Create an App Store Connect API key

Slipway talks to Apple through the official App Store Connect API. To do that it needs a team API key: a private key file (.p8) plus two identifiers, the Issuer ID and the Key ID. You create the key once in App Store Connect, then hand it to Slipway.

What you need#

• An App Store Connect account with the Account Holder or Admin role. Only these roles can generate team API keys.
• A web browser signed in to App Store Connect.
• A safe place to keep the downloaded file, such as a password manager.

Generate the key#

1. In App Store Connect, open Users and Access, then the Integrations tab.
2. Under App Store Connect API, select Team Keys.
   • If your team has never used the API, the Account Holder first has to click Request Access and accept the terms. This only happens once per team.
3. Click Generate API Key, or the + button if the team already has keys.
4. Enter a Name you'll recognise later, for example Slipway – MacBook Pro.
5. Under Access, choose App Manager. This is the role Slipway asks for. See Choosing a role below.
6. Click Generate.
7. In the new key's row, click Download API Key and save the file. It's named AuthKey_<KEY ID>.p8.
8. Copy the Issuer ID shown above the keys table, and note the Key ID in the key's row.

Warning — Apple lets you download a key's .p8 file only once. If you lose it, revoke the key and generate a new one.

Slipway links straight to this page: the Open App Store Connect link on its connect screen opens Users and Access ▸ Integrations for you.

What each value is#

Keep the file name as Apple gave it. When you add the key, Slipway reads the Key ID from an AuthKey_<KEY ID>.p8 file name and fills it in for you.

Choosing a role#

Slipway's connect screen asks for a key with the App Manager role. That role covers the day-to-day release work: metadata, screenshots, builds, TestFlight, customer reviews and submissions.

A few team-level pages depend on what Apple allows a key's role to do:

• Users & Access. Inviting people and changing roles generally needs an Admin key.
• Sales & Analytics. Apple limits sales and finance reports to roles with access to reports.
• Provisioning. Certificates, identifiers and profiles follow Apple's rules for each role.

Apple's role rules decide. If a page shows an error from App Store Connect about permissions, the key's role doesn't allow that action. A key keeps the role it was created with, so to get a different role, generate a new key and add it in place of the old one.

One API key connects one team. If you work with several teams, create a key in each team and add them all. See Add your first team.

Keep the key safe#

The .p8 file gives API access to your team's apps, so treat it like a password.

• Don't commit it to a repository or paste it into chat or email.
• When you add the key, Slipway stores its contents in the macOS Keychain on this Mac. You can then move the original file into a password manager or other secure storage.
• You need the file again to reconnect the team on another Mac, or after removing the account in Slipway.

Revoke a key#

If a key is lost, leaked, or no longer needed:

1. In App Store Connect, go to Users and Access ▸ Integrations ▸ Team Keys.
2. Find the key by name and Key ID, and click Revoke.
3. In Slipway, open Settings ▸ Accounts, click Remove… next to that team, and confirm. This deletes the key from the Keychain.
4. Generate a new key and add it, if you still want the team in Slipway.

Revoked keys stop working immediately. Until you remove the account, Slipway shows App Store Connect errors for that team. See Troubleshooting and FAQ.