TL;DR : 4 indie iOS apps, 600+ ASC API calls in 60 days. Here's the JWT auth code, the V1/V2 path traps that cost me 6 hours, and the resource model gotchas.

JWT generation (60 sec)

import jwt , time , uuid

def asc_token ( key_id : str , issuer_id : str , p8_path : str ) -> str : with open ( p8_path ) as f : priv = f . read () return jwt . encode ( payload = { " iss " : issuer_id , " iat " : int ( time . time ()), " exp " : int ( time . time ()) + 1200 , # 20 min max " aud " : " appstoreconnect-v1 " , }, key = priv , algorithm = " ES256 " , headers = { " kid " : key_id , " typ " : " JWT " }, )

Enter fullscreen mode

Exit fullscreen mode

3 things you need from ASC:

Key ID (10-char string)

Issuer ID (UUID)

.p8 private key file

Get all three at: appstoreconnect.apple.com → Users and Access → Keys → API Keys.

V1 vs V2 confusion (cost me 4 hours)

Apple's "v2" resources still use /v1/... paths.…