← Back to blog

    App Store Connect API: Keys, Tokens and Examples

    Developer working through API token code

    The App Store Connect API is a REST API from Apple that automates work you would otherwise do by hand in the App Store Connect web portal: app metadata, in-app purchases, subscription pricing, customer reviews and more. It costs nothing extra, but you must request access, create a key, and sign a short-lived token for every session. This guide walks through each step, then shows what to automate and what to leave alone.

    Appxl
    Automate app store optimization
    appXL manages keyword optimization, metadata updates, and localization directly through App Store Connect, helping developers reduce manual work.

    TL;DR

    Table of Contents

    What the App Store Connect API does

    Apple describes it as a standards-based REST API that lets you automate tasks you perform in App Store Connect. As of October 2026, Apple’s overview lists programmatic management of in-app purchases, subscription metadata including pricing and availability, Game Center features, customer review retrieval and responses, and app metadata updates.

    It helps to be clear about the terms people mix up:

    • The App Store is the consumer marketplace where people find and download apps.
    • App Store Connect is the administrative side where you manage submission, metadata, distribution, TestFlight testing and analytics. Apple’s account overview frames it this way.
    • The App Store Connect API is the programmatic route into that same administrative side.

    There is no standalone App Store Connect app from Apple for these tasks. You use the web portal in a browser, or you call the API from code, a script or a CI job.

    If you are on the Apple Developer Enterprise Program, Apple notes you can use the Enterprise Program API instead. Everything below is about the standard App Store Connect API.

    What it costs

    The API itself has no price tag. It is a component of the Apple Developer Program, which Apple lists at $99 USD per year for individuals and organizations. If your membership is active, you can use the API. If it lapses, you lose the surrounding access too.

    The real cost is engineering time: writing the token logic, handling pagination and errors, and maintaining the code as Apple ships new versions. Apple publishes release notes for each API version so you can update server-side code and test against changes.

    Step 1: Get API access switched on

    Enrolling in the program does not unlock the API. According to Apple’s help page, the Account Holder must:

    1. Sign in to App Store Connect.
    2. Open Users and Access.
    3. Select the Integrations tab.
    4. Submit the request for API access.

    Until that happens, the Integrations tab will not give you keys, whatever your membership status. If you are a contractor or an agency, ask the Account Holder at your client early. This is the most common reason a project stalls on day one.

    Step 2: Choose the right key type

    Apple offers two kinds of keys, and the distinction matters.

    Team key Individual key
    Scope Applies across all apps in the account Linked to one user
    Who creates it Admins or the Account Holder, in Integrations A user, from their profile, if their role allows it
    Limits Set by the role you assign One active key per person
    Typical use CI servers and automation tools Personal scripts

    Three habits will save you pain:

    • Give each integration the lowest role that works. A marketing team can have programmatic access to custom product pages or marketing assets without the power to delete apps or touch banking details. Apple’s help page describes access by role, and it is the right foundation for any production workflow.
    • Name keys by purpose. Names cannot be changed later.
    • Plan for revocation. You cannot edit a key’s permissions after generation. If you picked the wrong access level, revoke the key and generate a new one.

    When you create a team key you will download a private key file (a .p8) and note two identifiers: the Key ID and the Issuer ID. Store the private key in a secrets manager, never in your repository.

    Step 3: Sign a token

    Every request carries a bearer token. Apple’s guide to generating tokens explains that you create a JSON Web Token (JWT, an open standard defined in RFC 7519) and sign it with your private key. The signing algorithm is ES256, which is ECDSA with the P-256 curve and SHA-256.

    A token has three parts:

    • Header: the algorithm (ES256), your Key ID (kid) and the type (JWT).
    • Payload: your Issuer ID (iss), an issued-at time, an expiration time (exp) and the audience (aud, appstoreconnect-v1).
    • Signature: produced with your .p8 key.

    A short Python example using the common PyJWT library:

    import time, jwt

KEY_ID = "YOUR_KEY_ID"
ISSUER_ID = "YOUR_ISSUER_ID"
PRIVATE_KEY = open("AuthKey_YOUR_KEY_ID.p8").read()

def make_token():
    now = int(time.time())
    payload = {"iss": ISSUER_ID, "iat": now,
               "exp": now + 15 * 60,
               "aud": "appstoreconnect-v1"}
    headers = {"kid": KEY_ID, "typ": "JWT"}
    return jwt.encode(payload, PRIVATE_KEY,
                      algorithm="ES256", headers=headers)

    Check Apple’s token page for the exact current claim requirements before shipping, since the individual-key payload differs from the team-key one.

    Token lifetime and the 401 problem

    Do not generate a token for every request. Reuse one until it expires. Apple states that tokens with an expiration more than 20 minutes in the future are generally rejected for most resources, so the sample above uses 15 minutes. Cache the token, refresh it a minute or two before expiry, and you will avoid most 401 Unauthorized errors.

    When you do hit a 401, check these in order:

    1. The Key ID in the header matches the key you signed with.
    2. The Issuer ID is correct (team keys only).
    3. The expiration is within 20 minutes of the issue time.
    4. The system clock on your server is accurate.
    5. The key has not been revoked.

    Step 4: Send your first request

    The base URL is https://api.appstoreconnect.apple.com. A first call that lists your apps:

    curl -H "Authorization: Bearer $TOKEN" \
  "https://api.appstoreconnect.apple.com/v1/apps"

    A 200 response with a JSON list of your apps confirms the key, role and token all work. If you get a 403 instead, the token is fine but the key’s role does not allow that resource. That is the cue to review the role, and, since keys cannot be edited, to create a replacement.

    A write example comes from Apple’s Modify an app endpoint, a PATCH to /v1/apps/{id} that updates app information such as bundle ID, primary locale, price schedule and global availability:

    curl -X PATCH \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"data":{"type":"apps","id":"APP_ID",
       "attributes":{"primaryLocale":"en-US"}}}' \
  "https://api.appstoreconnect.apple.com/v1/apps/APP_ID"

    Test writes against a non-production app first. A bad PATCH to a live listing is as real as a bad edit in the web portal.

    Worked examples worth automating

    Not every task deserves a script. These are the ones that pay back fastest.

    Metadata across many locales

    If you maintain more than a handful of storefront languages, editing titles, subtitles, keyword fields and descriptions by hand is slow and error-prone. Apple’s overview points to this as the core value: teams can synchronize metadata updates and pricing changes across storefronts without manual submissions. A typical script reads a spreadsheet of translated strings, then writes them to each locale’s version record. Our localization guide covers what to put in those strings.

    Translated metadata flowing into locale records

    Review retrieval and responses

    The API lets you pull customer reviews and post responses. A simple job fetches new reviews each morning, flags low ratings in your team chat and queues a reply draft for a human to approve. Keep a person in the loop for replies.

    Subscription pricing and offer codes

    Subscription metadata, pricing and availability are manageable through the API. Apple also documents subscription offer codes, which let you give people a free or discounted period to acquire, retain or win back subscribers. Scripting price changes beats clicking through every storefront.

    Custom product pages and marketing assets

    If paid acquisition is part of your plan, custom product pages let you match the landing page to the ad. Our free custom product page URL generator builds the links, and the paid UA and custom product pages guide explains how to pair ads with pages.

    Security practices that hold up

    Signed tokens are more work than a simple static key, but they give you tighter control. The practical rules:

    • Keep one key per integration so you can revoke one without breaking the rest.
    • Use team keys for servers and individual keys only for personal scripts. An individual can hold only one active key at a time.
    • Assign roles so the key can do the job and nothing more. A metadata automation does not need permission to manage finance information.
    • Keep the .p8 out of source control and out of chat messages. Rotate it when someone with access leaves.
    • Log every write your automation makes, with the before and after values, so you can roll back a bad change.

    Apple’s help page also notes that individual users added through Users and Access get only the access you grant them. If you are enrolled as an individual, you can give up to 50 additional users access to your content in App Store Connect.

    Build it yourself or use a tool on top?

    The API gives you the plumbing. It does not tell you what to write. Deciding which keywords to target, how to rewrite a subtitle, which locales are worth the effort and whether a change helped rankings is a separate job, and that job is ASO.

    Teams usually land in one of three places:

    Approach Good for Cost to you
    Direct scripts against the API Release pipelines, pricing, bulk edits with fixed inputs Engineering time and upkeep
    Data-only ASO dashboards Seeing rankings and keyword scores Someone still makes every change by hand
    An automated ASO agent that ships changes itself Ongoing optimization without manual updates A subscription

    If your plan is to pull rankings from one place and then paste changes into App Store Connect, the API alone does not close that loop. You still write the logic that decides what to change.

    Our perspective

    We built appXL because the gap we kept seeing was not data. Most developers already know which keywords matter. What they lack is the time to rewrite metadata, localize it into dozens of languages and push it to App Store Connect every time the market moves.

    Our perspective — overview diagram

    So we treat the API as the delivery layer, not the product. appXL analyzes competitors and market trends, rewrites metadata, localizes listings into over 35 languages and ships updates directly to App Store Connect. Then it keeps monitoring rankings daily to see what moved.

    Our advice if you are choosing: script the API yourself for things with fixed inputs, like pricing or build distribution. Do not hand-write a pipeline for work that needs judgment about keywords and wording, because that is where manual maintenance quietly eats a team’s week. Whichever route you take, give the integration the narrowest role you can and keep a change log.

    — Samuel

    Where appXL fits

    If you want the optimization work done rather than the plumbing built, appXL handles keyword optimization, metadata rewriting, localization, review management, rank monitoring and custom product page optimization, and delivers changes through App Store Connect. See the Starter, Growth and Scale plans or read how the AI ASO agent works. If you are still assessing your listing, the ASO checklist is a good place to start.

    Common mistakes

    • Assuming enrollment equals access. The Account Holder must request API access first.
    • Minting a token per request. Reuse tokens until expiry and keep the lifetime under 20 minutes.
    • Over-privileged keys. Pick the narrowest role, since you cannot edit it later.
    • Testing on a live app. Use a test app for your first writes.
    • Automating without review. Generated copy still needs to follow listing best practices and Apple’s guidelines.

    FAQ

    How do I get my App Store Connect API key?

    The Account Holder first requests API access under Users and Access, then the Integrations tab. After approval, Admins or the Account Holder can generate team keys there. Individual users can generate their own key from their profile if their role allows it. Download the private key file when prompted and record the Key ID and Issuer ID.

    What is the difference between the App Store and App Store Connect?

    The App Store is where consumers find and download apps. App Store Connect is where developers manage submission, metadata, distribution, TestFlight testing and analytics. The API is the programmatic way to do many of those administrative tasks.

    How much does the App Store Connect API cost?

    Nothing beyond your Apple Developer Program membership, which is $99 USD per year according to Apple. The API is a part of that membership, not a separate product. Your real cost is the development time to build and maintain the integration.

    Is there an App Store Connect app?

    Apple does not offer a standalone App Store Connect app for administrative tasks. You work in a web browser on App Store Connect, or programmatically through the API.

    Sources

    Written with BabyLoveGrowth’s tools

    ← Back to blog