How to create an App Store Connect API key, step by step

The steps

1. Request API access (first time only). Sign in to App Store Connect as the Account Holder, open Users and Access → Integrations. If you see a Request Access button, click it, agree to the terms, and submit. Access is usually granted immediately. Individual developers are their own Account Holder; on a company team, you may need to ask the person who owns the membership.
2. Create the key. On the same Integrations page, under Team Keys, click the + (Generate API Key) button. Give the key a descriptive name – the name is only a label, so something like "Itsyconnect on my MacBook" beats "Key 2".
3. Choose the access role. The role decides what the key can see. Admin gives full API access, including sales reports, finance data, and analytics. App Manager can edit apps and TestFlight but cannot read sales or analytics. Developer is enough for uploading builds from CI. Pick the smallest role that covers your use case – but note that dashboards and analytics tools genuinely need Admin, because Apple only returns download, revenue, and engagement data to Admin keys.
4. Download the .p8 file – you get one chance. Click Generate, then Download API Key. The .p8 private key downloads once and can never be downloaded again; if you lose it, you revoke the key and create a new one. Store it somewhere safe (a password manager works well) and never commit it to a repository.
5. Note the issuer ID and key ID. The issuer ID appears at the top of the Integrations page and is the same for every key on your team. The key ID is listed next to your new key. API clients ask for all three: issuer ID, key ID, and the .p8 file – together they let a tool sign short-lived tokens to authenticate with Apple.

Which role do you actually need?

Keeping the key safe

• Treat the .p8 file like a password: it can read your revenue and edit your apps. Never put it in a git repository, a shared drive, or an email.
• A key cannot be edited after creation – you cannot rename it or change its role. To change anything, revoke it and generate a new one.
• Revoking a key takes effect immediately and breaks every tool using it, which makes per-tool keys a good habit: one key per app or CI system means revoking one thing breaks one thing.
• Check where a local-first tool stores the key. Itsyconnect, for example, encrypts it with AES-256-GCM, keeps the encryption key in the macOS Keychain, and sends the private key only to Apple – never to any other server.