has two of them cannot sign a request.

Before you start

You need the Account Holder or Admin role in App Store Connect to reach the Integrations page at all. If you don't see it, someone with the Account Holder role has to either generate the key for you or promote you.

The key itself needs a role too, and that role decides what the key can read. For a read-only audit, App Manager is enough. Developer cannot read pricing, availability, or several App Review fields, so checks that depend on them come back empty rather than failing loudly.

Generate the key

1. Sign in to App Store Connect.
2. Go to Users and Access, then the Integrations tab.
3. In the left sidebar, select App Store Connect API.
4. Stay on the Team Keys tab. (More on the Individual Keys tab below.)
5. Click + above the table.
6. Give the key a name you'll recognize later, for example AuditStore. The name is only a label, nothing depends on it.
7. Pick App Manager in the Access dropdown.
8. Click Generate.

The key now appears as a row in the table.

Collect the three values

Issuer ID sits above the table, next to the label Issuer ID, with a Copy link beside it. It is a UUID, it is the same for every key on your team, and it does not change when you create or revoke keys.

Key ID is the KEY ID column of your new key's row. Ten uppercase characters and digits.

Private key is behind the Download link at the end of that row. Click it and you get AuthKey_<KEYID>.p8.

Apple lets you download the .p8 exactly once

The Download link disappears after the first click, and Apple does not store a copy. Lose the file and the only remedy is to revoke the key and generate a new one, with a new Key ID.

Move the file somewhere permanent before you do anything else. Your Downloads folder is not permanent. ~/Library/Keys/ is the conventional place, and Apple's own tooling looks there.

mkdir -p ~/Library/Keys
mv ~/Downloads/AuthKey_2X9R4HXF34.p8 ~/Library/Keys/
chmod 600 ~/Library/Keys/AuthKey_2X9R4HXF34.p8

The .p8 is a private key. Anyone holding it, plus the two IDs, can act on your App Store Connect account with the role you granted. Treat it like an SSH private key: never commit it, never paste it into a chat, never mail it to yourself.

Team Keys vs Individual Keys

The Individual Keys tab creates a key tied to your personal account, with your own permissions, and it uses a different Issuer ID than the team one. Two consequences:

• A team key paired with an individual Issuer ID (or the reverse) fails authentication, even though both values are perfectly valid on their own. This is the single most common cause of a 401 on first setup.
• An individual key dies with its account. When that person leaves the team, every automation using it breaks.

Use a Team Key unless you have a specific reason not to.

Add the key to AuditStore

Open Settings, find the App Store Connect API section and click Connect…. Paste the Issuer ID, paste the Key ID, then drop AuthKey_<KEYID>.p8 on the drop target (or click it and pick the file).

Click Test connection to verify the three values before running an audit. Forget key wipes all three.

The .p8 is stored in the macOS Keychain, never on disk in plaintext; only the two IDs go to preferences. AuditStore signs its own JWT locally and talks straight to Apple. There is no NativLab server in the path.

With no key configured, AuditStore still runs the whole local Xcode analysis and Demo mode. The key only unlocks the checks that read your live App Store Connect data.

When it doesn't work

AuditStore surfaces the failure as:

Unauthorized (401). Check the key, Issuer ID, and that the key has
Admin or App Manager role.

That one 401 covers almost every setup mistake, because Apple returns the same generic NOT_AUTHORIZED for all of them. Work through these in order:

Cause	How to confirm
Issuer ID from the wrong tab	Compare against the Issuer ID shown above the table you generated the key in
Key ID and .p8 from different keys	The filename contains the Key ID: AuthKey_<KEYID>.p8 must match what you typed
Key revoked	The row shows a revoked state in the keys table
Wrong file entirely	An APNs key is also a .p8, and looks identical. It will never authenticate here
Corrupted file contents	See below

A valid .p8 is plain text, roughly four lines, and starts and ends exactly like this:

head -1 ~/Library/Keys/AuthKey_2X9R4HXF34.p8
# -----BEGIN PRIVATE KEY-----

If that first line is anything else, the file got mangled. It usually happens when the key was copied through a chat app, a ticket, or a spreadsheet, which strip or re-wrap the line breaks. Re-download it if you still can, otherwise revoke and regenerate.

403 on some checks but not others is not a key problem, it is a role problem. The key was created with Developer access. Roles cannot be changed after creation: revoke the key and generate a new one with App Manager.

A key that worked yesterday was probably revoked by a teammate, or the person who owned an individual key left the team. The keys table shows the current state.

Related

• How it works - what AuditStore does with the token once it has one
• App Information checks - the first checks that need a live key