Install & authenticate the App Store Connect CLI

Install

npm install -g @appeeky/app-store-connect-cli

This installs both binaries:

Binary	Role
`appstore`	CLI
`appstore-mcp`	MCP server (stdio)

appstore --help
appstore-mcp --help

Also available with pnpm add -g, yarn global add, or bun add -g.

Create an API key

Open the API keys page

In App Store Connect, go to Users and Access → Integrations → App Store Connect API.

Create a Team key

Pick the lowest role that covers your work: App Manager for most publishing, Finance or Sales for reports, Admin for users.

Save the Key ID, Issuer ID, and .p8

Download AuthKey_<KEYID>.p8. Apple lets you download it only once.

Add it to appstore

appstore accounts add my-team \
  --key-id ABC123DEFG \
  --issuer-id 00000000-0000-0000-0000-000000000000 \
  --private-key-path ~/.appstoreconnect/AuthKey_ABC123DEFG.p8 \
  --default
appstore whoami

The .p8 file is a password. Keep it out of source control. If it leaks, revoke the key in App Store Connect and create a new one.

Team vs Individual keys

	Team key	Individual key
Created under	Users and Access → Integrations	Your own user profile
Issuer ID	Required	None: leave `--issuer-id` out

appstore signs short-lived ES256 tokens itself (19 minutes, under Apple’s 20-minute limit). Nothing leaves your machine except requests to Apple.

Credentials

Resolved in this order:

#	Source
1	Flags: `--key-id`, `--issuer-id`, `--private-key <path\|pem>`
2	Environment: `ASC_KEY_ID`, `ASC_ISSUER_ID`, and `ASC_PRIVATE_KEY` (the PEM) or `ASC_PRIVATE_KEY_PATH`
3	`--account <id>`, or the default account in `~/.config/appstore/config.json`

Passing --account always selects that config account, even when ASC_* variables are set.

Variable	Use
`ASC_KEY_ID`	API key id
`ASC_ISSUER_ID`	Issuer id (Team keys)
`ASC_PRIVATE_KEY`	PEM contents; `\n` escapes allowed
`ASC_PRIVATE_KEY_PATH`	Path to the `.p8`
`ASC_APP_ID`	Default `--app`
`ASC_VENDOR_NUMBER`	Default vendor number for sales and finance reports

# CI: key from a secret
export ASC_KEY_ID=ABC123DEFG
export ASC_ISSUER_ID=00000000-0000-0000-0000-000000000000
export ASC_PRIVATE_KEY="$APP_STORE_CONNECT_P8"
appstore whoami

Multiple accounts

Agencies and studios can keep one named account per team. The config file is written with 0600 permissions.

appstore accounts add studio --key-id ABC123DEFG --issuer-id 0000… \
  --private-key-path ~/keys/AuthKey_ABC123DEFG.p8 --vendor-number 85012345 --default
appstore accounts add client-acme --key-id XYZ987WVUT --issuer-id 1111… \
  --private-key-path ~/keys/AuthKey_XYZ987WVUT.p8
appstore accounts list
appstore accounts check
appstore accounts use client-acme
appstore --account client-acme apps list

App Store Connect lists every app a key can see, so registering apps is optional. Register one to set a default app or route calls automatically:

appstore apps register 1234567890 --to studio --bundle-id com.studio.app --default
appstore apps registered

When an app is registered under exactly one account, MCP tools and ops call pick that account automatically.

Local MCP server

{
  "mcpServers": {
    "app-store-connect": {
      "command": "appstore-mcp",
      "env": {
        "ASC_KEY_ID": "ABC123DEFG",
        "ASC_ISSUER_ID": "00000000-0000-0000-0000-000000000000",
        "ASC_PRIVATE_KEY_PATH": "/path/to/AuthKey_ABC123DEFG.p8"
      }
    }
  }
}

appstore-mcp also takes --key-id, --issuer-id, --private-key, --account, and --read-only. With accounts in the config file, "command": "appstore-mcp" alone is enough.

Write safety

Mechanism	Behavior
`--confirm`	Required for every write command and for `ops call` / `api` on writes
`--read-only`	The client refuses every non-GET request
`appstore-mcp --read-only`	Same, for agent sessions

No key on this machine? Use the hosted MCP on your Appeeky connection instead.

Overview

Google Play CLI

App Store Connect CLI

Install & authenticate the App Store Connect CLI

Install

Create an API key

Team vs Individual keys

Credentials

Multiple accounts

Local MCP server

Write safety

​Install

​Create an API key

​Team vs Individual keys

​Credentials

​Multiple accounts

​Local MCP server

​Write safety

Install

Create an API key

Team vs Individual keys

Credentials

Multiple accounts

Local MCP server

Write safety