How to create an App Store Connect API key for sales data

Last updated: July 28, 2026

From the SoleOS answers series — written about our own product space; grounded in published definitions and documented behavior, never invented numbers.

You create an App Store Connect API key by going to Users and Access → Integrations → App Store Connect API in App Store Connect, generating a key with the narrowest role that covers Sales and Trends reports (Finance or Sales and Trends role, not Admin), then downloading the .p8 private key file once — Apple only lets you download it a single time. You'll also need the Key ID and Issuer ID shown on the same page to authenticate any tool that pulls your sales data.

This key is how any external dashboard, script, or reporting tool reads your App Store sales and financial reports without you handing over your Apple ID password. It's Apple's version of what Stripe and RevenueCat do with OAuth, just older and clunkier.

Where to find the API key settings

Log into App Store Connect with an account that has Admin access (only Admins can create API keys, even if the key itself will have a lower role). Then:

  1. Click Users and Access in the top navigation.
  2. Click the Integrations tab.
  3. Under App Store Connect API, click Team Keys (not "Individual Keys" — team keys survive if the creating user leaves the team, which matters if you're a solo founder but might add a contractor later).
  4. Click the + button to generate a new key.

Picking the right role

This is the step people get wrong. App Store Connect offers a long list of roles — Admin, App Manager, Developer, Marketing, Sales, Finance, Account Holder, and more. For sales reporting specifically, you want one of:

  • Sales and Trends — read-only access to sales, downloads, and trends reports. This is the correct choice for most reporting tools, including SoleOS.
  • Finance — adds access to financial reports (payments, proceeds) if you also need those.

Do not select Admin or App Manager just because the dropdown is sitting right there. Those roles can also modify app metadata, manage users, and submit builds. A reporting integration never needs write access to your apps — if a tool asks you for more than Sales and Trends (or Finance), that's worth questioning.

Generating and downloading the key

After you name the key and assign the role:

  1. Click Generate.
  2. Apple shows you the key exactly once, with a Download API Key button. Click it immediately — there is no second download. If you lose the .p8 file, you have to revoke it and create a new one.
  3. Note the Key ID (a short alphanumeric string) and the Issuer ID (a UUID shown at the top of the Integrations page, shared across all your keys).

Store the .p8 file somewhere you won't lose it — a password manager's secure notes or an encrypted vault, not a random folder on your desktop. Anyone who has the file, the Key ID, and the Issuer ID can pull your sales data, so treat it like a credential, because it is one.

Feeding the key into a reporting tool

Whatever tool you're connecting — a script you wrote, a spreadsheet macro, or a dashboard like SoleOS — will ask for three things:

  • The Key ID
  • The Issuer ID
  • The .p8 file contents (or its private key text, pasted directly)

There's no OAuth flow here, no "sign in with Apple" redirect. You're directly handing over a credential file, which is exactly why the role you picked in the previous step matters so much. A Sales and Trends key can't touch your app builds even if the tool consuming it were compromised.

If you're setting this up for SoleOS's connectors, the process is the same: paste the Key ID, Issuer ID, and .p8 contents into the App Store Connect connector setup. SoleOS never asks for your Apple ID or password, and the scopes SoleOS requests match what's documented for each connector, including this one — worth checking regardless of which tool you use, since scope creep is the main risk with .p8-based keys.

Revoking or rotating the key later

If you ever stop using a reporting tool, disconnect an old dashboard, or suspect the key leaked, go back to Users and Access → Integrations → Team Keys and click Revoke next to the key. Revocation is immediate — any tool using that Key ID loses access instantly, no grace period. There's no way to "pause" a key temporarily; revoke and regenerate is the only path, so if you're rotating keys on a schedule, budget a few minutes to update every tool that depends on the old one.

Because App Store Connect keys don't expire on their own, it's worth a habit: every time you disconnect a reporting tool, revoke its key the same day rather than leaving it dangling. An unused key with Sales and Trends access sitting around for a year is a bigger risk than the five minutes it takes to clean up.

Why sales data alone won't match your Stripe or RevenueCat numbers

App Store Connect sales reports show gross proceeds, units, and returns as Apple sees them — after Apple's cut, in the currency and timezone Apple uses for reporting, often with a one-to-two-day lag. If you're also selling through Stripe or tracking subscriptions via RevenueCat, don't expect these three numbers to line up without reconciliation. That's a separate problem worth understanding on its own terms — see why App Store revenue looks lower than Stripe revenue and tracking Stripe and RevenueCat together if you're running both.

Do you need a dashboard for this at all?

If you have one app on the App Store and you check sales once a month, App Store Connect's own Sales and Trends tab in the browser is genuinely enough — there's no reason to wire up an API key just to look at a single number occasionally. The API key setup earns its keep once you're comparing App Store sales against Stripe revenue, RevenueCat subscriptions, or numbers from several apps at once, where doing that reconciliation by hand every week gets tedious fast. For a sense of what that comparison actually looks like across a real multi-app portfolio, here are real numbers from a 10-app portfolio.

Disclosure: SoleOS wrote this post about its own connector category — it's portfolio intelligence for multi-product founders, and App Store Connect is one of the sources it reads. We tried to keep the setup steps accurate regardless of what you connect it to.

Frequently asked questions

Can I use an Individual Key instead of a Team Key?

You can, but Individual Keys are tied to the Apple ID that created them — if that person leaves your team or loses access, the key stops working. For anything you'll rely on long-term, including reporting tools, use Team Keys instead.

What's the difference between Key ID, Issuer ID, and the .p8 file?

The Issuer ID is a single UUID shared across your whole team's keys. The Key ID identifies one specific key. The .p8 file is the actual private key material used to sign requests. A tool needs all three to authenticate.

Does this API key give access to my app's source code or builds?

No. Even with a broader role like App Manager, App Store Connect API keys deal with metadata, reports, and app management functions — never your Xcode project or binary contents. For sales reporting, Sales and Trends role has no write access to anything.

My key stopped working — what happened?

The most common causes are: someone revoked it (check Team Keys for its status), the .p8 file was entered incorrectly somewhere, or Apple's Issuer ID changed because keys were regenerated. Team Keys don't expire on a timer, so if it worked before and now doesn't, revocation or a typo are the first things to check.

Can I see exactly what scopes a connector requests before connecting?

For SoleOS specifically, yes — the connectors page lists the scopes and revocation steps for every source, including App Store Connect. For other tools, check their documentation before pasting in a .p8 file, since that file is a real credential and worth the same caution you'd give an API secret key elsewhere.