App Store Connect API token generator
Drop your AuthKey_XXXXXXXXXX.p8, type the Key ID and Issuer ID (or pick Individual key), choose a lifetime of up to 20 minutes, and get a signed ES256 JWT for the App Store Connect API, with its header, payload and a curl command to test it. Signing happens in your browser with Web Crypto: the key is not uploaded, not stored, and the page makes no network requests.
Your key stays on this page
- •The .p8 key is read and used for signing by your own browser. It is never uploaded, and this page makes no network requests while you use it.
- •Nothing is saved: no cookies, no local storage. Reloading the page forgets the key.
- •Close this tab when you are done. A token keeps working until its exp time, even after you close the page, so keep it to yourself and choose a short lifetime.
Header and payload fields, the audience and the lifetime limits are copied from Apple's "Generating Tokens for API Requests", checked on 2026-10-30.
1. Your private key
Drop your AuthKey_XXXXXXXXXX.p8 file here
Or open the file, or paste its text below. The Key ID is filled in from the file name for you.
2. Key details
Shown next to the key in App Store Connect, for example 2X9R4HXF34.
Shown near the top of Users and Access > Integrations, for example 57246542-96fe-1a63-e053-0824d011072a.
Apple rejects tokens that live longer than 20 minutes for most requests. Choose the shortest that fits: 2 minutes is enough for one request.
Longer lifetimes unlock only when the scope lists GET requests on the resources Apple allows (Xcode Cloud, source control, test results, power and performance metrics).
Method, path and optional query, such as GET /v1/apps?filter[platform]=IOS. With a scope, App Store Connect accepts the token only for matching requests. It ignores limit, cursor and sort when it compares.
3. Your token
Fix before signing
- •Enter the Key ID.
- •Enter the Issuer ID, or switch to Individual key.
Add your key and details, then sign. The token appears here.
How it works
- •The header is {"alg": "ES256", "kid": your Key ID, "typ": "JWT"}, as Apple specifies. A team key's payload carries iss (your Issuer ID), iat, exp and aud "appstoreconnect-v1"; an individual key's payload carries sub "user" instead of iss.
- •iat is the current time from your device in Unix seconds, and exp is iat plus the lifetime you pick. The form stops you at 20 minutes unless your scope qualifies for Apple's long-lived tokens.
- •The .p8 file is read as PKCS#8 PEM, checked to be a P-256 elliptic-curve key, and imported into Web Crypto as a key that cannot be exported again. It signs base64url(header).base64url(payload) with ECDSA P-256 and SHA-256.
- •Web Crypto returns the signature as raw R and S (64 bytes), which is the form JWT's ES256 needs, so it is used directly. Libraries that output DER signatures are a common cause of 401 errors; this page avoids that.
- •If you add a scope, the token works only for those requests. The curl command uses the first GET entry, or GET /v1/apps when there is no scope.
What it does not do
- •It does not call App Store Connect for you. Copy the curl command or the token into your own tool.
- •It does not keep or renew tokens. For a script or CI job, generate tokens in that job with your own code and keep the key in its secret store.
- •It does not check that the Key ID or Issuer ID are yours, or that the key's role allows the request. App Store Connect decides that when you call it.
- •It cannot revoke a token. If one leaks, revoke the key in App Store Connect; a token stays valid until it expires.
- •It needs the unchanged PKCS#8 .p8 file. An "EC PRIVATE KEY" file must be converted first (the page shows the command).
Questions
- Is it safe to put my App Store Connect private key into a web page?
- Only if the page never sends it anywhere, which is how this one works: the key is read and used by Web Crypto inside your browser tab, imported as non-exportable, nothing is stored, and the page's content security policy lets it talk only to this site, which it does not do while you sign. Still treat it like any secret: use it on your own computer, close the tab afterwards, and prefer short lifetimes.
- How long can an App Store Connect token last?
- Twenty minutes for most requests: Apple rejects a token whose exp is more than 20 minutes after its iat. Apple accepts tokens up to six months only when the token has a scope, every entry is a GET request, and every resource is on Apple's list, such as Xcode Cloud build runs, workflows, products, source control repositories, test results and power and performance metrics.
- What is the difference between a team key and an individual key?
- A team key is created under Users and Access > Integrations and its token includes iss, your Issuer ID. An individual key is created in your own user profile and has no Issuer ID; its token carries sub set to "user" instead. Both use ES256, a kid header and aud "appstoreconnect-v1".
- Why do I get 401 NOT_AUTHORIZED?
- The usual causes: the kid does not match the key that signed the token; the Issuer ID is wrong or missing for a team key; the lifetime is over 20 minutes; your clock is off so iat or exp look wrong; the signature is in DER form instead of raw R and S; or the scope does not match the request. This page rules out the signature format and lifetime problems.
- What does the scope claim do?
- It limits the token to the requests you list, each written as the method, the path and an optional query, for example GET /v1/apps?filter[platform]=IOS. App Store Connect rejects the token for any request that matches none of them, and ignores limit, cursor and sort when comparing. Without a scope, the token works for anything the key's role allows.
- Should I make a new token for every request?
- No. Apple recommends reusing one signed token for many requests until it expires. For a long job, sign a fresh token every so often instead of making one with a long lifetime.