Updated Oct 2026

App Store Connect API key for reviews: create it step by step

The App Store Connect API reads customer reviews and publishes developer responses, but only with a key you create in App Store Connect. For a reviews integration the right key is a team key with the Customer Support role: it can read and answer reviews and nothing more. Here is how to create it, what to save, and what to do with it.

Before you start

• You need the Account Holder or Admin role in App Store Connect to create team keys. If you aren’t, ask an Admin to do steps 1 to 4 and send you the three values from step 5 securely.
• Decide who will hold the key. Apple’s API keys are not tied to a person’s password, but they act with the role you choose and they don’t expire on their own.

Step by step

1. Sign in to App Store Connect and open Users and Access.
2. Open the Integrations tab, then App Store Connect API. If the team has never used the API, accept the terms shown there.
3. Under Team Keys, click Generate API Key (the plus button).
4. Give it a name that says what it is for, for example Reviews integration, and choose the access Customer Support. That role can read customer reviews and respond to them. Avoid Admin or App Manager unless the same key also needs to manage builds.
5. Click Generate. Then save the three values you need:
   • Issuer ID, shown at the top of the page, shared by every key of the team.
   • Key ID, in the row of your new key.
   • The private key, a .p8 file you download with the Download link in that row. You can download it once. Store it in a secret manager; if you lose it, revoke the key and create another.

That is all. There is no OAuth screen and no app-level approval: the key works for every app the role can see.

What the key is used for

Every request to the App Store Connect API carries a JSON Web Token signed with the .p8 key (algorithm ES256), with the Key ID in the header, the Issuer ID as iss and an expiry of at most 20 minutes for the reviews endpoints. The review calls then are:

The 20-minute token lifetime, the per-key hourly rate limit and the lack of webhooks are the parts that make a production integration more work than the four calls suggest. They are described on the App Store reviews API page.

Using the key with Prisma

Prisma takes the same three values and does the signing, the token refresh, the pagination and the polling, then returns reviews in the same JSON as Google Play, Google and every other platform:

curl -X POST https://api.prismareviews.com/v1/connections \
  -H "Authorization: Bearer $PRISMA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"platform": "app_store", "credentials": {"issuer_id": "<issuer id>", "key_id": "<key id>", "private_key": "-----BEGIN PRIVATE KEY-----\n...\n-----END PRIVATE KEY-----"}}'

Prisma never sees your Apple ID: the key is the only credential, stored encrypted, and you can revoke it in App Store Connect at any time. Each app counts as one location, and the App Store is included in the free Spark plan.

Security notes

• Create one key per integration, so revoking one doesn’t break another.
• Keep the role at Customer Support. A key with Admin access can change pricing, builds and users.
• Revoke keys for integrations you stop using: App Store Connect lists every active key under Team Keys.

FAQ

Which App Store Connect role can read and reply to reviews?

Customer Support is the smallest role that can read customer reviews and respond to them, so a team key with that role is enough for a reviews integration. Admin and App Manager also can, but grant far more.

Can I download the .p8 file again?

No. App Store Connect lets you download the private key once. If you lose it, revoke the key and generate a new one.

Do I need an Admin account to create an App Store Connect API key?

To create a team key, yes: only the Account Holder or an Admin can generate team keys. An individual key can be created by any user from their own profile, with that user’s permissions.