We are calling these App Store Connect API endpoints from our server: curl --request POST \ --url https://api.appstoreconnect.apple.com/v1/gameCenterLeaderboardEntrySubmissions \ --header 'Authorization: Bearer JWT_Token' \ --header 'Content-Type: application/json' \ --data '{ "data": { "type": "gameCenterLeaderboardEntrySubmissions", "attributes": { "bundleId": "bundleId", "score": "1", "scopedPlayerId": "scopedPlayerId, "submittedDate": "date", "preReleased": true, "vendorIdentifier": "vendorIdentifier" } } }' curl --request POST \ --url https://api.appstoreconnect.apple.com/v1/gameCenterPlayerAchievementSubmissions \ --header 'Authorization: Bearer JWT_Token' \ --header 'Content-Type: application/json' \ --data '{ "data": { "type": "gameCenterPlayerAchievementSubmissions", "attributes": { "bundleId": "bundleId", "vendorIdentifier": "vendorIdentifier", "percentageAchieved": 1, "scopedPlayerId": "scopedPlayerId, "submittedDate": "Date", "preReleased": true } } }' According to https://developer.apple.com/documentation/appstoreconnectapi/app-store-connect-api-3-2-release-notes We should be able to set player score and achievements. We use an active Team App Store Connect API key and generate an unscoped ES256 JWT with aud: appstoreconnect-v1. The key has high-level App Store Connect permissions. We followed documentation: https://developer.apple.com/documentation/appstoreconnectapi https://developer.apple.com/documentation/appstoreconnectapi/post-v1-gamecenterplayerachievementsubmissions https://developer.apple.com/documentation/appstoreconnectapi/post-v1-gamecenterleaderboardentrysubmissions Both requests return: { "status": "403", "code": "FORBIDDEN_ERROR", "title": "This request is forbidden for security reasons", "detail": "The API key in use does not allow this request" } The player is authorised via GameKit on the mobile app. The API key can read: https://api.appstoreconnect.apple.com/v1/apps/:id https://api.appstoreconnect.apple.com/v2/gameCenterLeaderboards/:id. Which exact App Store Connect API key role or permission is required for these endpoints? Is server-to-server submission supported using a Team API key?