Overview
Spek supports connections for App Store and Google Play listing work. The credential details on this page cover App Store Connect, which Spek reaches only through its official token API. There is no login, no stored session and no browser automation anywhere in the product.
That is a safety boundary rather than an implementation detail, and this page explains what it rules out and why.
Token APIs
Every connection Spek makes to App Store Connect goes through Apple's official, token-authenticated API. Spek signs the workspace's App Store Connect API key into a short-lived token for each request.
There is no other path, and this is deliberate.
- No Apple ID login.
- No username and password, and no app-specific password.
- No stored web session and no cookies.
- No headless browser driving App Store Connect on your behalf.
Credential isolation
Each workspace brings its own credential. Keys are encrypted at rest and decrypted in memory only to sign a request.
Nothing is shared between workspaces: not a key and not an identity. Two workspaces belonging to two different developer accounts have no link to each other inside Spek.
Public store data
Keyword research needs public store data: search results, autocomplete suggestions and public listing metadata. None of that is tied to your account, and Spek collects it without one.
That public collection is a separate system from the authenticated connection above, and the two are never wired together. Nothing in the research path can reach your credential, and nothing in the credential path routes through the research path.
Disconnecting
Open Settings and then Integrations to see the current status of a connection or to disconnect it. Disconnecting removes the stored credential from Spek.
You can also revoke the key from the store's own console, which takes effect immediately regardless of what Spek holds. For an App Store Connect key that is Users and Access, then Integrations, then revoke the .p8 key.
Disconnecting does not undo anything already published. See what the agent will never do for what could have reached a store in the first place.
Common questions
Where do I see what is connected?
Settings, then Integrations. A connected App Store Connect account is named by the public seller name of the apps on that key, or by the label you gave it. The key's Issuer and Key ID are never displayed.
Check the selected workspace before interpreting the list, particularly when you belong to several teams. The label identifies an account without displaying its private credential. Use the relevant app and connection context when reporting a problem rather than copying secret material into the message.
Could connecting Spek get my developer account banned?
The pattern that causes associated-account bans is interactive login: a shared browser fingerprint, cookies and address across accounts. Spek uses none of those. It signs each request with your own key, which is what Apple publishes this API for.
Does the public keyword research use my account?
No. Search results, autocomplete and public listing data are collected without any account, by a system that is deliberately separate from the authenticated path and never wired into it.
Does connecting an account authorize automatic listing changes?
Connecting gives Spek the account access allowed by the credential, but it does not turn research output into permission to publish. The proposal workflow prepares changes for review, and accepted metadata is saved as a Spek draft. An authorized user must separately start a publishing action. Keep that distinction in mind when evaluating access: the provider key sets an upper limit on available operations, while workspace permissions and the action you take determine which supported operation is actually requested.
How are public competitor data and my private store account different?
A competitor's public listing and search position can be researched without access to its developer account. Your own authenticated connection is used for the app data and actions your store account permits. Spek keeps these purposes separate. Seeing a competing app in research does not mean Spek has that developer's credentials, private sales reports or publishing access. When interpreting a comparison, use the public listing and search evidence shown, rather than treating it as a view into another company's account.
What should I review when a team member leaves?
Review their membership and role in each Spek workspace they used, and separately review access in the developer account. A workspace invitation and an App Store Connect API key are different forms of access; changing one should not be assumed to change the other. If a provider key needs to be revoked, use the store's own controls and then check the affected integration in Spek. Previously published content remains on the store until someone makes another authorized change to it.
What should I check before disconnecting a store connection?
Identify which apps use the connection and whether anybody is preparing a publish or waiting for an operation to finish. Disconnecting removes Spek's stored credential, so further authenticated reads and writes cannot continue through that connection. It is not a rollback of the app's public listing and it is not the same as deleting the workspace. If you are replacing credentials, keep a record of the account and affected apps without copying the secret into notes or support messages.