App Store Connect

Push iOS/tvOS/visionOS IPA and macOS PKG builds from ReleaseDesk to TestFlight, submit them for review and track phased release.

API routes

All paths begin with /api/v1/orgs/:orgId/apps/:appId/app-store-connect. Configuration routes require a dashboard session. The publication and beta-group routes also accept an app-matched bearer token with the listed scope.

Method and suffix	Minimum access	Success
GET /	Viewer session	200 configuration view
PUT /	Admin session	200 configuration view
DELETE /	Admin session	204
POST /verify	Admin session	200 verification result
GET /beta-groups	Viewer session or read token	200 { "items": [...] }
GET /publications	Viewer session or read token	200 { "items": [...] }
POST /publications	Developer session or promote token	202 queued publication
PATCH /publications/:id	Developer session or promote token	202 queued update
POST /sync	Developer session or promote token	200 { "items": [...] }

PUT / accepts bundleId, numeric ascAppId, UUID issuerId, ten-character keyId, and optional raw .p8 text in privateKey. Omit the key to retain the existing one. The view exposes configured, bundleId, ascAppId, issuerId, keyId, and lastVerifiedAt, never the private key.

GET /publications?releaseId=rel_... filters by release. POST /publications accepts releaseId, optional artifactId, groupIds (default []), submitBeta (default false), and includeNotes (default true). A PATCH chooses an action: testflight with groupIds and optional submitBeta; submit with optional releaseType (manual or after_approval) and phasedRelease; or phased with state (pause, resume, or complete). 202 means work was queued. The publication view includes build/review/phased states, busy flag, last error, and sync timestamps. An upstream sync failure can return 502 asc_request_failed.

API key

1. App Store Connect > Users and Access > Integrations > App Store Connect API > Team Keys.
2. Generate a key with the App Manager role. Download AuthKey_XXXXXXXXXX.p8 (Apple offers the download once).
3. Note the Issuer ID (top of the page) and the Key ID.
4. Open the app's App Store Connect tab in ReleaseDesk and enter: bundle ID, the numeric Apple ID of the app (App Information > General), issuer ID, key ID, and the .p8 file (or paste its contents).
5. Click Verify connection.

The .p8 is stored AES-256-GCM encrypted with the server master key and is never returned by the API. Only issuer ID and key ID are shown. Tokens are ES256 JWTs valid for 19 minutes, cached in memory.

Workflow

• Push to TestFlight (release page, or rdesk asc push): uploads the IPA/PKG, waits for Apple to process it, then adds it to the chosen beta groups, sets "What to Test" from the release notes and optionally submits for external beta review.
• Submit for review (rdesk asc submit): attaches the processed build to the App Store version, submits it, and optionally enables phased release. Release type is manual or after_approval.
• Phased release (rdesk asc phased pause|resume|complete): controls the 7-day rollout.
• A background job syncs build, beta review, App Store review and phased state every 5 minutes; changes fire the asc.status_changed webhook. Use Refresh from Apple to sync immediately.

Operations are queued and retried with backoff. A retried push checks whether Apple already has the build and skips the upload if so.

Limitations

• The bundle ID and Apple ID configured for the app must match the artifact; mismatches are rejected before any Apple request.
• The build upload endpoints (buildUploads, buildUploadFiles) and their request shapes were implemented from the public API description and have not been exercised against a live account. Verify against Apple's current documentation and a test app before relying on them.
• One publication per release. Rejection messages from review are not fetched yet.
• Mapping ReleaseDesk tester groups to TestFlight groups is not implemented; testers are still invited through the Phase 10 flow.