Updated Oct 2026
App Store reviews API: read and reply with the App Store Connect API
Apple’s App Store reviews API lives inside the App Store Connect API. You read reviews with GET /v1/apps/{id}/customerReviews and reply with POST /v1/customerReviewResponses, authenticating every request with a JWT signed with ES256 that, for these endpoints, can’t live longer than 20 minutes. Prisma does the signing, pagination and retries for you and returns App Store reviews in the same JSON as Google Play, Google and Trustpilot.
2 apps free. Self-serve, no sales call.
How the official App Store Connect API works for reviews
Apple exposes customer ratings and written reviews as the customerReviews resource and your public replies as customerReviewResponses. All requests go to https://api.appstoreconnect.apple.com/v1.
Reading customer reviews
| What you want | Endpoint |
|---|---|
| All reviews for an app | GET /v1/apps/{id}/customerReviews |
| Reviews for one App Store version | GET /v1/appStoreVersions/{id}/customerReviews |
| One review | GET /v1/customerReviews/{id} |
| AI summary of reviews per territory | GET /v1/apps/{id}/customerReviewSummarizations |
You can filter by territory and rating, sort by date or rating, and ask only for reviews with or without a published response. Each review includes rating, title, body, reviewerNickname, createdDate and territory. Results are paginated with a cursor in links.next, and meta.paging.total tells you how many reviews exist. Apple’s own example shows an app with 4,326 reviews.
Replying to reviews
| What you want | Endpoint |
|---|---|
| Create or update a reply | POST /v1/customerReviewResponses |
| Read the reply to a review | GET /v1/customerReviews/{id}/response |
| Read a reply and its state | GET /v1/customerReviewResponses/{id} |
| Delete a reply | DELETE /v1/customerReviewResponses/{id} |
Each review can have one response. Posting again overwrites it. Replies are not instant: Apple says to allow some time before the response appears on the App Store.
Authentication: ES256 JWTs
There’s no OAuth here. You generate an API key in App Store Connect (Users and Access → Integrations for a team key, or your profile for an individual key), download the .p8 private key, and sign your own JWT:
- Header:
alg: ES256,kid: <your key ID>,typ: JWT. - Payload (team key):
iss(issuer ID),iat,exp,aud: appstoreconnect-v1, optionalscope. - Payload (individual key):
sub: userinstead ofiss. - Lifetime: for most requests, App Store Connect rejects tokens that live more than 20 minutes. Long-lived tokens (up to six months) only work for a short list of GET-only resources, and customer reviews isn’t on it.
Send it as Authorization: Bearer <token>. Reuse it until it expires.
What the App Store Connect API doesn’t tell you
- Your token dies every 20 minutes. Any long-running sync needs a token cache and a re-signing step. Forget it and every request after minute 20 fails with 401.
- The key is powerful. A team key acts with the role you gave it in App Store Connect, not just on reviews. Use
scopeto limit it, and store the.p8file like a password. - Rate limits are per key and per rolling hour. Every response has an
X-Rate-Limitheader likeuser-hour-lim:3500;user-hour-rem:500. Apple says actual limits vary. Exceed them and you get HTTP 429 withRATE_LIMIT_EXCEEDED. If the same key also runs your CI or TestFlight automation, review syncs compete with builds. - Replies are asynchronous. A 201 doesn’t mean the customer sees your answer. You have to read the response state later to confirm it’s live.
- No webhooks for new reviews. You poll, and every poll counts against your hourly limit.
- One app, one store. Your Android app’s reviews are in a different API with different auth: see the Google Play reviews API.
Read and reply to App Store reviews with Prisma
Prisma is a unified reviews API for apps and businesses you own. You add your App Store Connect API key once; Prisma signs short-lived JWTs, paginates, retries on 429 and stores history. Your App Store reviews come back in the same JSON as everything else.
1. Connect your App Store Connect team
curl -X POST https://api.prismareviews.com/v1/connections \
-H "Authorization: Bearer $PRISMA_API_KEY" \
-H "Content-Type: application/json" \
-d '{"platform": "app_store"}'
# Returns a secure page where you paste your issuer ID and key ID and upload the .p8 key.2. Read your latest App Store reviews
curl "https://api.prismareviews.com/v1/reviews?platform=app_store&location_id=app_682658836&since=2026-10-01" \
-H "Authorization: Bearer $PRISMA_API_KEY"{
"data": [
{
"id": "rev_a71d",
"platform": "app_store",
"location_id": "app_682658836",
"rating": 1,
"text": "Crashes every time I open the camera on iOS 26.",
"author": "mikeb_92",
"created_at": "2026-10-15T18:40:00Z",
"reply": null,
"url": "https://apps.apple.com/app/id682658836"
}
]
}3. Reply from your code
// Node.js 18+
const res = await fetch("https://api.prismareviews.com/v1/reviews/rev_a71d/reply", {
method: "POST",
headers: {
Authorization: `Bearer ${process.env.PRISMA_API_KEY}`,
"Content-Type": "application/json",
},
body: JSON.stringify({
text: "Thanks Mike. Version 4.2.1 fixes the camera crash on iOS 26. Please update and tell us if it persists.",
}),
});
console.log(await res.json());# Python 3
import os, requests
r = requests.post(
"https://api.prismareviews.com/v1/reviews/rev_a71d/reply",
headers={"Authorization": f"Bearer {os.environ['PRISMA_API_KEY']}"},
json={"text": "Thanks Mike. Version 4.2.1 fixes the camera crash on iOS 26. Please update and tell us if it persists."},
)
print(r.json())4. Know when it’s live. Prisma sends reply.published when Apple publishes your reply, and review.created when a new review arrives, so you stop polling.
Building for a mobile team? See Prisma for SaaS and app teams. First call in five minutes with the quickstart. How we store your .p8 key: security.
App Store Connect API vs Prisma
| App Store Connect API | Prisma | |
|---|---|---|
| Cost | Included with the Apple Developer Program | 2 apps free, then plans from €49/month |
| Auth | ES256 JWT you sign, max 20 min for these endpoints | One Prisma API key |
| Read reviews | customerReviews, cursor pagination | GET /v1/reviews, same JSON for every platform |
| Reply | POST /v1/customerReviewResponses, async publish | POST /v1/reviews/{id}/reply + reply.published webhook |
| Rate limits | Per key, rolling hour, shared with your other automation | Handled by Prisma |
| New review alerts | Polling | review.created webhook |
| Android, Google, Trustpilot | Not covered | Same API |
| Where Apple wins | Free, AI review summaries, every other App Store Connect feature | Cross-store reading and replying |
If you only ship on iOS and already have JWT signing in your stack, the official API is free and complete. If you also ship on Android, or support answers reviews from a helpdesk, Prisma replaces two integrations with one. Compare with the Google Play reviews API, the Trustpilot API and the Google reviews API.
FAQ
Is there an official App Store reviews API?
Yes. The App Store Connect API has a customerReviews resource to read reviews and a customerReviewResponses resource to create, update and delete your replies.
How do I authenticate with the App Store Connect API?
You sign a JWT with the ES256 algorithm using the .p8 private key from App Store Connect, and send it as a Bearer token. For most requests the token can live 20 minutes at most.
Can I reply to App Store reviews with the API?
Yes. POST /v1/customerReviewResponses creates a reply or overwrites the existing one. Each review can have at most one response, and it is not published instantly.
What are the App Store Connect API rate limits?
Limits are per API key and per rolling hour. Every response carries an X-Rate-Limit header with your hourly limit and remaining requests; going over returns HTTP 429 RATE_LIMIT_EXCEEDED.
Can I read reviews of apps I don’t own?
Not with the App Store Connect API, and not with Prisma. Both only work for apps in your own App Store Connect team.
How is an app billed in Prisma?
Each connected app counts as one location. The first 2 are free, and paid plans start at €49 a month for up to 10. See pricing.
App Store and Google Play reviews, one API
Add your App Store Connect key once. Read every review as clean JSON and reply from your own code, without signing a single JWT.
2 apps free · Self-serve · Your .p8 key encrypted at rest