> ## Documentation Index
> Fetch the complete documentation index at: https://docs.appeeky.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Install & authenticate the App Store Connect CLI

> Install appstore, create an App Store Connect API key, and configure credentials, environment variables, and multiple accounts.

## Install

```bash theme={"theme":{"light":"github-light","dark":"github-dark"}}
npm install -g @appeeky/app-store-connect-cli
```

This installs both binaries:

| Binary | Role |
| - | - |
| `appstore` | CLI |
| `appstore-mcp` | MCP server (stdio) |

```bash theme={"theme":{"light":"github-light","dark":"github-dark"}}
appstore --help
appstore-mcp --help
```

Also available with `pnpm add -g`, `yarn global add`, or `bun add -g`.

## Create an API key

**1. Open the API keys page**

In App Store Connect, go to **Users and Access → Integrations → App Store Connect API**.

**2. Create a Team key**

Pick the lowest role that covers your work: **App Manager** for most publishing, **Finance** or **Sales** for reports, **Admin** for users.

**3. Save the Key ID, Issuer ID, and .p8**

Download `AuthKey_<KEYID>.p8`. Apple lets you download it only once.

**4. Add it to appstore**

```bash theme={"theme":{"light":"github-light","dark":"github-dark"}}
appstore accounts add my-team \
  --key-id ABC123DEFG \
  --issuer-id 00000000-0000-0000-0000-000000000000 \
  --private-key-path ~/.appstoreconnect/AuthKey_ABC123DEFG.p8 \
  --default
appstore whoami
```

> [!WARNING]
>
> The `.p8` file is a password. Keep it out of source control. If it leaks, revoke the key in App Store Connect and create a new one.

### Team vs Individual keys

| | Team key | Individual key |
| - | - | - |
| Created under | Users and Access → Integrations | Your own user profile |
| Issuer ID | Required | None: leave `--issuer-id` out |

`appstore` signs short-lived ES256 tokens itself (19 minutes, under Apple's 20-minute limit). Nothing leaves your machine except requests to Apple.

## Credentials

Resolved in this order:

| # | Source |
| - | - |
| 1 | Flags: `--key-id`, `--issuer-id`, `--private-key <path\|pem>` |
| 2 | Environment: `ASC_KEY_ID`, `ASC_ISSUER_ID`, and `ASC_PRIVATE_KEY` (the PEM) or `ASC_PRIVATE_KEY_PATH` |
| 3 | `--account <id>`, or the default account in `~/.config/appstore/config.json` |

Passing `--account` always selects that config account, even when `ASC_*` variables are set.

| Variable | Use |
| - | - |
| `ASC_KEY_ID` | API key id |
| `ASC_ISSUER_ID` | Issuer id (Team keys) |
| `ASC_PRIVATE_KEY` | PEM contents; `\n` escapes allowed |
| `ASC_PRIVATE_KEY_PATH` | Path to the `.p8` |
| `ASC_APP_ID` | Default `--app` |
| `ASC_VENDOR_NUMBER` | Default vendor number for sales and finance reports |

```bash theme={"theme":{"light":"github-light","dark":"github-dark"}}
# CI: key from a secret
export ASC_KEY_ID=ABC123DEFG
export ASC_ISSUER_ID=00000000-0000-0000-0000-000000000000
export ASC_PRIVATE_KEY="$APP_STORE_CONNECT_P8"
appstore whoami
```

## Multiple accounts

Agencies and studios can keep one named account per team. The config file is written with `0600` permissions.

```bash theme={"theme":{"light":"github-light","dark":"github-dark"}}
appstore accounts add studio --key-id ABC123DEFG --issuer-id 0000… \
  --private-key-path ~/keys/AuthKey_ABC123DEFG.p8 --vendor-number 85012345 --default
appstore accounts add client-acme --key-id XYZ987WVUT --issuer-id 1111… \
  --private-key-path ~/keys/AuthKey_XYZ987WVUT.p8
appstore accounts list
appstore accounts check
appstore accounts use client-acme
appstore --account client-acme apps list
```

App Store Connect lists every app a key can see, so registering apps is optional. Register one to set a default app or route calls automatically:

```bash theme={"theme":{"light":"github-light","dark":"github-dark"}}
appstore apps register 1234567890 --to studio --bundle-id com.studio.app --default
appstore apps registered
```

When an app is registered under exactly one account, MCP tools and `ops call` pick that account automatically.

## Local MCP server

```json theme={"theme":{"light":"github-light","dark":"github-dark"}}
{
  "mcpServers": {
    "app-store-connect": {
      "command": "appstore-mcp",
      "env": {
        "ASC_KEY_ID": "ABC123DEFG",
        "ASC_ISSUER_ID": "00000000-0000-0000-0000-000000000000",
        "ASC_PRIVATE_KEY_PATH": "/path/to/AuthKey_ABC123DEFG.p8"
      }
    }
  }
}
```

`appstore-mcp` also takes `--key-id`, `--issuer-id`, `--private-key`, `--account`, and `--read-only`. With accounts in the config file, `"command": "appstore-mcp"` alone is enough.

## Write safety

| Mechanism | Behavior |
| - | - |
| `--confirm` | Required for every write command and for `ops call` / `api` on writes |
| `--read-only` | The client refuses every non-GET request |
| `appstore-mcp --read-only` | Same, for agent sessions |

> [!TIP]
>
> No key on this machine? Use the [hosted MCP](/docs/store-cli-app-store-connect-hosted-mcp.md) on your Appeeky connection instead.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.