Overview
An App Store Connect API key lets Spek read and update your listings through Apple's official API, without ever holding your Apple ID. You create the key, you own it, and you can revoke it at any time from Apple's side.
The whole job is one visit to App Store Connect and three values pasted into Spek.
What you need
Spek talks to App Store Connect with its official API, authenticated by a key you create and own. Three values make that work.
| Value | Where it comes from | Looks like |
|---|---|---|
| Issuer ID | Shown once at the top of the Integrations tab. It is the same for every key in your account. | 57246542-96fe-1a63-e053-0824d011072a |
| Key ID | Listed next to the key in the same table. | 2X9R4HXF34 |
| Private key | The .p8 file. Apple lets you download it exactly once. | AuthKey_2X9R4HXF34.p8 |
Create the API key
Open Users and Access, then Integrations
In App Store Connect, go to Users and Access and select the Integrations tab. If you cannot see it, your role does not allow key management. See below.
Generate an App Store Connect API key
Give it a name you will recognise later, such as Spek. Choose an access role. App Manager is enough for everything Spek does.
Download the .p8 file immediately
Apple offers this download once. If you lose the file you cannot recover it, only revoke the key and create another.
Copy the issuer ID and the key ID
The issuer ID sits above the key table, the key ID in the row itself.
The key table
Everything after the first step happens on one screen. The Team Keys table lists the keys in your account, and the two values Spek asks for are both on it.
The row gains a Download action as soon as the key exists. Take it now: it disappears after the first use, and there is no way to ask Apple for the file again.
The Issuer ID sits above the table and is the same for every key in the account. The Key ID is the short code in the row you just created. Copying the wrong one is the most common reason a credential is rejected.
Add it to Spek
Open the connect step during onboarding, or Settings and then Integrations for a workspace that is already set up. Paste the issuer ID and key ID, then upload the .p8 file.
The file contents look like this. Include the header and footer lines.
-----BEGIN PRIVATE KEY-----
MIGTAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBHkwdwIBAQQg...
-----END PRIVATE KEY-----Spek encrypts the key at rest and decrypts it in memory only to sign a request. It is never written to a log and never leaves your workspace.
Which role to give the key
The role you give the key is the ceiling on what Spek can do, no matter what you ask it to do.
- App Manager is the recommended role. It covers reading your catalog, editing listing metadata and submitting changes.
- Developer can read but cannot edit listing metadata, so proposals will still appear and publishing will fail.
- Admin works, and grants far more than Spek needs. Prefer App Manager.
If the key is rejected
Spek checks the credential as soon as you save it, so a problem shows up straight away rather than during a run.
| What you see | Usually means |
|---|---|
| The key is rejected immediately | The issuer ID and key ID belong to different accounts, or the .p8 is not the file for this key ID. |
| It worked before and now fails | The key was revoked in App Store Connect, or the user who created it lost access. Create a new key and paste it in. |
| Connected, but no apps to choose from | The key's role cannot see the app, or the app is not yet in the account this key belongs to. |
| Proposals appear but publishing fails | The role is read-only. Recreate the key with App Manager access. |
Still stuck? Get in touch and include the key ID, never the key file itself.
Common questions
I lost the .p8 file. Can I download it again?
No. Apple offers that download once, which is why the console warns This key can only be downloaded once. Revoke the key, create another with Generate API Key, and paste the new values in.
Can I use one key for several workspaces?
You can, and you should not. A shared credential is the one thing that genuinely links otherwise independent developer accounts. Give each workspace its own key.
Does Spek ever show my private key back to me?
No. It is encrypted at rest and decrypted in memory only to sign a request. Settings shows the issuer and key ID, never the key.
What happens if I revoke the key in App Store Connect?
Spek loses access immediately and says so on the integrations page. Nothing you already published is affected.