How to get an App Store Connect API key (2026)

What an App Store Connect API key is

The App Store Connect API lets software talk to App Store Connect programmatically. Instead of clicking through the website or Xcode, a tool authenticates with an API key and can create app records, upload builds, manage TestFlight, set metadata, and submit for review.

Authentication works by signing a JSON Web Token, a JWT, with your private key. That token proves the request is yours. To build the token, a tool needs three pieces of information from the key you generate: the Key ID, the Issuer ID, and the .p8 private key file.

Generate the key step by step

You need to be an Admin or the Account Holder on the Apple Developer account to create a team key.

1. Sign in to App Store Connect at appstoreconnect.apple.com with your Apple Developer account.
2. Open Users and Access from the top navigation.
3. Select the Integrations tab, then choose App Store Connect API.
4. Generate a new key. Give it a name and assign an access role that matches what the key needs to do, such as App Manager or Admin. Use the least access the task requires.
5. Download the .p8 file. After creating the key, download the private key file, which ends in .p8. Apple allows this download only once.
6. Note the Key ID and Issuer ID. The Key ID is a 10-character identifier shown next to the key, for example T9GPZ92M7K. The Issuer ID is a UUID shown at the top of the keys page, for example c055ca8c-e5a8-4836-b61d-aa5794eeb3f4, and it is shared across your team's keys.

The Key ID and Issuer ID stay visible in App Store Connect indefinitely. The .p8 does not. If you lose it, you cannot re-download it. You revoke the key and generate a new one.

Store and use the key safely

The .p8 is a private key, so treat it like a password.

1. Save the .p8 securely. Keep it in a password manager or a secrets store, not in a shared folder or a public code repository.
2. Keep the three values together. A tool needs the Key ID, the Issuer ID, and the .p8 to authenticate.
3. Scope and rotate. Use a role with only the access the job requires, and revoke keys you no longer use. If a key may be exposed, revoke it and create a new one.
4. Use it for automation. Build and submission tools, CI systems, and apps like AppFlight use the key to upload builds and submit to the App Store without a person signing in each time.

How AppFlight uses the key

AppFlight uses an App Store Connect API key to handle code signing, upload to TestFlight, and submit to the App Store on your behalf from inside the app, so you do not run these steps in Xcode by hand. You generate the key in your own App Store Connect account and provide it once, then AppFlight uses it to drive the submission flow and, if Apple rejects a build, to resubmit after working on the fix. You stay in control of the key and can revoke it at any time. AppFlight does not guarantee approval. Apple reviews every app, and submitted is not the same as approved.