asc-api

ASC API

Use this skill to build or run local App Store Connect automation without exposing secrets to Codex, logs, repositories, or remote model context.

The default pattern is:

1. Keep credentials outside every project in ~/.asc_secrets.
2. Keep the .p8 private key outside every project, such as under ~/.ssh/.
3. Generate a 20-minute JWT only inside the local Python process.
4. Send requests directly to https://api.appstoreconnect.apple.com/.
5. Print only safe response summaries, never tokens or request headers.

Hard Security Rules

Never ask the user to paste ASC_KEY_ID, ASC_ISSUER_ID, .p8 contents, JWTs, or Authorization headers into chat.

Never run commands that reveal secrets, including:

• cat ~/.asc_secrets
• cat *.p8
• printenv
• env
• any command that prints ASC_*, PRIVATE KEY, Bearer, or Authorization

Never add real credentials to a project file, git-tracked file, script, fixture, markdown doc, shell history snippet, or test output.

Never print token, auth_headers, response.request.headers, PreparedRequest.headers, or full request dumps. On failures, print only:

• HTTP method and endpoint path
• status code
• response body text or JSON
• redacted diagnostics such as Authorization: <redacted>

If authentication, signing, missing-file, missing-field, permission, or ASC 401/403 errors occur, tell the user to manually inspect ~/.asc_secrets and the .p8 path on their own machine. Explicitly state that Codex cannot and should not access the user's secret file, private key, JWT, or Authorization header.

For mutating live ASC operations (POST, PATCH, DELETE), confirm the target app/resource and intended changes with the user before executing. After generating final task JSON, stop and show it to the user. Do not upload or modify App Store Connect until the user explicitly confirms that final JSON. For read-only GET, proceed when the task is clear.

Local Credential File

Expect the user to create this file manually outside the project. If they have not done so yet, direct them to docs/asc-api-setup.md in the repository root for a complete step-by-step guide covering key generation, .p8 file storage, and setup verification.