---
title: "Get notarization credentials for xcrun notarytool"
method: GET
path: "/appsec/7.0/apple/notarization/credentials"
tags: ["Credential"]
---

# Get notarization credentials for xcrun notarytool

`GET /appsec/7.0/apple/notarization/credentials`

Returns the caller's own ASC key material (key id, issuer id, and the `.p8`) for `xcrun notarytool submit --key <.p8> --key-id <keyId> --issuer <issuerId> --wait` on a Mac build VM. This is the only endpoint that returns the `.p8` — a deliberate, owner-only exposure of the caller's own key; the credential status endpoint never leaks it. 409 if no ASC key is configured.

## Response `200`

Notarization credentials

- NotarizationCredentials — Owner-only. Everything xcrun notarytool needs; the only response that carries the .p8.
  - `keyId` string
  - `issuerId` string
  - `privateKeyP8` string — The .p8 EC private key

## Other responses

- `403` — Caller is anonymous / not authenticated.
- `409` — No ASC API key configured

---

[API](https://skmtc.dev/codenameone/apis/codename-one-apple-signing-service.md) · [All operations](https://skmtc.dev/codenameone/apis/codename-one-apple-signing-service/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/codenameone/codename-one-apple-signing-service/revisions/f0b48d0af96f/schema)