App Store Connect API Key Setup

Overview

To use automatic code signing in RunnerHub, you need to configure an Apple App Store Connect API key at the workspace level. This key grants RunnerHub permission to create certificates and manage provisioning profiles on your behalf.

Prerequisites

• Apple Developer account with admin or app manager access
• Access to App Store Connect

Step 1: Create an API Key in Apple Developer

1. Go to App Store Connect
2. Click Users and Access in the sidebar
3. Click the Keys tab
4. Click Generate a key (or the + button)
5. Enter a key name (e.g., “RunnerHub Signing”)
6. For Access Level, select Developer or App Manager
   • Developer: Can create and manage certificates
   • App Manager: Can manage both certificates and apps (recommended)
7. Click Generate

Apple will display your new key with three pieces of information:

• Key ID (e.g., ABC123D45E)
• Issuer ID (e.g., 12a3bc45-d6e7-89fa-bcde-f1g2h3i4j5k6)
• Private Key (.p8 file) — Download this immediately; it’s only shown once

Danger

Save the .p8 file now. Apple only displays it once. If you lose it, you’ll need to revoke this key and create a new one.

Step 2: Add API Key to RunnerHub

1. In the RunnerHub dashboard, go to Workspace Settings

2. Click the Apple Signing tab

3. Click Add API Key

4. Fill in the form:

   • Issuer ID: Paste the Issuer ID from App Store Connect
   • Key ID: Paste the Key ID from App Store Connect
   • Team ID: Your Apple Team ID (available in App Store Connect under Account > Membership)
   • Private Key (.p8): Open the downloaded .p8 file in a text editor and paste the entire contents

5. Click Save

RunnerHub will:

• Encrypt your private key using industry-standard encryption
• Validate that the key has access to your Apple account
• Generate or fetch an existing Apple Distribution certificate
• Store the certificate securely

Finding Your Team ID

Your Apple Team ID is an 10-character alphanumeric code (e.g., ABC123D45E). To find it:

1. Go to App Store Connect
2. Click Account in the top right
3. Click Membership
4. Look for Team ID in the table

Security & Best Practices

Caution

Your .p8 file is sensitive. Treat it like a password:

• Never share it with others
• Never commit it to version control
• Never post it in public forums
• Delete local copies after uploading to RunnerHub

RunnerHub encrypts the .p8 file immediately upon upload. The private key is:

• Encrypted at rest
• Never logged or exposed
• Only decrypted in memory during job execution
• Deleted from memory after the job completes

API Key Permissions

The API key you create needs Developer or App Manager access to:

• Create and manage certificates
• Fetch provisioning profiles
• Access team information

The key does not need access to:

• Financial data
• Sales reports
• App reviews

Revoking a Key

If you suspect your API key has been compromised:

1. Go to App Store Connect
2. Click Users and Access > Keys
3. Find the key and click the X to revoke it
4. In RunnerHub, go to Workspace Settings > Apple Signing
5. Click Remove API Key

The revoked key will no longer work. You’ll need to create a new key and reconfigure RunnerHub.

Multiple Teams

If you manage multiple Apple teams, you’ll need separate API keys for each team. Create a separate API key for each team in their respective Apple accounts, then add each key to the corresponding RunnerHub workspace.

Troubleshooting

“Invalid API key credentials”

• Verify that Issuer ID, Key ID, and Team ID are copied correctly with no extra spaces
• Ensure the .p8 file content is complete (should start with -----BEGIN PRIVATE KEY-----)
• Check that the key has not been revoked in App Store Connect

“Key does not have permission to create certificates”

• Verify the key has Developer or App Manager access
• If it has different access levels, revoke and create a new key with the correct role

“Team not found”

• Double-check your Team ID—it’s a 10-character alphanumeric code
• Verify the Team ID matches the Apple account that issued the API key

See Code Signing Troubleshooting for more help.