| 1 | # App Store Connect Signing |
| 2 | |
| 3 | `asc` issues and inspects Apple signing certificates from the terminal |
| 4 | or as an MCP server, without a trip to the developer portal. It also |
| 5 | covers App Store Connect's App Metadata surface: apps, app infos, app |
| 6 | store versions, bundle IDs, screenshots, and their localizations. |
| 7 | |
| 8 | MCP Registry name: `mcp-name: io.github.smbcloudXYZ/ascapi` |
| 9 | |
| 10 | ## Install |
| 11 | |
| 12 | ```bash |
| 13 | cargo install smbcloud-ascapi-cli |
| 14 | ``` |
| 15 | |
| 16 | ## Credentials |
| 17 | |
| 18 | All three come from App Store Connect → Users and Access → Integrations → |
| 19 | App Store Connect API: |
| 20 | |
| 21 | ```bash |
| 22 | export ASC_API_KEY=<key id> |
| 23 | export ASC_ISSUER_ID=<issuer id> |
| 24 | # Optional. Defaults to ~/.appstoreconnect/private_keys/AuthKey_<key-id>.p8 |
| 25 | export ASC_PRIVATE_KEY_PATH=/path/to/AuthKey_XXXXXXXXXX.p8 |
| 26 | ``` |
| 27 | |
| 28 | ## Sales reports |
| 29 | |
| 30 | `sales-reports download` retrieves account-level App Store sales data. It is |
| 31 | for paid-app and in-app purchase reporting across the team; it is not the |
| 32 | per-customer transaction-history API. Reports are returned as a JSON array |
| 33 | whose keys are Apple's original TSV column names and whose values are strings. |
| 34 | |
| 35 | Set the vendor number shown in App Store Connect → Payments and Financial |
| 36 | Reports, then request a report date and frequency: |
| 37 | |
| 38 | ```bash |
| 39 | export ASC_VENDOR_NUMBER=12345678 |
| 40 | |
| 41 | # Yesterday's paid-app and in-app purchase sales. |
| 42 | asc sales-reports download \ |
| 43 | --frequency DAILY \ |
| 44 | --report-date 2026-09-11 |
| 45 | |
| 46 | # Save a monthly report rather than printing it to stdout. |
| 47 | asc sales-reports download \ |
| 48 | --frequency MONTHLY \ |
| 49 | --report-date 2026-08 \ |
| 50 | --output sales-2026-08.json |
| 51 | ``` |
| 52 | |
| 53 | `--report-type` and `--report-subtype` default to `SALES` and `SUMMARY`. |
| 54 | Pass the exact Apple values to request another supported sales-report layout; |
| 55 | use `--version` where that layout requires a report format version. |
| 56 | |
| 57 | ## Signing certificates |
| 58 | |
| 59 | ```bash |
| 60 | asc certificates list --type distribution |
| 61 | asc certificates create --type mac-installer-distribution --out-dir ~/certs |
| 62 | ``` |
| 63 | |
| 64 | `create` generates an RSA 2048 key pair locally, sends Apple only a |
| 65 | signing request, and writes both halves to `--out-dir`. Two things follow |
| 66 | from that and are worth knowing before you run it: |
| 67 | |
| 68 | - **Apple never has your private key.** A certificate whose key file is |
| 69 | lost is permanently unusable, and no re-download recovers it. Back up |
| 70 | the output directory somewhere encrypted. |
| 71 | - **An expired certificate cannot be renewed.** There is no such |
| 72 | operation; you issue a new one, and every provisioning profile that |
| 73 | embedded the old certificate has to be regenerated. |
| 74 | |
| 75 | The private key is written before the request is sent, so a failure |
| 76 | mid-flight leaves an unused key rather than a certificate whose key was |
| 77 | never saved. |
| 78 | |
| 79 | ## MCP server |
| 80 | |
| 81 | ```bash |
| 82 | asc --mcp |
| 83 | ``` |
| 84 | |
| 85 | Speaks MCP over stdio and exposes 28 tools: every operation the command |
| 86 | line has except `certificates revoke`. That covers apps, bundle IDs, app |
| 87 | store versions, both kinds of localization, screenshot sets, screenshot |
| 88 | upload, and certificates. |
| 89 | |
| 90 | Twelve are read-only. Five delete something and are annotated |
| 91 | `destructiveHint`, so a client can gate them: version, localization, |
| 92 | screenshot set, and screenshot deletes, all of which can be recreated by |
| 93 | re-running the tool that made them. |
| 94 | |
| 95 | Credentials resolve per call, so the server starts and answers |
| 96 | `tools/list` even when unconfigured, then fails with a message naming what |
| 97 | is missing. |
| 98 | |
| 99 | Two deliberate absences: |
| 100 | |
| 101 | - **No revocation tool.** Revoking a signing certificate invalidates every |
| 102 | provisioning profile embedding it, for every teammate and every CI job, |
| 103 | at once and irreversibly. That is the one delete no confirmation string a |
| 104 | model types on your behalf makes safe, so `asc certificates revoke` |
| 105 | stays on the command line, where a human is the one typing. A test fails |
| 106 | the build if it ever appears in the tool list. |
| 107 | - **No key material in tool results.** `certificate_create` returns the |
| 108 | path it wrote the key to, never the key itself, because tool results are |
| 109 | read by a model and end up in transcripts. |
| 110 | |
| 111 | ## Copyright |
| 112 | |
| 113 | © 2026 PT Sigit Mitra Bangun ([smbCloud](https://smbcloud.xyz)). |