Skip to main content
This article covers the standard and multi-auth Apple App Store Connect connector, which syncs users and roles and can also provision them.

​
After this article

You will be able to connect Apple App Store Connect to Lumos to sync users and their roles, and to invite users, remove them, and manage their role assignments from Lumos.

​
Capabilities

Provisioning behavior:
  • Create: sends an App Store Connect invitation with the user’s email, first name, last name, and at least one role. The account stays Pending until the person accepts the invite. If the email already has a pending invitation or an existing user, Lumos links that account instead of sending a duplicate.
  • Assign or remove a role: Lumos reads the user’s current roles and writes the updated set back. Assigning a role the user already has, or removing one they don’t, is a safe no-op. Every user must hold at least one role. Role changes only work on accepted users, a pending invitation must be accepted first.
  • Delete: removes the user from App Store Connect. If the account is still a pending invitation, Lumos cancels the invitation instead. If neither exists anymore, the account is recorded as deprovisioned without erroring.
  • Not supported: activate and deactivate (Apple’s API has no such operations), profile updates beyond roles, and custom attributes.

​
Required plan and roles

  • App Store Connect role: the API key used for the connection must be generated with the Admin role. Keys with lesser roles can’t read the full user list, and inviting, deleting, and changing roles all require the “Manage Users and Access” permission, which the Admin role carries. The required endpoints listed below must be authorized. For read-only access, only
  • Authentication: a JWT credential built from three values in App Store Connect: the Issuer ID, the Key ID, and the Private Key (the downloaded .p8 file contents). Apple requires the token to be signed with ES256, so the private key must be an EC key on the P-256 curve, which is what App Store Connect generates.
  • Account ID: a unique identifier for your account, chosen by you. It cannot be determined programmatically and is used to differentiate between multiple instances of this integration.

​
Read-only access vs provisioning

Is read-only possible? Yes. This connector expects an Admin key that will be scoped for certain endpoints. For sync-only access with the same credential type, do not provide access to provisioning endpoints that are required below. To ensure base read functionality, the key must be authorized for the endpoints Lumos calls: GET /v1/users and GET /v1/userInvitations. What full provisioning requires. An App Store Connect API key with the Admin role, connected with its Issuer ID, Key ID, and private key. With that in place Lumos can invite users, cancel invitations, delete users, and assign or unassign roles. Watch out for. Apple’s API has no way to activate or deactivate a user, so those actions aren’t available on this connector. Profile updates beyond roles aren’t supported either, since the API exposes nothing meaningful to update. Store the downloaded .p8 private key file carefully, App Store Connect only lets you download it once.

​
Instructions

Phase 1: Create an API key in App Store Connect
  1. Log in to the App Store Connect portal and open the API Keys page (under Users and Access).
  2. Create a Team or Individual API key. Assign the Admin role to the key.
  3. Download the .p8 private key file and store it securely, it can only be downloaded once.
  4. Note the Issuer ID shown on the API Keys page (e.g. 57246542-96fe-1a63-e053-0824d011072a) and the Key ID of the key you created (e.g. 2X9R4HXF34).
Phase 2: Connect in Lumos
  1. Find the Apple App Store Connect (Multi-Auth) card in your Lumos integrations (reconnect an existing card or add a new one).
  2. Select the JWT Token credential and fill in the requested fields:
    • Issuer ID: from the API Keys page in App Store Connect.
    • Key ID: the Private Key ID associated with the key.
    • Private Key: the full contents of the .p8 file, including the PEM header and footer lines.
    • Account ID: a unique identifier for your account, chosen by you.
  3. Click Connect. Lumos validates the key format and probes read access before saving the connection.

​
API Endpoints Used

​
Troubleshooting

Credential validation rejects the private key. The key must be an unencrypted PEM-encoded EC private key on the P-256 curve, exactly as downloaded from App Store Connect. Paste the full .p8 contents including the header and footer lines. If the key was lost or truncated, revoke it and create a new one, it can only be downloaded once. App Store Connect rejected these credentials (401). The Issuer ID, Key ID, and Private Key don’t line up. Confirm all three belong to the same API key. Credentials accepted but permissions insufficient (403). The key’s role isn’t Admin. Apple’s API exposes no way to read a key’s role back, so Lumos can only detect this when a call fails. Create a new key with the Admin role. Role assignment fails with “is an invitation, not a user.” Roles can only be changed on accepted users. Wait for the person to accept their invitation, then retry. To change the roles on a pending invite, cancel it and re-invite with the right roles.