Connecting App Store Connect to Stacktic

For: an App Store Connect Account Holder or Admin. Takes about 5–10 minutes.

What this integration does

Connecting App Store Connect lets Stacktic see everyone on your App Store Connect team. When someone leaves, Stacktic can remove their account from the team in one step.

To connect, you create a login for apps at the team level in App Store Connect. Apple calls this a Team Key. It isn't tied to any one person's own sign-in. Stacktic stores it encrypted and only uses it with the one App Store Connect team it was created on.

Stacktic needs three values, all from the same Team Key:

Value	What it is
Issuer ID	Identifies your team to Apple's API.
Key ID	Identifies this specific key.
Private key (.p8)	The key file Apple lets you download once, when you create the Team Key.

This one is stricter than most integrations: the key must have the Admin role, full stop. Apple's API needs the Admin role just to list your team. There's no lower, read-only option like GitHub or Google Analytics offer. If you only want visibility for now, that's fine. Removal is a separate switch, covered in Step 3. But the key itself still has to be an Admin key either way.

Before you start

You need to be the Account Holder or an Admin on the App Store Connect team you're connecting. Only those two roles can create a Team Key.
You need to be ready to create a new Team Key with the Admin role. (If your team already has one you're comfortable reusing, that works too. Just note it in Step 1.)
Apple shows a Team Key's private key file exactly once, when you create it. Have somewhere safe to save the .p8 file before you move on.

Step 1: Create a Team Key

In App Store Connect, go to Users and Access → Integrations → Team Keys.
Create a new key with the Admin role. (Apple's console is the source of truth for the exact steps. This article can't show screenshots of Apple's screens. If what you see is different, follow what's in front of you.)
Apple shows you the Issuer ID, which every key on your team shares. It also shows a new Key ID for this key. Then it lets you download the .p8 private key file once. Save it somewhere safe now.

Step 2: Connect in Stacktic

In Stacktic, go to Tools → App Store Connect → Integration and enter:

Issuer ID
Key ID
Private key (.p8): open the .p8 file you downloaded in a text editor. Paste its full contents, including the BEGIN/END lines.

Click Connect. Stacktic checks the key against your real team member list before it accepts it. So a key without the Admin role gets caught right away, instead of failing later.

Step 3: Turn on removal (when you're ready)

Stacktic starts reading your team member list as soon as you connect. Removing someone during an offboarding is a separate switch. It's off until you turn it on, because removal is destructive. That's true even though the Admin role you already needed in Step 2 would technically allow it.

When you want Stacktic to remove people from this App Store Connect team during an offboarding, turn on Automated user removal on the integration.

What you'll see

Once you're connected, Stacktic lists everyone who has accepted an invitation to this App Store Connect team. It also shows each person's role: Admin, Account Holder, Developer, Finance, Marketing, and so on. A person can have more than one.

App Store Connect doesn't tell Stacktic a few things, so don't expect to see them:

Pending invitations: someone who was invited but hasn't accepted yet doesn't show up on this list at all. Apple tracks invitations separately.
Last sign-in or last activity: App Store Connect's API has no such field for a team member.
Outside collaborator vs. full member: App Store Connect doesn't make this distinction. Everyone on the list is the same kind of member. Only their roles differ.

The connected card doesn't show the private key. Next to the Issuer ID and Key ID, you'll see "On file (fingerprint …)" instead of any part of the key.

Read-only vs. removal

Connected, Automated user removal off (the default): Stacktic shows everyone on your App Store Connect team next to the rest of your tools. Nothing here can remove anyone.
Connected, Automated user removal on: Stacktic also removes people when you offboard them.

Both use the same Admin-role key. Only the switch in Stacktic changes.

What removal does (and doesn't do)

Removing a person deletes their user account from this App Store Connect team outright. It does not:

delete their Apple ID.
affect any other App Store Connect team they belong to.

Apple won't let anyone remove the Account Holder. Every team has exactly one. It's the person who signed the Apple Developer Program license agreement. If the person you're offboarding holds that role, Stacktic refuses the removal. It tells you to move the Account Holder role to someone else in App Store Connect first.

Security notes

You can't limit the key to read-only. Apple's API ties listing team members to the Admin role itself. So there's no lower-permission key to create, the way there is for GitHub or Google Analytics. The Automated user removal switch in Stacktic is what really controls whether Stacktic ever removes anyone. Treat that as your real on/off switch, not the key's role.
Not tied to a person. A Team Key belongs to the team, not to whoever created it. Unlike a personal access token, it keeps working when someone leaves your team.
No expiry. Apple Team Keys don't expire on their own. Stacktic can't detect an expiry date because there isn't one. Changing the key from time to time is up to you. Create a new one in App Store Connect and reconnect with it.
Stored encrypted, never shown again. Stacktic keeps the Issuer ID, Key ID, and private key encrypted. It never shows the private key again, not even part of it. It only shows a one-way fingerprint. So nothing in Stacktic's screens could be used to rebuild the key.
You can cut it off anytime. Delete or deactivate the key in Users and Access → Integrations → Team Keys in App Store Connect. The connection stops working right away.

Troubleshooting

Message in Stacktic	Likely cause and fix
"App Store Connect refused the request (HTTP 401)."	The key was deleted, or its Issuer ID or Key ID no longer match a live key. Create a new Team Key with the Admin role and reconnect.
"App Store Connect refused the request (HTTP 403)."	The key is valid but no longer has the Admin role. Create a new Admin-role Team Key, or have the role given back to this one. Then reconnect.
"App Store Connect private key could not be used to sign a request."	The `.p8` contents got garbled when you copied them. A common cause is a paste that got reformatted or wrapped, instead of the exact file contents. Download the key from App Store Connect again (if you still can) and paste it again, `BEGIN`/`END` lines included.
Offboarding removal refused: "This person holds the Account Holder role…"	You're trying to remove the team's only Account Holder. Move that role to someone else in App Store Connect, then retry.
Offboarding removal reports the person wasn't found	They were already removed from the team, or were never on it. Stacktic counts this as done. You don't need to do anything.

Frequently asked questions

Does this cover more than one App Store Connect team? No. One connection covers exactly one team, because a Team Key only works for the team it was created on. If you manage more than one team, create a Team Key on each. Then create a separate Stacktic connection for each team.

Do I need to give Stacktic the Admin role just to see who's on my team? Yes. This is the one place App Store Connect doesn't offer a lighter option. Apple's API needs Admin to list team members at all, whether or not you ever turn on removal.

Will connecting remove or change anything right away? No. Connecting only reads your team member list. Stacktic removes people only during an offboarding, and only after you turn on Automated user removal.

What about someone who was invited but hasn't accepted yet? They won't show up in Stacktic. App Store Connect tracks pending invitations separately from team members. This integration only reads the member list.

Where can I read more about App Store Connect's API and Team Keys? Apple's own App Store Connect API documentation is what this integration is built against.