How to find your App Store Connect API key, Issuer ID and vendor number

01The four things most tools ask for

Analytics dashboards, build tools and review apps all connect to App Store Connect the same way. They ask for these four items.

The first three come from the same page. The vendor number lives elsewhere, which is why so many setups stall at the last step.

02Check that API access is turned on

The first time anyone on a team uses the API, the Account Holder has to request access. In Users and Access, click Integrations, then Request Access. Agree to the terms and submit. Apple approves requests case by case, so do this before the day you need a key.

If you already see a Generate API Key button or a list of keys, access is on and you can skip ahead.

Only the Account Holder can request access. Only the Account Holder or an Admin can make a team key. If you’re neither, ask whoever holds that role to make the key for you.

03Generate a team key

1. Sign in to App Store Connect and open Users and Access.
2. Click Integrations. The App Store Connect API page opens.
3. Click Team Keys.
4. Click Generate API Key, or the add button (+) if you already have a key.
5. Give it a name you’ll recognise later, such as the name of the tool that will use it.
6. Choose its access, then click Generate.

You can’t change a key’s name or access once it exists. To change either, revoke the key and make a new one.

Tools that ask for an Issuer ID, Perch included, expect a team key. Individual keys, which users make from their own profile, are set up differently.

04Give the key only the access it needs

A team key works across every app in your account. You can’t limit it to certain apps, so its access role is the only boundary. Pick the narrowest role that covers what the tool does.

A tool that does several of these may need a broader role. An Admin key covers everything, which is far more than a dashboard needs, so check the tool’s own guide first. For Perch, the setup guide walks through it. Apple lists exactly what each role can do on its role permissions page.

05Copy the Issuer ID and Key ID

Both IDs stay on the page after you make the key, so you can come back for them any time.

• Issuer ID: shown above the Team Keys table, with a copy button. It’s the same for every team key.
• Key ID: shown in the row for your key. Each key has its own.

Copy rather than retype. Both are long, and a dropped character is the most common reason a new connection fails.

06Download the .p8 file once, and keep it safe

Straight after you make the key, click Download API Key beside it. Apple offers the download only once. The file is named AuthKey_ plus the Key ID, ending in .p8.

Store it the way you’d store a password: in a password manager or an encrypted folder. Keep it out of email, shared drives and code repositories.

If you lose the file, there’s no way to download it again. Revoke the key, make a new one and update every tool that used the old one.

07Find your vendor number

The vendor number isn’t on the API page. In App Store Connect, open Payments and Financial Reports and select Reports. Your vendor number is shown under your legal entity name.

Your sales and finance reports are filed under this number, so any tool that reads your sales needs it. If you belong to more than one team, use the vendor number from the same team you made the key for. A key from one team and a vendor number from another won’t work together.

08When the connection still fails

Work through these before making a new key.

• The Issuer ID or Key ID has a missing or extra character.
• The .p8 file belongs to a different key. Its file name includes the Key ID, so match the two.
• The key has been revoked, or it belongs to another team.
• The key’s access doesn’t cover what the tool is asking for.
• The vendor number belongs to another team.

One more thing that looks like a failure but isn’t: Apple’s daily sales reports arrive a day or two late. A brand new connection can show nothing for yesterday and still be working perfectly.