App Store Connect API key security checklist

Assign an owner and purpose

Every key should have a named business purpose: reporting, metadata automation, CI upload, release support, or finance reconciliation. Keys without a purpose become permanent risk.

Assign an owner who can rotate or revoke the key during an incident. Do not leave key ownership with a departed contractor or one-off script author.

Minimize scope and storage risk

• Use the narrowest role that satisfies the workflow.
• Store private key material in a secret manager, not source code, tickets, or local notes.
• Separate read-only reporting keys from write-capable release keys.
• Avoid sharing one key across unrelated apps, vendors, or workflows.
• Log key use by workflow without exposing the key itself.

Plan rotation before you need it

Rotation should be tested while the system is healthy. If the first rotation happens during a compromise, the team will not know which jobs depend on the old key.

AppReviewReady interpretation: API key security is part of release velocity. Secure, documented keys make automation safer and easier to expand.

Prepare incident response

1. Identify every workflow that uses the key.
2. Define how to revoke, replace, and verify new credentials.
3. Review recent API writes after suspected exposure.
4. Notify release and support owners if public app information may have changed.
5. Document the root cause and prevention change.

API key ledger

The ledger gives security and release teams one view of automation authority.

After every new automation workflow, update the key ledger first. It is easier to prevent key sprawl than to clean it up after multiple scripts depend on the same credential.

Do not treat a key as safe merely because it is stored outside the repository. The operational question is who can read it, which jobs can inject it, which logs might expose surrounding claims, and whether a compromised build runner could use it to perform App Store Connect actions.

A useful rotation test proves two things: the old key stops working everywhere, and the replacement key works only for the intended workflow. Keep the verification output with the ledger so future maintainers know the rotation path has been exercised rather than only documented.

Vendor access needs an expiration date. If an agency, analyst, or contractor needs API access for a campaign or migration, create a temporary path with a removal owner. Permanent shared keys make it impossible to know whether an App Store Connect change came from the product team, growth work, or an abandoned integration.

API key record:
Purpose: [workflow]
Role/scope: [permissions]
Storage: [secret manager]
Owner: [team]
Rotation date: [date]
Apps affected: [list]
Incident plan: [link]