---
title: "Set the organization's App Store Connect key."
method: PUT
path: "/organizations/{organizationId}/app-store-connect-credential"
tags: ["app-store-connect"]
---

# Set the organization's App Store Connect key.

`PUT /organizations/{organizationId}/app-store-connect-credential`

## Request

- Base URL: `https://api.shorebird.dev/api/v1`
- URL: `https://api.shorebird.dev/api/v1/organizations/{organizationId}/app-store-connect-credential`
- Auth: one of:
  - HTTP bearer
  - HTTP bearer

Stores an App Store Connect team API key for the organization,
replacing any it had. Create the key in App Store Connect under Users
and Access, Integrations, Team Keys, with the narrowest role the
integration needs.

The key is checked with App Store Connect first, by listing one of
the team's apps, and stored only if Apple accepts it. The private key
is encrypted before it is stored and is never returned.

Requires the `storeCredentials.update` permission, which
only the `admin` and `owner` roles hold. Personal access tokens and
federated (OIDC-exchanged) tokens are refused whatever their role:
sign in to the console instead.

## Request body

- PutAppStoreConnectCredentialRequest
  - `issuer_id` string, uuid, required: The issuer id App Store Connect shows above its team keys.
  - `key_id` string, required: The key id App Store Connect shows beside the key.
  - `private_key` string, required: The contents of the `.p8` file App Store Connect downloaded: a PEM P-256 private key beginning `-----BEGIN PRIVATE KEY-----`.

## Response `200`

The organization's key, replacing any it had.

- AppStoreConnectCredential: The App Store Connect team API key an organization gave Shorebird, without its private key.
  - `id` integer, required: The credential's ID.
  - `organization_id` integer, required: The organization the key belongs to.
  - `issuer_id` string, uuid, required: The App Store Connect issuer id, in lowercase.
  - `key_id` string, required: The App Store Connect key id.
  - `uploaded_by_user_id` integer, nullable, required: The person who last uploaded the key, while they still exist.
  - `created_at` string, date-time, required: When the organization first gave Shorebird a key.
  - `updated_at` string, date-time, required: When the key was last uploaded.
  - `rejected_at` string, date-time, nullable, required: When Apple refused the key, if it has since it was uploaded. App Store statuses stop updating until a new key is uploaded.
  - `rejection` 'unauthorized' | 'forbidden' | 'null', nullable, required: How Apple refused the key: `unauthorized` when it no longer accepts the key at all, `forbidden` when the key's role may not read the team's builds.

## Other responses

- `400`: The organization id is not an integer (`organization_id_malformed`); the body is not a JSON object, or a field is missing or malformed (`app_store_connect_credential_bad_request`, with the reason in `details`); or App Store Connect refused the key, or accepted it but its role cannot read the team's apps (`app_store_connect_key_rejected`).
- `403`: The caller lacks the `storeCredentials.update` permission, or authenticated with a personal access token or a federated token, which may never set the key (`personal_access_token_forbidden` or `api_key_insufficient_permissions`).
- `404`: No such organization, or the caller is not a member of it (`organization_membership_guard_error`).
- `424`: Encrypting the key failed (`app_store_connect_credential_encryption_error`), or a database step failed (`app_store_connect_credential_database_error`, or `organization_membership_guard_error` while checking membership).
- `503`: App Store Connect could not be reached to check the key (`app_store_connect_unavailable`), or this server cannot store App Store Connect keys (`app_store_connect_credentials_not_configured`).
- `default`: Standard error response. Emitted for any non-2xx status where a body can be decoded into an [ErrorResponse].

---

[API](https://skmtc.dev/shorebird/apis/shorebird-codepush-api.md) - [All operations](https://skmtc.dev/shorebird/apis/shorebird-codepush-api/llms.txt) - [OpenAPI document](https://skmtc.dev/shorebird/apis/shorebird-codepush-api/revisions/941da8871d10?raw)