AppleNot published by vendorVerified 2026-10-18

App Store Connect API for AI agents

Apple’s REST API for what you do in App Store Connect: builds, TestFlight, metadata, submissions, reviews and reports. Each request needs a JWT you sign with an API key. Included with the $99/year Apple Developer Program.

CompareDocs

Verified factsChecked 2026-10-18

PriceNo separate API charge; you need an Apple Developer Program membership, 99 USD per membership year (local prices vary; fee waivers exist for eligible nonprofits, schools and government entities).3 [Verified 2026-10-18]
API key / authBearer JWT signed with ES256: header alg ES256, kid (key ID), typ JWT; payload iss (issuer ID), iat, exp, aud appstoreconnect-v1, optional scope. Tokens that expire more than 20 minutes ahead are rejected for most resources. Our unsigned request on 2026-10-18 returned HTTP 401 NOT_AUTHORIZED.6 [Verified 2026-10-18]
Key rolesTeam keys reach all apps with the role you assign (generating one needs an Admin account); individual keys inherit one user’s access and can’t use provisioning endpoints or notaryTool. The private key downloads once.7 [Verified 2026-10-18]
Rate limitPer API key, on a rolling hour, reported in an X-Rate-Limit header (user-hour-lim, user-hour-rem). Apple’s example shows 3,500 an hour and says actual limits vary. Over the limit you get HTTP 429 RATE_LIMIT_EXCEEDED.4 [Verified 2026-10-18]
TermsUse is governed by the Apple Developer Program License Agreement you accept when you join.5 [Verified 2026-10-18]
OpenAPI specApple publishes a downloadable OpenAPI specification for the API; there is no official Apple MCP server (none found in the official MCP Registry on 2026-10-18).1 [Verified 2026-10-18]

FeaturesChecked 2026-10-18

YesNoN/ANot published
CapabilityValueNote
StatusThe API docs carry no stage label for the API as a whole.Not published1 [Not published by vendor: checked 2026-10-18 on https://developer.apple.com/documentation/appstoreconnectapi]The API docs carry no stage label for the API as a whole.
API key requiredES256 JWT from an API key. Our unsigned request returned HTTP 401 NOT_AUTHORIZED.Yes2 [Verified 2026-10-18 by test request to https://api.appstoreconnect.apple.com/v1/apps?limit=1]ES256 JWT from an API key. Our unsigned request returned HTTP 401 NOT_AUTHORIZED.
Free tierNeeds $99/yr developer membership. No separate API fee; fee waivers exist for eligible nonprofits, schools and government entities.No3 [Verified 2026-10-18 on https://developer.apple.com/programs/enroll/]Needs $99/yr developer membership. No separate API fee; fee waivers exist for eligible nonprofits, schools and government entities.
Rate limitRolling hour; Apple’s example shows 3,500/hour and says actual limits vary. 429 RATE_LIMIT_EXCEEDED.Per key, hourly (X-Rate-Limit)4 [Verified 2026-10-18 on https://developer.apple.com/documentation/appstoreconnectapi/identifying-rate-limits]Rolling hour; Apple’s example shows 3,500/hour and says actual limits vary. 429 RATE_LIMIT_EXCEEDED.
Official MCP serverNo official MCP server. None from Apple, and none found in the official MCP Registry on 2026-10-18.No1 [Verified 2026-10-18 on https://developer.apple.com/documentation/appstoreconnectapi]No official MCP server. None from Apple, and none found in the official MCP Registry on 2026-10-18.
Official SDKOpenAPI spec, no SDK. Apple publishes a downloadable OpenAPI specification but no client SDK.No1 [Verified 2026-10-18 on https://developer.apple.com/documentation/appstoreconnectapi]OpenAPI spec, no SDK. Apple publishes a downloadable OpenAPI specification but no client SDK.
Data license / termsAccepted when you join the Apple Developer Program.Apple Developer Program License5 [Verified 2026-10-18 on https://developer.apple.com/support/terms/apple-developer-program-license-agreement/]Accepted when you join the Apple Developer Program.
Commercial use allowedFor your own apps. It manages apps you distribute under your developer membership.Yes1 [Verified 2026-10-18 on https://developer.apple.com/documentation/appstoreconnectapi]For your own apps. It manages apps you distribute under your developer membership.
CORS / browser useApple does not document browser use; our preflight got HTTP 401 with no CORS headers.Not published1 [Not published by vendor: checked 2026-10-18 on https://developer.apple.com/documentation/appstoreconnectapi]Apple does not document browser use; our preflight got HTTP 401 with no CORS headers.
Freshness / coverageChanges made through the API affect your production App Store Connect data immediately.Live production data1 [Verified 2026-10-18 on https://developer.apple.com/documentation/appstoreconnectapi]Changes made through the API affect your production App Store Connect data immediately.

What it does

The App Store Connect API automates App Store Connect: TestFlight builds, testers and groups; app versions, metadata and submissions; in-app purchases and subscriptions; customer reviews and responses; sales, finance and performance reports; provisioning; and Xcode Cloud. Calls change production data, so an agent with a key can ship real changes. Authentication is a short-lived JWT signed with ES256 using a private key you download once from App Store Connect, which makes least privilege easy: create a key with the narrowest role, keep tokens short and revoke the key when the job is done.

Working exampleNot run: needs an App Store Connect API key and a signed JWT

Documented request, not run by us: needs an App Store Connect API key and a signed JWT. The response below is what we did run on 2026-10-18.

# Not run: needs an App Store Connect API key (.p8), key ID and issuer ID to sign the JWT
# JWT: header {"alg":"ES256","kid":"<KEY_ID>","typ":"JWT"}
#      payload {"iss":"<ISSUER_ID>","iat":<now>,"exp":<now+1200>,"aud":"appstoreconnect-v1"}
curl "https://api.appstoreconnect.apple.com/v1/apps?limit=1" \
  -H "Authorization: Bearer $ASC_JWT"

Response (trimmed)

Not run with a key. What we did run on 2026-10-18 (same call, no token):
HTTP 401
{"errors":[{"status":"401","code":"NOT_AUTHORIZED",
  "title":"Authentication credentials are missing or invalid.",
  "detail":"Provide a properly configured and signed bearer token, and make sure that it has not expired. ..."}]}

Agent setup

Prompt to give your agent

You can call the App Store Connect API with a key limited to the App Manager role. List the latest TestFlight builds for app <APP_ID> and their processing state. Do not submit for review, change pricing or edit users without asking me first. Mint a fresh JWT (exp at most 20 minutes) for each batch, and stop if X-Rate-Limit shows fewer than 100 requests left.

Agent / MCP-style tool snippet

# Python: sign a short-lived token for an agent tool (pip install pyjwt cryptography)
import time, jwt
def asc_token(key_id, issuer_id, p8_path):
    now = int(time.time())
    return jwt.encode(
        {"iss": issuer_id, "iat": now, "exp": now + 1200, "aud": "appstoreconnect-v1"},
        open(p8_path).read(), algorithm="ES256",
        headers={"kid": key_id, "typ": "JWT"})
# Tool: GET https://api.appstoreconnect.apple.com/v1/builds?filter[app]=<APP_ID>
#       with Authorization: Bearer <asc_token(...)>

Fit and safety

Good for

  • Checking TestFlight build status from an agent
  • Drafting and posting replies to App Store reviews with human approval
  • Pulling sales and performance reports into a weekly summary

Watch out

  • Do not hand an agent an Admin team key. Admin keys can create and delete users; pick the narrowest role that covers the job.
  • Do not let an agent submit builds or change prices unattended. The API changes production data immediately.
  • Do not mint long-lived tokens. Apple rejects tokens expiring more than 20 minutes ahead for most resources; refresh per batch instead.
  • Do not use it without a paid developer membership. There is no free tier.

Alternatives

Google Play Developer APIGoogle’s equivalent for Android builds, listings and reviews.
fastlaneOpen-source CLI that wraps App Store Connect tasks; an agent can drive it from a shell.
GitLab MCP serverFor the CI and merge-request side of a mobile release, not App Store metadata.

FAQ

Is the App Store Connect API free?

There is no separate API fee, but you need an Apple Developer Program membership, 99 USD per membership year.

How long is an App Store Connect JWT valid?

At most 20 minutes for most resources. Apple rejects tokens whose expiry is further out, except for a few listed resources.

What is the App Store Connect API rate limit?

It is per key per rolling hour and shown in the X-Rate-Limit response header. Apple’s example shows 3,500 an hour and says limits vary.

Compare

Put App Store Connect API side by side with other free agent tools on keys, limits, MCP support, licensing and CORS. Open the comparison grid →

SourcesFootnotes

  1. 1developer.apple.com/documentation/appstoreconnectapiVerified 2026-10-18
  2. 2api.appstoreconnect.apple.com/v1/apps?limit=1Tested 2026-10-18
  3. 3developer.apple.com/programs/enrollVerified 2026-10-18
  4. 4developer.apple.com/documentation/appstoreconnectapi/identifying-rate-liVerified 2026-10-18
  5. 5developer.apple.com/support/terms/apple-developer-program-license-agreemVerified 2026-10-18
  6. 6developer.apple.com/documentation/appstoreconnectapi/generating-tokens-fVerified 2026-10-18
  7. 7developer.apple.com/documentation/appstoreconnectapi/creating-api-keys-fVerified 2026-10-18