> ## Documentation Index
> Fetch the complete documentation index at: https://docs.oleria.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Apple Developer Program

> Connect your Apple Developer Program team to Oleria for visibility into team members, pending invitations, and App Store Connect roles, and to change roles or remove members.

The Apple Developer Program team is the group of people who build, sign, and ship your organization's apps. Its members and their roles are managed in App Store Connect. Connect your team to Oleria to see who belongs to it, which App Store Connect roles they hold, who can manage signing certificates, and which invitations are still pending. Oleria reads this data from the App Store Connect API.

## What Oleria discovers

Once connected, Oleria continuously discovers and maps the following from your Apple Developer Program team:

* **Accounts** - every member of the team, with name, Apple Account email, and roles. Pending invitations appear as disabled accounts with the roles they will receive once accepted, so an outstanding invitation for an Admin is visible before anyone accepts it.
* **Roles** - your App Store Connect roles, with the accounts that hold each one: **Account Holder**, **Admin**, **App Manager**, **Developer**, **Finance**, **Sales**, **Marketing**, **Customer Support**, and the additional permissions **Access to Reports**, **Create Apps**, **Generate Individual API Keys**, **Cloud-Managed Apple Distribution Certificate**, and **Cloud-Managed Developer ID Certificate**. **Access to Certificates, Identifiers & Profiles** is shown as its own role; Account Holders and Admins always hold it as part of their role.

Oleria uses this data for access reviews and user inventory, refreshed on Oleria's [regular sync schedule](/integrations/overview#sync-model).

<Note>
  This integration doesn't read apps, per-app access, certificates, provisioning profiles, devices, or TestFlight testers, so it doesn't populate resource-level Access Graph or Access Inventory data. App Store Connect has no user groups, and its API doesn't expose sign-in activity, audit logs, or API keys, so Oleria doesn't collect activity for this integration. Apple requires two-factor authentication for every App Store Connect sign-in, so Oleria shows MFA as required for every member.
</Note>

## Prerequisites

* An App Store Connect user with the **Admin** role to create a team API key.
* Admin access on the Oleria platform to add a new integration.

<Note>
  The exact location of these settings can change over time. If the steps below don't match what you see, refer to Apple's App Store Connect API documentation.
</Note>

## Create an App Store Connect team API key

Oleria connects with an App Store Connect **team** API key: its **Issuer ID**, its **Key ID**, and its **private key** (a `.p8` file). Individual API keys aren't supported, because they belong to one person and stop working when that person leaves the team.

<Steps>
  <Step title="Open the App Store Connect API keys">
    Sign in to [App Store Connect](https://appstoreconnect.apple.com) as an Admin. Select **Users and Access**, select the **Integrations** tab, then select **App Store Connect API** and make sure **Team Keys** is selected.
  </Step>

  <Step title="Copy the Issuer ID">
    Copy the **Issuer ID** shown at the top of the page. It identifies your team.
  </Step>

  <Step title="Generate a key with the Admin role">
    Select **Generate API Key** (or **+**). Give it a name such as `Oleria` and, under **Access**, select **Admin**. Oleria needs the Admin role to read team members and to change roles or remove members.
  </Step>

  <Step title="Copy the Key ID and download the private key">
    Copy the new key's **Key ID**, then select **Download API Key** to download its `.p8` file. Apple lets you download the private key only once, so store it securely until you've finished connecting.
  </Step>
</Steps>

<Tip>
  If the key is ever exposed, revoke it in App Store Connect, generate a new one, and update the integration in Oleria.
</Tip>

## Connect Apple Developer Program to Oleria

<Steps>
  <Step title="Open the integration">
    Go to your Oleria workspace, select **Integrations**, then select the **Apple Developer Program** tile.
  </Step>

  <Step title="Complete the connection form">
    Fill in the connection form:

    | Field | Notes |
    | :- | :- |
    | Issuer ID | Required. The UUID from [Create an App Store Connect team API key](#create-an-app-store-connect-team-api-key). |
    | Key ID | Required. The Key ID of the team key with the Admin role. |
    | Private Key (.p8) | Required. Paste the full contents of the `.p8` file, including the `BEGIN PRIVATE KEY` and `END PRIVATE KEY` lines. |
  </Step>

  <Step title="Save the integration">
    Select **Authenticate**. Oleria checks that the private key is a valid App Store Connect key and that Apple accepts it for reading team members and pending invitations. Then it saves the integration.
  </Step>
</Steps>

## Verify the integration

Confirm the new instance appears on the **Connected** tab of your Oleria **Integrations** page with a status of **Healthy**. Oleria syncs team members, pending invitations, and roles from App Store Connect on its [regular sync schedule](/integrations/overview#sync-model) once the initial sync completes.

<Note>
  To rotate the key, edit the integration and enter the new **Key ID** together with its **Private Key (.p8)**. Leave **Private Key (.p8)** blank to keep the stored key when you aren't changing the Key ID. The Issuer ID can't be changed after you connect; to connect a different team, add a new integration.
</Note>

## Remediation actions

Beyond discovery, Oleria can act on Apple Developer Program access to remediate risk. Actions use the Admin role of the connected team API key. If the key doesn't have the Admin role, App Store Connect rejects these changes and Oleria reports the action as failed for missing permission. Apple doesn't expose a key's role, so Oleria can't check it before you run an action.

| Action | What it does | Revert |
| :- | :- | :- |
| Disable user accounts | Removes the member from your team. For a pending invitation, cancels the invitation. | Not supported - Apple has no API to restore a removed member. Re-invite them in App Store Connect; they must accept the new invitation. |
| Add user to role | Adds an App Store Connect role to the member, or grants **Access to Certificates, Identifiers & Profiles**. | Supported - removes the role, if Oleria added it. |
| Remove user from role | Removes an App Store Connect role from the member, or removes **Access to Certificates, Identifiers & Profiles**. | Supported - re-adds the role, if Oleria removed it. |

<Warning>
  Removing a member can't be undone from Oleria. Confirm the action before you run it, and re-invite the member in App Store Connect if you need to restore their access.
</Warning>

Some changes are refused because App Store Connect doesn't allow them:

* The **Account Holder** can't be removed and their roles can't be changed. Transfer the Account Holder role in App Store Connect first.
* A member's only role can't be removed, because every member needs at least one role. Remove the member instead.
* **Access to Certificates, Identifiers & Profiles** can't be removed from an Admin, because the Admin role includes it. Remove the Admin role instead.
* Roles of a pending invitation can't be changed. Cancel the invitation and send a new one.

## Contact us

For questions about this integration, contact us at [support@oleria.com](mailto:support@oleria.com).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.