Create API keys used to sign JWTs and authorize API requests.
The App Store Connect API requires a JSON Web Token (JWT) to authorize each request you make to the API. You generate JWTs using an API key downloaded from App Store Connect.
Best way to hide API key in source code. Ask Question Asked 6 years, 1 month ago. It may be beneficial to outline the concept of of an API key for readers unfamiliar with it. An API key is a secret awarded to the developer of some software interacting with a service (typically a web service).
An API key has two parts: a public portion that Apple keeps, and a private key that you download. The private key enables you to sign tokens that authorize access to your data in App Store Connect and the Apple Developer website.
Important
Secure your private keys as you would other credentials, such as usernames and passwords. If you suspect a private key is compromised, immediately revoke the key in App Store Connect. See Revoking API Keys for details.
App Store Connect API keys are unique to the App Store Connect API and cannot be used for other Apple services.
When you create an API key, assign it a role that determines the key's access to areas of the App Store Connect API and permissions for performing tasks. For example, keys with the Admin role have broad permissions and can do things like create new users and delete users. The roles that apply to keys are the same roles that apply to users on your team; for more information, see role permissions in App Store Connect Help. API keys can access all apps, regardless of their role.
Note
An API key's access cannot be limited to specific apps.
To generate keys, you must have an Admin account in App Store Connect. You may generate multiple API keys with any roles you choose.
To generate an API key to use with the App Store Connect API, log in to App Store Connect.
Select Users and Access, and then select the API Keys tab.
Pgp generate public key from private key. Click Generate API Key or the Add (+) button.
Enter a name for the key. The name is for your reference only and is not part of the key itself.
Under Access, select the role for the key.
Click Generate.
The new key's name, key ID, a download link, and other information appears on the page.
Once you've generated your API key, you are given the opportunity to download the private half of the key. The private key is available for download a single time.
Log in to App Store Connect.
Select Users and Access, and then select the API Keys tab.
Click 'Download API Key' link next to the new API key.
The download link appears only if the private key has not yet been downloaded. Apple does not keep a copy of the private key.
Store your private key in a safe place.
Important
Keep your API keys secure and private. You should never share your keys, store keys in a code repository, or include keys in client-side code.
If the key becomes lost or compromised, remember to revoke it immediately. See Revoking API Keys for more information.
Create JSON Web Tokens signed with your private key to authorize API requests.