How to create an App Store Connect API key
What the key is, in plain terms
An App Store Connect API key lets an app read your data from Apple without your Apple ID password. It has three parts:
- The Key ID: a short code that names the key.
- The Issuer ID: a longer code that identifies your team.
- The private key file: a small
.p8file you download once. Treat it like a password.
Which role to pick
Kiikari supports both of these, and tells you during onboarding exactly what your key unlocks:
- App Manager with Sales access unlocks everything Kiikari does. Replying to a review is a write to Apple, so replies need this key. It is the one to pick if you want the reviews inbox at full power. Kiikari still never changes your apps, pricing, metadata or availability: the only write it ever performs is the review replies you send.
- Sales and Reports is fully read-only, the safest kind of key there is. You get every number: sales, proceeds, refunds, analytics and the Insights window, plus a read-only reviews inbox. Replies and the live app status stay off, and Kiikari says so instead of failing.
An Admin key works too, but App Manager is all Kiikari ever needs. Start read-only if you are unsure: you can swap the key later in one step.
Step by step
- Sign in to App Store Connect and open Users and Access.
- Select the Integrations tab, then App Store Connect API.
- Under Team Keys, click the add button to generate a key.
- Give it a name you will recognise, such as "Kiikari", and set the access to App Manager with Sales access (or Sales and Reports for read-only).
- Click Generate. Then Download the
.p8file. You can only download it once, so keep it somewhere safe. - Note the Key ID next to your new key, and the Issuer ID shown at the top of the keys list.
Add it to Kiikari
Open Kiikari's onboarding, drop in the .p8 file, and paste the Key ID and Issuer ID. Kiikari validates the key against Apple immediately and shows you exactly what it unlocks. If anything is off, it tells you which part and why, in plain language.
Frequently asked
Is this key safe to give a third-party app?
A read-only Sales and Reports key is the safest kind, and Kiikari fully supports it. If you enable replies with an App Manager key, posting those replies is the only write Kiikari ever performs. Either way the key never leaves your Mac: it lives in the Keychain and is used only to sign requests to Apple. There is no Kiikari server for it to travel to.
I lost the .p8 file. What now?
You cannot re-download a key file. Revoke the old key in App Store Connect and generate a fresh one. It takes the same two minutes.
What is the vendor number?
It is the ID Apple attaches to your sales reports. Kiikari asks for it during setup and points you to Payments and Financial Reports in App Store Connect, where the number is shown at the top left. One paste, once.