Configure App Store Connect signing

Use App Store Connect API credentials when Oore should synchronize signing assets for a pipeline. API mode still uses the Direct macOS runner’s runner-owned signing path.

What you need

Project developer, maintainer, instance admin, or instance owner access.
An Apple Developer team with App Store Connect API access to the required certificates, profiles, bundle IDs, and devices.
The Apple Team ID and every bundle identifier the pipeline signs.

1. Create an App Store Connect key

In App Store Connect, create an API key with the access required to read and manage the pipeline’s signing assets. Record:

Key ID
Issuer ID
the downloaded .p8 private key

Apple shows the private-key download once. Store it securely outside Oore as well.

When several apps belong to the same Apple team, store the key once instead of uploading it to every pipeline. This needs instance admin or owner access.

Open Settings > Store credentials.
Under App Store Connect API keys, select Add key.
Enter a Name, the Key ID and the Issuer ID, and choose the .p8 file.
Select Add key.

Replacing a shared key updates every pipeline that uses it on its next build. Oore refuses to delete a key while a pipeline uses it: iOS signing is on, and the pipeline signs in API or Hybrid mode or uploads builds to App Store Connect.

API-mode pipelines on the same Apple team share one distribution certificate. The first sync creates it, and later syncs reuse it, because Apple allows only a few distribution certificates per team.

3. Add the API credentials

Open the pipeline, select Edit, and find Signing > iOS.
Turn on Enable iOS signing.
For Signing mode, select API (App Store Connect automation).
Enter Apple Team ID and the Bundle identifiers.
For App Store Connect API key, choose a shared key. To use a key only for this pipeline, choose This pipeline’s own key, enter API key ID and API issuer ID (UUID), and upload App Store Connect key (.p8).
Select Save changes.

A pipeline’s own key overrides the shared keys. Oore keeps it stored when you switch the pipeline to a shared key, so you can switch back.

Use Hybrid (manual cert + API automation) only when the pipeline needs a manually uploaded certificate together with API-synchronized profiles.

4. Synchronize profiles

Open the pipeline’s Edit page and select Sync profiles beside the iOS heading under Signing. Oore synchronizes signing assets for the configured bundle identifiers and reports warnings separately from updated profiles.

Verify the result

Oore shows an iOS signing sync completed message with the number of profiles updated. The pipeline’s signing summary shows the stored API key and profiles for the configured bundle identifiers.

Troubleshooting

Sync cannot find a profile

Confirm the Apple Team ID and bundle identifier are exact, and that the API key can access the corresponding certificate and provisioning profile.

The API key is rejected

Confirm the Key ID, Issuer ID, and .p8 file came from the same App Store Connect key and that the key is still active.

The build stops before checkout

API synchronization does not remove the active-login prerequisite for Apple signing. Log in to the Direct macOS runner account and retry.