App Store Connect Account

Everything under flowdeck ship needs two things: an App Store Connect account FlowDeck can authenticate as, and a repository that knows which app record it belongs to. This page covers both.

# Is an account connected, and which one?
flowdeck ship auth status

# Is this repository linked to an app?
flowdeck ship app status

Both are read-only and safe to run at any time. Together they answer “can this project ship, and where to”.

One credential, and it is an API key

FlowDeck never asks for an Apple ID password. The only credential it stores is an App Store Connect API key you create yourself, kept in your login keychain. That is deliberate. An Apple ID gives away your entire Apple account; an API key is scoped to App Store Connect, revocable on its own, and documented, so it does not break when Apple changes something private. Create one in App Store Connect under Users and Access › Integrations, and download the .p8 file. Apple lets you download it once.

Connecting an account

flowdeck ship auth add \
  --key-id ABC123XYZ9 \
  --issuer-id 69a6de70-1111-2222-3333-444444444444 \
  --private-key ~/Downloads/AuthKey_ABC123XYZ9.p8 \
  --name "Personal"

Option	Description
`--key-id`	The Key ID shown beside the key in App Store Connect
`--issuer-id`	The Issuer ID shown above the key list
`--private-key`	Path to the downloaded `.p8`
`--private-key-stdin`	Read the key from standard input instead of a file
`--name`	A label for this account, so `auth list` is readable

The key is checked against Apple before anything is stored. A key that cannot authenticate, or that lacks permission to read apps, is refused rather than saved for you to discover later.

There is no --team-id. An API key belongs to exactly one account, and that account is exactly one team, so FlowDeck derives the Developer Team ID itself.

More than one account

Credentials are keyed by issuer ID, so a machine can hold as many as you have.

# Every connected account
flowdeck ship auth list

# Record which account this repository ships with
flowdeck ship auth use --issuer-id 69a6de70-1111-2222-3333-444444444444

A project names its account explicitly, in .flowdeck/config.json. It is never inferred: two accounts can share a team, and the cost of guessing wrong is a build pushed to somebody else’s listing. If several accounts are connected and the repository has not chosen one, commands fail with shipAmbiguousAccount rather than picking for you.

Checking an account

# Read the stored credential
flowdeck ship auth status

# Verify it against Apple as well
flowdeck ship auth status --verify

# JSON, for scripts and agents
flowdeck ship auth status --json

{
  "signedIn": true,
  "issuerId": "69a6de70-1111-2222-3333-444444444444",
  "keyId": "ABC123XYZ9",
  "name": "Personal",
  "teamId": "ABCDE12345",
  "isAdmin": true,
  "tokenValid": true
}

isAdmin reports whether this key can create app records in App Store Connect, which is an Admin-only action on the web. It is a Bool?: absent means the check could not be made, not that you lack the permission.

Removing an account

flowdeck ship auth remove --issuer-id 69a6de70-1111-2222-3333-444444444444

This removes the keychain item and nothing else. The key itself stays live. A key cannot revoke itself and revocation is not in Apple’s public API, so revoke it in App Store Connect under Users and Access › Integrations when you mean to.

Linking a project to an app

An account can reach many apps. Linking records which one this repository ships to, in a small git-tracked file so the whole team inherits it.

# Apps this account can reach
flowdeck ship app list

# Every connected account's apps at once
flowdeck ship app list --all-accounts

# Link this repository
flowdeck ship app link --bundle-id com.example.myapp

Choosing the app is what chooses the account: --all-accounts tags each row with its issuer, so you do not have to know which account holds which app before you can pick one.

Where a project stands

flowdeck ship app status --json

An unlinked repository answers from local files alone, with no network call:

{ "linked": false }

A linked one adds the app record and a row per platform:

{
  "linked": true,
  "appId": "1457476313",
  "bundleId": "com.example.myapp",
  "name": "My App",
  "platforms": [
    { "platform": "IOS", "currentVersion": "2.9.1", "liveVersion": "2.9.0" }
  ]
}

currentVersion is the newest version in any state; liveVersion is the newest one on sale. They are equal when nothing new is in flight, and liveVersion is absent for a platform that has never shipped.

When the app record does not exist yet

Apple does not allow creating an app record through the API, for any key. It has to be done on the web. app init automates everything around that one step:

flowdeck ship app init --bundle-id com.example.myapp --name "My App"

It registers the bundle ID through the API, prints the SKU to use, opens the App Store Connect form, then polls until the record appears and links it for you.

app init waits for a person to fill in a form. It is not suitable for CI or for an unattended agent run.

With an account connected and a project linked, see TestFlight for building, uploading, and getting the build to testers.

Overview

FlowDeck for AI

Interactive Mode (TUI)

Core Features

Command Reference

Advanced

Support

App Store Connect Account

One credential, and it is an API key

Connecting an account

More than one account

Checking an account

Removing an account

Linking a project to an app

Where a project stands

When the app record does not exist yet

Next

​One credential, and it is an API key

​Connecting an account

​More than one account

​Checking an account

​Removing an account

​Linking a project to an app

​Where a project stands

​When the app record does not exist yet

​Next

One credential, and it is an API key

Connecting an account

More than one account

Checking an account

Removing an account

Linking a project to an app

Where a project stands

When the app record does not exist yet

Next