docs(CSM-357): document app-level API key scoping for App Store Connect - #21
Open
arcappcircle wants to merge 3 commits into
Open
docs(CSM-357): document app-level API key scoping for App Store Connect#21arcappcircle wants to merge 3 commits into
arcappcircle wants to merge 3 commits into
Conversation
Team API keys always span every app in the account. Add a dedicated section explaining that an app-scoped key requires an individual key generated by a service account user restricted to selected apps, and note the signing limitation that comes with a non-Admin role.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughThe App Store Connect API key guide now explains app-scoped individual keys, restricted service accounts, eligible roles, key generation, and endpoint limitations. ChangesApp Store Connect API key guidance
Poem
🚥 Pre-merge checks | ✅ 2✅ Passed checks (2 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
✨ Simplify code
Comment |
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
appcircle-docs | 23a1889 | Commit Preview URL Branch Preview URL |
Aug 02 2026, 05:55 PM |
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
appcircle-docs | 23a1889 | Commit Preview URL Branch Preview URL |
Aug 02 2026, 05:55 PM |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@docs/account/my-organization/security/credentials/adding-an-app-store-connect-api-key.md`:
- Line 105: Update the compound modifier in the sentence about individual keys
so “app scoped” becomes “app-scoped,” leaving the surrounding documentation
unchanged.
- Around line 97-101: Update the “Generating the API Key as That User” section
to instruct users to generate the individual key from the service account
profile via username > Edit Profile > Individual API Key > Generate Key. Remove
the incorrect Users and Access > Integrations navigation while preserving the
instructions to download the .p8 file and link it to Appcircle.
- Around line 93-94: Update the role guidance in the app store API key setup
instructions to clarify that Sales supports Selected Apps only when Access to
Reports is disabled. Retain Sales in the supported-role list, and state that
individual API keys cannot access Sales or Finance report endpoints because
those require a team key.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 1aac5651-096d-4919-9157-011b033c7f53
📒 Files selected for processing (1)
docs/account/my-organization/security/credentials/adding-an-app-store-connect-api-key.md
- Generate the individual key from the user profile (Edit Profile > Individual API Key), not Users and Access > Integrations. - Note that Sales only supports Selected Apps while Access to Reports is disabled, and that Certificates, Identifiers & Profiles access also forces all-app scope. - Note that individual keys cannot reach Sales and Finance endpoints. - Hyphenate 'app-scoped'.
Sales can be restricted to selected apps, but Apple does not allow the Sales role to generate an individual API key (eligible roles: Account Holder, Admin, App Manager, Customer Support, Developer, Marketing), so a Sales service account cannot produce an app-scoped key at all.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Based on the CSM-357 analysis: an App Store Connect team key (Users and Access > Integrations) can never be limited to specific apps, its role only defines what it can do. An individual key inherits the generating user's role and their app-level restrictions, so it is the only way to get an app-scoped key.
Adds a dedicated section "Restricting the API Key to Specific Apps" to the App Store Connect API Key doc, recommending that customers who want app-level permission create a dedicated service account user in App Store Connect, grant it access to selected apps only, and generate the API key from that user.
Changes
Linear: https://linear.app/appcircle/issue/CSM-357/asc-api-permission-app-level-api-key-permission-analysis
Created on behalf of burako@appcircle.io via Arc.
Summary by CodeRabbit