> ## Documentation Index
> Fetch the complete documentation index at: https://docs.flowdeck.studio/llms.txt
> Use this file to discover all available pages before exploring further.
# App Store Connect Account
> Connect an App Store Connect account and link a project to its app record
Everything under `flowdeck ship` needs two things: an App Store Connect
account FlowDeck can authenticate as, and a repository that knows which app
record it belongs to. This page covers both.
```bash theme={null}
# Is an account connected, and which one?
flowdeck ship auth status
# Is this repository linked to an app?
flowdeck ship app status
```
Both are read-only and safe to run at any time. Together they answer "can this
project ship, and where to".
## One credential, and it is an API key
FlowDeck never asks for an Apple ID password. The only credential it stores is
an **App Store Connect API key** you create yourself, kept in your login
keychain.
That is deliberate. An Apple ID gives away your entire Apple account; an API
key is scoped to App Store Connect, revocable on its own, and documented, so
it does not break when Apple changes something private.
Create one in App Store Connect under **Users and Access › Integrations**, and
download the `.p8` file. Apple lets you download it once.
## Connecting an account
```bash theme={null}
flowdeck ship auth add \
--key-id ABC123XYZ9 \
--issuer-id 69a6de70-1111-2222-3333-444444444444 \
--private-key ~/Downloads/AuthKey_ABC123XYZ9.p8 \
--name "Personal"
```
| Option | Description |
| --------------------- | ---------------------------------------------------- |
| `--key-id` | The Key ID shown beside the key in App Store Connect |
| `--issuer-id` | The Issuer ID shown above the key list |
| `--private-key` | Path to the downloaded `.p8` |
| `--private-key-stdin` | Read the key from standard input instead of a file |
| `--name` | A label for this account, so `auth list` is readable |
The key is checked against Apple before anything is stored. A key that cannot
authenticate, or that lacks permission to read apps, is refused rather than
saved for you to discover later.
There is no `--team-id`. An API key belongs to exactly one account, and that
account is exactly one team, so FlowDeck derives the Developer Team ID itself.
## More than one account
Credentials are keyed by issuer ID, so a machine can hold as many as you have.
```bash theme={null}
# Every connected account
flowdeck ship auth list
# Record which account this repository ships with
flowdeck ship auth use --issuer-id 69a6de70-1111-2222-3333-444444444444
```
A project names its account explicitly, in `.flowdeck/config.json`. It is
never inferred: two accounts can share a team, and the cost of guessing wrong
is a build pushed to somebody else's listing.
If several accounts are connected and the repository has not chosen one,
commands fail with `shipAmbiguousAccount` rather than picking for you.
## Checking an account
```bash theme={null}
# Read the stored credential
flowdeck ship auth status
# Verify it against Apple as well
flowdeck ship auth status --verify
# JSON, for scripts and agents
flowdeck ship auth status --json
```
```json theme={null}
{
"signedIn": true,
"issuerId": "69a6de70-1111-2222-3333-444444444444",
"keyId": "ABC123XYZ9",
"name": "Personal",
"teamId": "ABCDE12345",
"isAdmin": true,
"tokenValid": true
}
```
`isAdmin` reports whether this key can create app records in App Store
Connect, which is an Admin-only action on the web. It is a `Bool?`: **absent
means the check could not be made**, not that you lack the permission.
## Removing an account
```bash theme={null}
flowdeck ship auth remove --issuer-id 69a6de70-1111-2222-3333-444444444444
```
This removes the keychain item and nothing else. **The key itself stays live.**
A key cannot revoke itself and revocation is not in Apple's public API, so
revoke it in App Store Connect under Users and Access › Integrations when you
mean to.
## Linking a project to an app
An account can reach many apps. Linking records which one this repository
ships to, in a small git-tracked file so the whole team inherits it.
```bash theme={null}
# Apps this account can reach
flowdeck ship app list
# Every connected account's apps at once
flowdeck ship app list --all-accounts
# Link this repository
flowdeck ship app link --bundle-id com.example.myapp
```
Choosing the app is what chooses the account: `--all-accounts` tags each row
with its issuer, so you do not have to know which account holds which app
before you can pick one.
## Where a project stands
```bash theme={null}
flowdeck ship app status --json
```
An unlinked repository answers from local files alone, with no network call:
```json theme={null}
{ "linked": false }
```
A linked one adds the app record and a row per platform:
```json theme={null}
{
"linked": true,
"appId": "1457476313",
"bundleId": "com.example.myapp",
"name": "My App",
"platforms": [
{ "platform": "IOS", "currentVersion": "2.9.1", "liveVersion": "2.9.0" }
]
}
```
`currentVersion` is the newest version in any state; `liveVersion` is the
newest one on sale. They are equal when nothing new is in flight, and
`liveVersion` is absent for a platform that has never shipped.
## When the app record does not exist yet
Apple does not allow creating an app record through the API, for any key. It
has to be done on the web. `app init` automates everything around that one
step:
```bash theme={null}
flowdeck ship app init --bundle-id com.example.myapp --name "My App"
```
It registers the bundle ID through the API, prints the SKU to use, opens the
App Store Connect form, then polls until the record appears and links it for
you.
`app init` waits for a person to fill in a form. It is not suitable for CI or
for an unattended agent run.
## Next
With an account connected and a project linked, see
[TestFlight](/cli/commands/ship/testflight) for building, uploading, and
getting the build to testers.