Context

When setting up iOS code signing and App Store Connect integration in Codemagic, you are asked to upload an App Store Connect API private .p8 key along with its Issuer ID and Key ID. Apple's terms state that API credentials may not be shared outside the team, which may raise questions about whether providing this key to Codemagic is permitted.

Answer

Yes, using an App Store Connect API key with Codemagic for automated code signing and App Store Connect/TestFlight workflows is a fully supported and permitted setup.

Apple's restriction refers to sharing Apple account credentials or providing unauthorized access to your developer account. Codemagic operates as a CI/CD service provider acting on your behalf, which is covered under Apple's Developer Program Agreement provisions for using third-party service providers to assist with Apple services.

Key points to keep in mind:

• Create a dedicated API key: It is recommended to generate a dedicated App Store Connect API key specifically for use with Codemagic, rather than reusing a key intended for other purposes.

• Choose the appropriate access level: You can select the role that matches the operations Codemagic needs to perform. If you intend to publish to the App Store, the key will need the App Manager or Admin role for the standard code signing and App Store Connect publishing workflow.

• No Apple ID password required: Codemagic does not require your Apple ID password — only the .p8 private key, Issuer ID, and Key ID.

• Secure upload: The private .p8 key is uploaded through Codemagic's Developer Portal integration and is used solely to authenticate Codemagic's requests to Apple's services.