Overview
Spek reaches App Store Connect only through its official token API. There is no login, no stored session and no browser automation anywhere in the product.
That is a safety boundary rather than an implementation detail, and this page explains what it rules out and why.
Token APIs
Every connection Spek makes to App Store Connect goes through Apple's official, token-authenticated API. Spek signs the workspace's App Store Connect API key into a short-lived token for each request.
There is no other path, and this is deliberate.
- No Apple ID login.
- No username and password, and no app-specific password.
- No stored web session and no cookies.
- No headless browser driving App Store Connect on your behalf.
Credential isolation
Each workspace brings its own credential. Keys are encrypted at rest and decrypted in memory only to sign a request.
Nothing is shared between workspaces: not a key and not an identity. Two workspaces belonging to two different developer accounts have no link to each other inside Spek.
Public store data
Keyword research needs public store data: search results, autocomplete suggestions and public listing metadata. None of that is tied to your account, and Spek collects it without one.
That public collection is a separate system from the authenticated connection above, and the two are never wired together. Nothing in the research path can reach your credential, and nothing in the credential path routes through the research path.
Disconnecting
Open Settings and then Integrations to see the current status of a connection or to disconnect it. Disconnecting removes the stored credential from Spek.
You can also revoke the key from the store's own console, which takes effect immediately regardless of what Spek holds. For an App Store Connect key that is Users and Access, then Integrations, then revoke the .p8 key.
Disconnecting does not undo anything already published. See what the agent will never do for what could have reached a store in the first place.
Common questions
Where do I see what is connected?
Settings, then Integrations. A connected App Store Connect account is named by the public seller name of the apps on that key, or by the label you gave it. The key's Issuer and Key ID are never displayed.
Could connecting Spek get my developer account banned?
The pattern that causes associated-account bans is interactive login: a shared browser fingerprint, cookies and address across accounts. Spek uses none of those. It signs each request with your own key, which is what Apple publishes this API for.
Does the public keyword research use my account?
No. Search results, autocomplete and public listing data are collected without any account, by a system that is deliberately separate from the authenticated path and never wired into it.