Hi everyone, I'm investigating an issue related to StoreKit 1 receipt validation and would appreciate any insight from Apple engineers or developers who have encountered this before. Environment StoreKit 1 Consumable In-App Purchase iOS 16 / iOS 17 / iOS 18 (observed on multiple versions) Receipt validation performed on our server Receipt is read from the app bundle after the transaction completes Issue Occasionally, after a purchase succeeds and the transaction reaches the SKPaymentTransactionStatePurchased state, the App Receipt exists and can be decoded successfully, but the receipt contains: { "receipt": { ... "in_app": [] } } The in_app array is completely empty. As a result, our server cannot find the purchased product in the receipt and cannot complete receipt validation. Questions I'd like to understand under what circumstances Apple may return an App Receipt where receipt.in_app is empty. Specifically: Is it expected behavior that receipt.in_app can be empty after a successful consumable purchase? Could this happen if the app reads the receipt before the receipt has been updated? Is there any possibility that calling finishTransaction: before reading the receipt could cause the purchase record not to appear in receipt.in_app? If receipt synchronization is delayed, what is Apple's recommended approach? Wait and retry? Issue an SKReceiptRefreshRequest? Or validate using another mechanism? Are there any documented scenarios where Apple intentionally returns an empty in_app array? Additional Information The transaction state is Purchased. The purchase callback is received successfully. We have confirmed that the receipt file exists. The issue occurs only occasionally and cannot be reproduced consistently. Most purchases contain the expected in_app entry. Any clarification about the expected behavior of the App Receipt or recommended best practices would be greatly appreciated. Thank you!

Hello, We want to ensure that our Declared Age Range API is working correctly, in Production, but we had concerns on how this is done. Do we need to have an account created from Texas with a credit card/addressed based in Texas? What's the best approach to be able to test this in a live environment to ensure everything is working as intended? Thank You.

Hello Apple Developer Team, I've followed the AppStoreConnect API documentation and created the following: I've created a API Key in App store > Integrations > Teams key, gave the role as admin. Created a valid JWT token When fetching the GET v1/apps, I can see the list of apps. Also I was able to make GET v1/users as well successfully. I've the valid bundle Id and capabilities enabled in the developer portal. Facing an issue while creating an app in App Store using AppStoreConnect API using POST call: This is my ruby script: response = api_request( method: :post, path: "/v1/apps", token: token, body: { data: { type: 'apps', attributes: { name: APP_NAME, primaryLocale: LOCALE, sku: "SKU#{Time.now.to_i}", bundleId: BUNDLE_ID, platform: 'IOS' } } } ) It gives me below error: { "errors": [ { "id": "09b465fc-316f-47b4-9bc3-9c340cb966aa", "status": "403", "code": "FORBIDDEN_ERROR", "title": "The given operation is not allowed", "detail": "The resource 'apps' does not allow 'CREATE'. Allowed operations are: GET_COLLECTION, GET_INSTANCE, UPDATE" } ] } Did anyone was able to successfully create the app in App Store via AppStoreConnect API? Could you please help me identify the root cause for the above issue and provide some inputs so that I could work on resolving them and move forward in the deployment process. Appreciate your help in reviewing this. Thank you, Santosh

We manage provisioning for a large number of App IDs across multiple apps via CI, using the App Store Connect API (not session-based Spaceship/Xcode auth). Capability management works well end to end for everything we've tried — Push Notifications, App Groups, Associated Domains, Data Protection, etc. can all be created, updated, and deleted via POST/PATCH/DELETE on /v1/bundleIdCapabilities. Apple Pay is the one exception. We can enable the Apple Pay capability itself via the API the same way as anything else, but there's no way to associate that capability with a specific Merchant ID. /v1/merchantIds exists as its own resource, but nothing in the bundleIdCapabilities or bundleIds schema links to it — no relationship, no include, no dedicated endpoint. In practice this means every new Apple Pay-enabled App ID we provision needs someone to go into the Developer Portal by hand (Identifiers → App ID → Capabilities → Apple Pay → select Merchant ID) before the generated provisioning profile will actually build — otherwise Xcode fails with errors like "doesn't include the Apple Pay capability" / "doesn't support the Merchant ID". Every other capability we use is fully scriptable; this is the one manual step left in an otherwise automated pipeline. Has anyone found a documented (or undocumented) way to do this via the API? If this is a confirmed gap rather than something we're missing, I've filed it as FB24414090 — if you've hit the same thing, adding your own Feedback number to a report on the same gap seems to be one of the few things that actually helps get traction internally, so feel free to reference this thread if you file one too.

To Apple Engineers, I don't seem to get any updates or responses so I will keep trying to reach out here. Please work with me on what is needed to get my app approved. it is truly important to get it deployed as soon as we can so I can begin to launch and promote the app in App Store. It has already been live on the Google Play Store for a couple weeks. My app: XmasMaps has been going from "Waiting for Review" to "Rejected". I would fix the mistakes right away which would put XmasMaps back into "Waiting for Review". This App would be a useless App after November. Our app, XmasMaps, has been stuck in "Waiting for Review" since September 29th, 2026 (Submission ID: 1ced2377-575b-4bdd-812f-2852a23c2ffc). Timeline of previous actions: Sept 29, 2026: Initial submission Oct 8 & Oct 11, 2026: Resubmitted fixes following rejections Oct 14, 2026: new build resubmitted, currently stuck in "Waiting for Review" Oct 16, 2026: Expedited review request submitted Oct 19, 2026: Support customer inquiry submitted Android is already live, and we are hoping to clear iOS review so users can access the platform ahead of the upcoming holiday season. Oct 24, 2026: Rejected again for something already built into my latest build. i resubmitted right away and now put back into "waiting for review" when I would expect that the engineer who rejected it would take it back and finalize my app. Oct 28, 2026: As of today, I opened multiple app requests for an update and update the forum multiple times until I can try to get a response. Submission ID: 1ced2377-575b-4bdd-812f-2852a23c2ffc Support Case ID: 102982950152 / 103008467960 Team ID: 34WAQXFJHP I ask, please assist and review my app. I really need it live on both platforms to promote it. Please let me know if any additional information is needed from my side. Thank you.

I am trying to retrieve the numbers displayed in "App Analytics" under "Metrics" > "Active Devices" using the API. Since there does not seem to be a dedicated report for this metric I am using the daily "App Sessions Standard" report and by looking at the "Sessions" field I am able to recreate the numbers displayed for the "Sessions" metric. However if I try to infer the active devices by looking at the "Unique Devices" field my numbers for individual days are in the same ballpark (deviations may be attributable to privacy reasons?), but the total number of devices is way off. Is there a better way to recreate this metric?

Today I witnessed the real power of AI beyond just writing code. I am using it as a super marketer to drive up my app business, and the results are incredible. This is what I have set up. I provided read access to the AI using their official APIs for: App Store Connect Apple Search Ads Meta Ads Firebase Analytics Local app source code By combining the source code with real performance data, the AI ran a thorough analysis and suggested concrete, actionable items to improve my overall app business. My main concern is whether this is allowed by Apple. Specifically, does Apple permit using AI agents to query App Store Connect and Apple Search Ads through their official APIs? The setup is too powerful not to use, but we still need to abide by Apple rules. Has anyone else looked into this or tried a similar workflow?

I'm fetching Apple Store Connect data from the API (in particular, fetching the App Store Purchases report) and trying to replicate the dashboards that we can see under Analytics > Metrics. The thresholding that Apple applies ("Omits values with data from fewer than 5 users or 5 unique devices") means that a lot of data is lost. Is there a way of specifying the dimensions of the report? If we had less dimensions, the threshold would affect to less rows of data, and we would be able to analyze more data. It's strange that from the website of App Store Analytics we can get the data, but through the automated reports we cannot or a lot of data is lost due to not being able to set the report dimensions.

I've been trying to understand why data from the Appstore Connect API is highly inflated when compared to the same data and same period/filters from the Appstore UI. Has anyone any idea why I am experiencing such inconsistencies?

We are requesting a supported App Store Connect API endpoint for creating a new app record, for example POST /v1/apps. We run an automated "create app" workflow that sets up new apps as part of our app management service. The App Store Connect API supports reading and updating apps, but the Apps documentation (https://developer.apple.com/documentation/appstoreconnectapi/apps) lists no way to create one. A new app can only be created on the App Store Connect website. Today our approach is using a third-party library (fastlane's Spaceship) that calls the private endpoints behind the App Store Connect website. Those endpoints can change at any time, and if they do, app creation and our automation will stop working. A supported endpoint, authenticated with an App Store Connect API key, would let us create apps reliably. Thank you for considering this request.

We are calling these App Store Connect API endpoints from our server: curl --request POST \ --url https://api.appstoreconnect.apple.com/v1/gameCenterLeaderboardEntrySubmissions \ --header 'Authorization: Bearer JWT_Token' \ --header 'Content-Type: application/json' \ --data '{ "data": { "type": "gameCenterLeaderboardEntrySubmissions", "attributes": { "bundleId": "bundleId", "score": "1", "scopedPlayerId": "scopedPlayerId, "submittedDate": "date", "preReleased": true, "vendorIdentifier": "vendorIdentifier" } } }' curl --request POST \ --url https://api.appstoreconnect.apple.com/v1/gameCenterPlayerAchievementSubmissions \ --header 'Authorization: Bearer JWT_Token' \ --header 'Content-Type: application/json' \ --data '{ "data": { "type": "gameCenterPlayerAchievementSubmissions", "attributes": { "bundleId": "bundleId", "vendorIdentifier": "vendorIdentifier", "percentageAchieved": 1, "scopedPlayerId": "scopedPlayerId, "submittedDate": "Date", "preReleased": true } } }' According to https://developer.apple.com/documentation/appstoreconnectapi/app-store-connect-api-3-2-release-notes We should be able to set player score and achievements. We use an active Team App Store Connect API key and generate an unscoped ES256 JWT with aud: appstoreconnect-v1. The key has high-level App Store Connect permissions. We followed documentation: https://developer.apple.com/documentation/appstoreconnectapi https://developer.apple.com/documentation/appstoreconnectapi/post-v1-gamecenterplayerachievementsubmissions https://developer.apple.com/documentation/appstoreconnectapi/post-v1-gamecenterleaderboardentrysubmissions Both requests return: { "status": "403", "code": "FORBIDDEN_ERROR", "title": "This request is forbidden for security reasons", "detail": "The API key in use does not allow this request" } The player is authorised via GameKit on the mobile app. The API key can read: https://api.appstoreconnect.apple.com/v1/apps/:id https://api.appstoreconnect.apple.com/v2/gameCenterLeaderboards/:id. Which exact App Store Connect API key role or permission is required for these endpoints? Is server-to-server submission supported using a Team API key?

I hope this message finds you well. I’m reaching out to ask whether specific App Store Connect metrics available in the App Analytics dashboard can also be accessed via the App Store Connect REST API. I have reviewed the official API documentation, but I couldn’t find confirmation regarding the metrics listed below. Could you kindly clarify if the following metrics are available through the REST API? And if so, could you point me to the relevant endpoints or documentation? From the "Usage" group: Installations (Opt-in only) Active Devices Deletions (Uninstalls) From the "App Store" group: Impressions (Unique Devices) Product Page Views (Unique Devices) If these metrics are not available via the REST API, is there an alternative method to programmatically access or export them? Thank you very much in advance for your help and guidance.

Posting here to see if anyone has found a workaround and/or to get Apple employees' eyes on it. I'm not sure when this bug was introduced but I've found that in Safari on iOS 27, I'm unable to download API keys from App Store Connect. Reported as a Safari bug in Feedback Assistant (FB24994724). I checked web inspector's console and network logs for both my iPad and iPhone; no JS errors and a nondescript network error for the key's fetch request. Google Chrome for iPad/iPhone downloads the .p8 key file without issue, so this feels more like a Safari bug than an App Store Connect bug.

We are automating subscription review submissions via the App Store Connect API (POST /v1/reviewSubmissions, /v1/reviewSubmissionItems) for an app with many creator-defined in-app subscriptions (App ID: 6777003020). We would appreciate clarification on the following, as the public documentation appears inconsistent with what we observe in production: What is the actual concurrency limit, and does it vary? We received this live error when calling POST /v1/reviewSubmissions: { "status": "409", "code": "STATE_ERROR.ENTITY_STATE_INVALID", "detail": "This resource cannot be reviewed, please check associated errors to see why.", "meta": { "associatedErrors": { "/apps/6777003020": [{ "status": "409", "code": "STATE_ERROR.CONCURRENT_REVIEW_SUBMISSION_LIMIT_EXCEEDED", "detail": "Unable to create reviewSubmission for appId=6777003020 reviewSubmissionType=DEFAULT platform=ANY as maximum limit=5 of concurrency has reached" }] } } } This says the limit is 5. However, your public documentation ("Overview of submitting for review") states: "A platform can have a maximum of two submissions under review at a time: one that includes an app version and one that includes items… without an app version." Could you confirm: Is 5 the correct, current limit for item-only (reviewSubmissionType=DEFAULT, no app version) reviewSubmissions specifically for in-app purchases/subscriptions? Does this limit scale with account size, app size, or number of in-app purchases, or is it a fixed platform-wide constant for every developer account? Is this the same quota referenced by the deprecated subscriptionSubmissions resource's undocumented SUBMISSION_LIMIT_REACHED error, or an entirely separate one? 2. What counts against the limit, and for how long? Does a reviewSubmission count against this limit from the moment it's created (READY_FOR_REVIEW), or only once actually submitted (WAITING_FOR_REVIEW/IN_REVIEW)? If we create a reviewSubmission and never call submitted:true on it, does it still occupy a slot indefinitely, or does Apple expire/release it automatically after some period? Is there a reliable, documented way to cancel/release a reviewSubmission via the API to free a slot on demand, and is that guaranteed to complete promptly? (We're aware of forum reports of CANCELING state persisting for extended periods without resolution.) 3. Can this limit be raised for our account? Is there a process (support request, account tier, or otherwise) to request a higher concurrency limit for automated review submissions, given we manage subscriptions on behalf of many independent creators? Proposed workaround — please confirm whether this resolves the issue: Per your documentation, a single reviewSubmission can hold up to 200 reviewSubmissionItems. Our proposed fix is to stop creating one reviewSubmission per subscription, and instead: Check for an existing, still-editable (READY_FOR_REVIEW) reviewSubmission for the app. If one exists, add the new subscription as an additional item to it (up to the 200-item cap) rather than creating a new reviewSubmission. Only create a new reviewSubmission when none exists in a state that still accepts new items. Could you confirm whether this is in fact the intended/correct usage pattern to stay under the concurrency-5 limit — i.e., does batching multiple pending subscription changes into a single, shared reviewSubmission avoid tripping CONCURRENT_REVIEW_SUBMISSION_LIMIT_EXCEEDED, since it reduces the number of reviewSubmission objects created regardless of how many items each one carries? Or does adding items to an already-WAITING_FOR_REVIEW/IN_REVIEW submission trigger a different restriction we should also account for? Thank you — happy to provide additional logs/request IDs if useful

Every App Store Connect API key on my team returns 401 NOT_AUTHORIZED for every request, since enrollment. I believe the ASC API entitlement was never provisioned for my team server-side, and I can't find any way to verify or fix that myself. Setup: Individual (paid) Apple Developer Program membership, enrolled 2026-08-12. Team ID 736ZTRRS22, Issuer ID 20166a52-0258-4dbc-80cd-c1e63d55cd56. All agreements Active (Free Apps, Paid Apps, banking, tax). Note: agreement problems surface as 403 REQUIRED_AGREEMENTS_MISSING_OR_EXPIRED, not 401. What fails — everything, identically: GET https://api.appstoreconnect.apple.com/v1/apps → HTTP/2 401 {"errors":[{"status":"401","code":"NOT_AUTHORIZED","title":"Authentication credentials are missing or invalid."}]} Three separate TEAM keys (Admin access), created per the documentation: 7293F9VQS5 (active), plus two since revoked. All 401. One INDIVIDUAL key (YBQLYQZPDATE) with the documented individual payload ("sub":"user", no "iss") — also 401. Individual keys don't use the Issuer ID, so this rules out a wrong Issuer ID or a corrupt team-key record. "Last Used" under Users and Access → Integrations → App Store Connect API has NEVER populated for any key, suggesting my tokens are never resolved to a key record at all. The 401s carry no "id" field in the error object and no X-Request-ID header — only x-apple-jingle-correlation-key (values available on support case 20000139980951, along with screenshots). Control test proving the client side is correct: The identical ES256 signing code, on the same machine and clock, using my APNs key, is ACCEPTED by both api.push.apple.com and api.sandbox.push.apple.com (HTTP/2 400 BadDeviceToken — i.e., authentication succeeded and only my deliberately-invalid test device token was rejected). So key handling, signature format, system clock, and Team ID are all confirmed good. Only the App Store Connect API rejects. Team-key JWT (per "Generating Tokens for API Requests"): header {"alg":"ES256","kid":"7293F9VQS5","typ":"JWT"} payload {"iss":"20166a52-0258-4dbc-80cd-c1e63d55cd56","iat":, "exp":<now+600>,"aud":"appstoreconnect-v1"} Also reproduced with PyJWT and with fastlane — identical 401. Developer Support (case 20000139980951) said API troubleshooting is out of scope for them and pointed me here. Question for Apple engineers: can someone check whether the App Store Connect API entitlement is actually provisioned for team 736ZTRRS22, and whether the key records above are bound to the team? Is there any developer-visible way to see or re-trigger that provisioning? Happy to provide correlation keys / timestamps for specific failing requests.

Hello, We are trying to extract our lifetime app star ratings data from the App Store Connect API but we couldn't find the resource anywhere. We were able to successfully get all app reviews data from this endpoint GET https://api.appstoreconnect.apple.com/v1/apps/{id}/customerReviews based on the official documentation. We validated that we received all reviews, these reviews also include the star ratings. However, the number of star ratings that we see on the App Store console is way less than the one we got from reviews API since star ratings can be submitted without a text review. Any idea where can we get the data of lifetime star ratings using the Connect API ? Thanks !

Hi, I use the Reporter utility to download sales reports. Periodically I have to update its credentials with a new token. Trying to do this today, I get: $ java -jar Reporter.jar p=Reporter.properties Sales.generateToken Please enter your username: Please enter your password: If you generate a new access token, your existing token will be deleted. You will need to save your new access token within your properties file. Do you still want to continue? (y/n): y Network is available but cannot connect to application. Check your proxy and firewall settings and try again.` Is anyone else having any problems with this? (I'm posting this in "App Store Connect API", but of course this isn't the modern App Store Connect API, it's something that has been around for much longer, and for which I don't see an appropriate forum category.)

Hello, Apple’s documentation appears inconsistent about which App Store Connect API should be used to submit an Apple-hosted Background Asset version for external TestFlight review: In WWDC25 “Discover Apple-Hosted Background Assets”, Apple says that the asset pack version can be submitted using the POST /v1/betaBackgroundAssetReviewSubmissions. In Uploading and versioning Apple hosted background assets, the external beta review instructions link to “Submit an app for beta review,” which uses POST /v1/betaAppReviewSubmissions. These two resources have different behavior. betaBackgroundAssetReviewSubmissions I called the public API with the same resource structure used by the App Store Connect web UI: POST https://api.appstoreconnect.apple.com/v1/betaBackgroundAssetReviewSubmissions { "data": { "type": "betaBackgroundAssetReviewSubmissions", "relationships": { "backgroundAssetVersion": { "data": { "type": "backgroundAssetVersions", "id": "<BACKGROUND_ASSET_VERSION_ID>" } } } } } The public API returned 404 PATH_ERROR: The resource 'v1/betaBackgroundAssetReviewSubmissions' does not exist. However, the App Store Connect web UI uses the private endpoint below with the same payload and receives HTTP 201: POST https://appstoreconnect.apple.com/iris/v1/betaBackgroundAssetReviewSubmissions The public endpoint is also absent from the current App Store Connect OpenAPI specification. betaAppReviewSubmissions I also tested the public POST /v1/betaAppReviewSubmissions endpoint. When I supplied a backgroundAssetVersion relationship, the API returned 409: 'backgroundAssetVersion' is not a relationship on the resource 'betaAppReviewSubmissions'. You must provide a value for the relationship 'build'. The build relationship only accepts the builds resource type, not backgroundAssetVersions. Therefore, betaAppReviewSubmissions can submit an app build but cannot submit a Background Asset version. Could Apple please clarify: Which public API should be used to submit a Background Asset version for external TestFlight review? Is betaBackgroundAssetReviewSubmissions intended to be exposed through the public App Store Connect API? Is the link to betaAppReviewSubmissions in the Background Assets documentation incorrect? When will the public documentation and OpenAPI specification be updated? Thank you.

Hi! I'm observing a problem with ASC webhooks. I have a webhook with all event triggers enabled, and I verified it works: events such as buildUploadStateUpdated and buildBetaDetailExternalBuildStateUpdated are delivered. However, when a screenshot feedback is submitted from an external testing group, no webhook is dispatched (confirmed it does not appear in "Recent deliveries"). The screenshot feedback is submitted successfully, the screenshots appear in the ASC dashboard. Basing on the documentation, I think this event should trigger the BETA_FEEDBACK_SCREENSHOT_SUBMISSION_CREATED webhook.

Hello, I'm developing a consumer iOS app (Capacitor + RevenueCat SDK) and I've been blocked for several weeks on a StoreKit issue: subscription products are never returned to the device, so the Apple payment sheet cannot open. I previously contacted Apple Support. I was told to request a phone call, but my call request was declined because of the topic (StoreKit / in-app purchases). I'm posting here hoping someone from Apple or the community can help. App details App name: Vytal AI Bundle ID: com.ciborgu.vytalai App Store Connect App ID: 6767160542 Team ID: JZF7CR3W8Z Distribution: TestFlight (physical iPhone, France) iOS deployment target: 15+ Subscription product IDs (auto-renewable) vytalai_premium_monthly vytalai_premium_yearly vytalai_premium_yearly_intro All three are in subscription group "Vytal AI" on the correct ASC app (not a typo bundle). Cleared for Sale is ON. Paid Apps Agreement is active. In-App Purchase capability is enabled on the App ID (checkbox is grayed out / locked, which I understand is normal). Problem On a real device via TestFlight: RevenueCat SDK configures successfully (public iOS API key present in build). Purchases.getProducts({ productIdentifiers: [...] }) returns { products: [] } — zero products. Because StoreKit returns an empty array, the Sandbox payment sheet never appears when the user taps Subscribe. This is NOT a UI issue — the native SDK call to Apple returns no products. What I've already verified Bundle ID in signed IPA matches ASC app: com.ciborgu.vytalai Subscriptions exist only on the correct app (not on an old typo bundle com.ciborgue.vytalai) Removed duplicate ASC app; old App ID cannot be deleted ("in use by App Store") but has no IAPs Regenerated EAS provisioning profile for com.ciborgu.vytalai Sandbox tester account configured on device (Settings → App Store → Sandbox Account) Tested without VPN / iCloud Private Relay Reinstalled app from TestFlight after ASC changes Waited for propagation after metadata / availability updates Associated Domains enabled (for deep links) — separate from IAP SDK / integration @revenuecat/purchases-capacitor 13.x Direct StoreKit fetch via Purchases.getProducts() (not only RevenueCat offerings) Same result: 0 products from Apple Expected vs actual Expected: StoreKit returns 3 subscription products in Sandbox; payment sheet opens on purchase. Actual: products array is always empty; no payment sheet. Questions Why would StoreKit return 0 products for valid auto-renewable subscriptions on TestFlight when metadata is "Waiting for Review" / in review — shouldn't Sandbox still return products per TN3186? Is there an ASC configuration state (availability, subscription group localization, missing review screenshot on yearly products, etc.) that causes StoreKit to return zero products even in Sandbox? Is there an internal flag or propagation delay on Apple's side I should ask to be reset for this app/bundle? I'm happy to provide additional logs, a sysdiagnose, or a short screen recording from TestFlight showing the empty product response. Thank you for any guidance — this is blocking App Review (Guideline 2.1) and I cannot test IAP at all. Nathan