Overview
An App Store Connect API key lets Spek read and update your listings through Apple's official API, without ever holding your Apple ID. You create the key, you own it, and you can revoke it at any time from Apple's side.
The whole job is one visit to App Store Connect and three values pasted into Spek.
What you need
Spek talks to App Store Connect with its official API, authenticated by a key you create and own. Three values make that work.
| Value | Where it comes from | Looks like |
|---|---|---|
| Issuer ID | Shown once at the top of the Integrations tab. It is the same for every key in your account. | 57246542-96fe-1a63-e053-0824d011072a |
| Key ID | Listed next to the key in the same table. | 2X9R4HXF34 |
| Private key | The .p8 file. Apple lets you download it exactly once. | AuthKey_2X9R4HXF34.p8 |
Create the API key
Open Users and Access, then Integrations
In App Store Connect, go to Users and Access and select the Integrations tab. If you cannot see it, your role does not allow key management. See below.
Generate an App Store Connect API key
Give it a name you will recognise later, such as Spek. Choose an access role. App Manager is enough for everything Spek does.
Download the .p8 file immediately
Apple offers this download once. If you lose the file you cannot recover it, only revoke the key and create another.
Copy the issuer ID and the key ID
The issuer ID sits above the key table, the key ID in the row itself.
The key table
Everything after the first step happens on one screen. The Team Keys table lists the keys in your account, and the two values Spek asks for are both on it.
The row gains a Download action as soon as the key exists. Take it now: it disappears after the first use, and there is no way to ask Apple for the file again.
The Issuer ID sits above the table and is the same for every key in the account. The Key ID is the short code in the row you just created. Copying the wrong one is the most common reason a credential is rejected.
Add it to Spek
Open the connect step during onboarding, or Settings and then Integrations for a workspace that is already set up. Paste the issuer ID and key ID, then upload the .p8 file.
The file contents look like this. Include the header and footer lines.
-----BEGIN PRIVATE KEY-----
MIGTAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBHkwdwIBAQQg...
-----END PRIVATE KEY-----Spek encrypts the key at rest and decrypts it in memory only to sign a request. It is never written to a log and never leaves your workspace.
Which role to give the key
The role you give the key is the ceiling on what Spek can do, no matter what you ask it to do.
- App Manager is the recommended role. It covers reading your catalog, editing listing metadata and submitting changes.
- Developer can read but cannot edit listing metadata, so proposals will still appear and publishing will fail.
- Admin works, and grants far more than Spek needs. Prefer App Manager.
If the key is rejected
Spek checks the credential as soon as you save it, so a problem shows up straight away rather than during a run.
| What you see | Usually means |
|---|---|
| The key is rejected immediately | The issuer ID and key ID belong to different accounts, or the .p8 is not the file for this key ID. |
| It worked before and now fails | The key was revoked in App Store Connect, or the user who created it lost access. Create a new key and paste it in. |
| Connected, but no apps to choose from | The key's role cannot see the app, or the app is not yet in the account this key belongs to. |
| Proposals appear but publishing fails | The role is read-only. Recreate the key with App Manager access. |
Still stuck? Get in touch and include the key ID, never the key file itself.
Common questions
I lost the .p8 file. Can I download it again?
No. Apple offers that download once, which is why the console warns This key can only be downloaded once. Revoke the key, create another with Generate API Key, and paste the new values in.
Before replacing it, confirm the developer account and the apps that use the connection. Keep the new private file in the intended credential flow and out of email or chat. After updating the connection, check its status rather than assuming the replacement is valid because the file uploaded.
Can I use one key for several workspaces?
You can, and you should not. A shared credential is the one thing that genuinely links otherwise independent developer accounts. Give each workspace its own key.
Does Spek ever show my private key back to me?
No. It is encrypted at rest and decrypted in memory only to sign a request. Settings shows the connected account label, never the private key.
What happens if I revoke the key in App Store Connect?
Spek loses access immediately and says so on the integrations page. Nothing you already published is affected.
How do I check that the three connection values belong together?
Use the issuer ID from the same App Store Connect account where the key was created, the key ID from that key's row, and the corresponding private key file. A correct-looking ID paired with another key's file cannot authenticate the connection. Check the developer account first when you manage several accounts. If the original file is lost, use Apple's key management controls to replace the credential; do not substitute a file from another workspace or send a private key to support for inspection.
Why can the connection work while a particular action is unavailable?
Authenticating a key and being allowed to perform every operation are different checks. The key's access role, the apps visible to that account, your Spek workspace role and the current App Store version state can each affect an action. A successful connection therefore does not mean that a submitted version is editable or that every team member can publish. Read the message attached to the blocked action and check the relevant account or version, rather than creating a broader credential as the first troubleshooting step.
What is a sensible way to organize credentials for client apps?
Keep each client's developer account and workspace clear, and use a credential owned by the account whose apps are being connected. Give the connection a recognizable label so team members can identify it without seeing the secret itself. Do not distribute one account's private key across unrelated clients to simplify setup. Workspace membership controls who can operate inside Spek; Apple's key management controls the provider credential. Reviewing both makes it easier to remove access when a client engagement or a team member's responsibilities change.
What information helps support investigate a connection problem?
Describe whether the credential was rejected, the expected app was missing, or a later operation failed. Include the workspace, app, approximate time and the exact error message after removing any sensitive values. A non-secret key identifier can help identify which connection you mean, but the private key file, Apple ID password and authentication tokens must stay out of the message. This distinction helps the team investigate the correct stage without turning a support conversation into another place where account credentials are stored.