Skip to main content
The Apple Developer Program team is the group of people who build, sign, and ship your organization’s apps. Its members and their roles are managed in App Store Connect. Connect your team to Oleria to see who belongs to it, which App Store Connect roles they hold, who can manage signing certificates, and which invitations are still pending. Oleria reads this data from the App Store Connect API.

​
What Oleria discovers

Once connected, Oleria continuously discovers and maps the following from your Apple Developer Program team:
  • Accounts - every member of the team, with name, Apple Account email, and roles. Pending invitations appear as disabled accounts with the roles they will receive once accepted, so an outstanding invitation for an Admin is visible before anyone accepts it.
  • Roles - your App Store Connect roles, with the accounts that hold each one: Account Holder, Admin, App Manager, Developer, Finance, Sales, Marketing, Customer Support, and the additional permissions Access to Reports, Create Apps, Generate Individual API Keys, Cloud-Managed Apple Distribution Certificate, and Cloud-Managed Developer ID Certificate. Access to Certificates, Identifiers & Profiles is shown as its own role; Account Holders and Admins always hold it as part of their role.
Oleria uses this data for access reviews and user inventory, refreshed on Oleria’s regular sync schedule.
This integration doesn’t read apps, per-app access, certificates, provisioning profiles, devices, or TestFlight testers, so it doesn’t populate resource-level Access Graph or Access Inventory data. App Store Connect has no user groups, and its API doesn’t expose sign-in activity, audit logs, or API keys, so Oleria doesn’t collect activity for this integration. Apple requires two-factor authentication for every App Store Connect sign-in, so Oleria shows MFA as required for every member.

​
Prerequisites

  • An App Store Connect user with the Admin role to create a team API key.
  • Admin access on the Oleria platform to add a new integration.
The exact location of these settings can change over time. If the steps below don’t match what you see, refer to Apple’s App Store Connect API documentation.

​
Create an App Store Connect team API key

Oleria connects with an App Store Connect team API key: its Issuer ID, its Key ID, and its private key (a .p8 file). Individual API keys aren’t supported, because they belong to one person and stop working when that person leaves the team.
1

Open the App Store Connect API keys

Sign in to App Store Connect as an Admin. Select Users and Access, select the Integrations tab, then select App Store Connect API and make sure Team Keys is selected.
2

Copy the Issuer ID

Copy the Issuer ID shown at the top of the page. It identifies your team.
3

Generate a key with the Admin role

Select Generate API Key (or +). Give it a name such as Oleria and, under Access, select Admin. Oleria needs the Admin role to read team members and to change roles or remove members.
4

Copy the Key ID and download the private key

Copy the new key’s Key ID, then select Download API Key to download its .p8 file. Apple lets you download the private key only once, so store it securely until you’ve finished connecting.
If the key is ever exposed, revoke it in App Store Connect, generate a new one, and update the integration in Oleria.

​
Connect Apple Developer Program to Oleria

1

Open the integration

Go to your Oleria workspace, select Integrations, then select the Apple Developer Program tile.
2

Complete the connection form

Fill in the connection form:
3

Save the integration

Select Authenticate. Oleria checks that the private key is a valid App Store Connect key and that Apple accepts it for reading team members and pending invitations. Then it saves the integration.

​
Verify the integration

Confirm the new instance appears on the Connected tab of your Oleria Integrations page with a status of Healthy. Oleria syncs team members, pending invitations, and roles from App Store Connect on its regular sync schedule once the initial sync completes.
To rotate the key, edit the integration and enter the new Key ID together with its Private Key (.p8). Leave Private Key (.p8) blank to keep the stored key when you aren’t changing the Key ID. The Issuer ID can’t be changed after you connect; to connect a different team, add a new integration.

​
Remediation actions

Beyond discovery, Oleria can act on Apple Developer Program access to remediate risk. Actions use the Admin role of the connected team API key. If the key doesn’t have the Admin role, App Store Connect rejects these changes and Oleria reports the action as failed for missing permission. Apple doesn’t expose a key’s role, so Oleria can’t check it before you run an action.
Removing a member can’t be undone from Oleria. Confirm the action before you run it, and re-invite the member in App Store Connect if you need to restore their access.
Some changes are refused because App Store Connect doesn’t allow them:
  • The Account Holder can’t be removed and their roles can’t be changed. Transfer the Account Holder role in App Store Connect first.
  • A member’s only role can’t be removed, because every member needs at least one role. Remove the member instead.
  • Access to Certificates, Identifiers & Profiles can’t be removed from an Admin, because the Admin role includes it. Remove the Admin role instead.
  • Roles of a pending invitation can’t be changed. Cancel the invitation and send a new one.

​
Contact us

For questions about this integration, contact us at support@oleria.com.