msd-setup-credentials

Set up production credentials for store submission.

Load skills/submitting-app-release/references/credentials-guide.md before starting.

---

Step 1 — Choose storage path

Ask:

"Where should credentials be stored?

• EAS secrets (recommended) — encrypted in EAS cloud. Works in CI, GitHub Actions, and locally. Set once, works forever. Run eas secret:list anytime to verify.
• Local .env.production — stored in a local file. Faster to set up. Not available in CI unless you add it to your pipeline."

---

Step 2 — EXPO_TOKEN (required for both platforms)

Ask: "Do you have an Expo access token set? (check with eas whoami)"

If not:

1. Direct user to: expo.dev → Account → Settings → Access Tokens → Create Token
2. Ask user to paste the token (it starts with expo_)
3. Validate format: must start with expo_ and be at least 20 chars
4. Store it:

# EAS secrets path
eas secret:create --scope project --name EXPO_TOKEN --value "<token>"

# Local path
echo 'EXPO_TOKEN=<token>' >> .env.production

---

Step 3 — iOS credentials (skip if Android-only)

App Store Connect API Key

1. Direct user to: App Store Connect → Users and Access → Integrations → App Store Connect API → Generate API Key

   • Role: App Manager or higher
   • Download the .p8 file — it can only be downloaded once

2. Collect three values:

APP_STORE_CONNECT_API_KEY_ID   — shown on the key list (10 alphanumeric chars)
APP_STORE_CONNECT_ISSUER_ID    — shown above the key list (UUID format)
APP_STORE_CONNECT_API_KEY_CONTENT — base64 of the .p8 file

1. Generate the base64 content:

base64 -i AuthKey_XXXXXXXXXX.p8
# Copy the output — that is APP_STORE_CONNECT_API_KEY_CONTENT

1. Validate each value before storing:

# Key ID: 10 alphanumeric chars
echo "KEYID" | grep -E '^[A-Z0-9]{10}$' && echo "✅ format valid" || echo "❌ invalid"

# Issuer ID: UUID
echo "ISSUERID" | grep -E '^[0-9a-f]{8}-([0-9a-f]{4}-){3}[0-9a-f]{12}$' && echo "✅ format valid" || echo "❌ invalid"

# Key content: must contain PEM header
echo "CONTENT" | grep "BEGIN PRIVATE KEY" && echo "✅ valid" || echo "❌ missing PEM header"