asc-api-automationlisted

# App Store Connect API Automation This catalog's default way to drive App Store Connect from scripts and CI: an Apple-native toolchain — a ~30-line Swift/CryptoKit script mints the JWT, plain curl calls the REST API. No fastlane/spaceship, no Ruby gems, no Homebrew, consistent with the catalog's mise + no-third-party baselines. ## When to invoke - Writing release tooling: distribute a build to TestFlight groups, set what's-new, create the next App Store version, submit for review - Pulling sales or App Store analytics reports on a schedule - Debugging ASC API auth failures (401 `NOT_AUTHORIZED`) or rate limiting (429) - Asked "should I use fastlane for this?" ## Scope Owns: token minting, curl conventions, and the endpoint cookbook below. Does NOT own: - **Building / uploading the binary** — there is no REST endpoint for `.ipa` upload; builds arrive in ASC via Xcode Cloud (→ `xcode-cloud-single-track-ci`), a local `xcodebuild -exportArchive` / `xcrun altool` run (→ `local-archive-export-upload`), Xcode Organizer, or Transporter. This skill picks up *after* the build exists in ASC. - **`.p8` key storage & leak prevention** → `build-time-secret-injection` (Layer 2 `secrets/.env`) + `apple-public-repo-security` (rotate-first SOP). - **What metadata will pass review** → `app-store-review-rejections`; this skill is *how* to submit, not *what*. ## Keys: create, scope, store | Key kind | Where | JWT identity claim | Use for | |---|---|---|---| | **Team key** (default) | Use