Lagerland Apps

API access · Methodology · Public, citable

How AppMeta Pulse
talks to App Store Connect.

AppMeta Pulse authenticates to App Store Connect using Apple's official API with a key you generate in your own account. This page documents which endpoints the app calls, which API key role each one needs, how the short-lived JWT tokens are signed and refreshed, where credentials live, and what the app cannot do because of the scope it works under. You can check all of it against Apple's own documentation.

See AppMeta Pulse Jump to endpoint table

What you generate and what the app stores

App Store Connect API keys are generated in your App Store Connect account, not by AppMeta Pulse. The app cannot generate or escalate a key; it can only use the one you give it.

In App Store Connect (you)
  • Sign in to App Store Connect with an account that has permission to create API keys (Admin or Account Holder).
  • Open Users and Access → Integrations → App Store Connect API.
  • Generate a new key with the Admin role. AppMeta Pulse asks for Admin because it is the role that covers sales reports, App Analytics, and review replies together; App Manager and Developer keys can't read sales reports, and Apple answers them with a 403 error.
  • Download the .p8 private key file. Apple only lets you download it once; if you lose it, you generate a new one.
  • Copy the Key ID (10-character string) and the Issuer ID (your team's UUID, shown above the keys list). Pulse also needs your Vendor Number from Payments and Financial Reports to download sales reports.
In AppMeta Pulse (the app)
  • Paste or import the .p8 file, Key ID, and Issuer ID into AppMeta Pulse.
  • The three values are stored together in the iPhone Keychain, the secure storage iOS uses for passwords and Wi-Fi credentials. The .p8 key is kept for this device only.
  • The .p8 key is never written to plain files, iCloud Drive, iCloud Sync, or any server, and the app contains no analytics SDKs. With iCloud Sync on, the account name and vendor number you entered sync to your own private iCloud database; the key stays on this iPhone.
  • Revoke the key any time in App Store Connect → Users and Access → Integrations. Revocation takes effect at Apple's API immediately; the app cannot circumvent it.

How each request is signed

Per Apple's documented requirements for API tokens, every request to the App Store Connect API must include a short-lived JSON Web Token signed with ES256 using your private key. AppMeta Pulse does this signing locally, so the .p8 private key never leaves your device.

01
Token construction
Header: alg: ES256, kid: <your Key ID>, typ: JWT. Payload: iss: <your Issuer ID>, iat: <now>, exp: <now + ≤20 min>, aud: appstoreconnect-v1. Apple's documentation specifies a maximum token lifetime of 20 minutes, and the API rejects tokens with a longer expiry.
02
Signing
The token header + payload is signed locally with the ES256 algorithm using your .p8 private key. The signing happens on-device; the private key bytes never go to a network. Apple's API verifies the signature using the public key registered against your Key ID.
03
Request
The signed JWT is attached as an Authorization: Bearer <token> header on each HTTPS request to https://api.appstoreconnect.apple.com. The request goes directly to Apple, with no intermediate proxy, Lagerland server, or third-party analytics endpoint in between.
04
Refresh
When the JWT is close to expiry, AppMeta Pulse generates a new one from the same stored Key ID, Issuer ID, and .p8, built the same way with a new iat and exp. There is no refresh token in the OAuth sense; Apple's API uses self-signed short-lived JWTs only.

Endpoints called and the role each needs

AppMeta Pulse asks for one key with the Admin role, because that role covers everything below. Apple's role permissions decide what a key can reach; when a request is refused, Settings → Connection in the app shows which data source failed and why.

Sales and Trends reports
Endpoint: GET /v1/salesReports with report type SALES, daily (and yearly for the By Year chart), using your Vendor Number. Returns units, customer price, and developer proceeds per product and territory.

Role: Admin. App Manager and Developer keys can list your apps but can't download sales reports; Apple answers them with a 403 error, and the app says so at sign-in.

This is the endpoint that drives the proceeds, sales, downloads, and territory views.
Subscription reports
Endpoint: GET /v1/salesReports with report types SUBSCRIPTION and SUBSCRIPTION_EVENT, daily.

Role: Admin, as for the Sales report.

Drives the subscription views: MRR, active subscriptions, trials, churn, and cancellations. The trial and conversion figures are estimates built from new subscriptions and the current number of active trials, not an exact trial-to-paid rate.
App Analytics
Endpoints: GET on /v1/apps/{id}/analyticsReportRequests, the reports, instances, and segments under it, plus the time-limited download links Apple returns; and POST /v1/analyticsReportRequests for an app that has no request yet (an ongoing one, plus a one-time snapshot for history on the first sync), which asks Apple to start preparing the reports.

Role: Admin. With a key that lacks it, Pulse skips analytics for that app and reports it in Settings → Connection.

Drives impressions, product page views, and the App Store conversion funnel.
Catalog and customer reviews
Endpoints: GET /v1/apps, each app's in-app purchases and subscription groups, and GET /v1/apps/{id}/customerReviews with any developer responses.

Role: a key that can't post replies can still read reviews; replying needs Admin, and the app asks for an Admin key when a reply is refused.

Drives the app list, product names, and the reviews screens.
Endpoints AppMeta Pulse does NOT call
It calls no endpoints for build submission, app metadata edits, pricing, or TestFlight management. The app writes to App Store Connect in exactly two places: POST, PATCH, and DELETE on /v1/customerReviewResponses when you send, edit, or delete a review reply, and POST /v1/analyticsReportRequests, which asks Apple to start preparing your analytics reports.

What the app can and cannot change

There are two layers of limits: what the app's code does, and what your key's role allows.

At the app level
  • The network layer reads with GET. Its only writes are review replies you send (POST, PATCH, DELETE on customer review responses) and analytics report requests (POST). There is no code for builds, metadata, pricing, or TestFlight.
  • The UI has no "submit," "publish," metadata, or pricing controls. The only buttons that change App Store Connect are Reply (to one review or a batch of up to 25), Edit, and Delete on your own review responses.
  • You cannot push the wrong build or raise the wrong price inside AppMeta Pulse, because the code for it does not exist.
At Apple's API level
  • The role you set on the API key determines what the key can do. An Admin key could change far more than Pulse ever asks of it. What Pulse can change is set by its code, listed on the left.
  • You can revoke the key in App Store Connect at any time; the next API call from AppMeta Pulse fails with a 401 error, and Settings → Connection shows it.
  • Apple's API enforces the role on every request and does not rely on trusting the calling app.

How fresh the data is

App Store Connect's own reporting cadence is the upper bound on freshness; no third-party dashboard can be faster than Apple's source data.

Sales and Trends
Apple publishes each day's report the following day, generally by 8 a.m. Pacific Time (Apple). That is the same cadence as the App Store Connect web dashboard; App Store analytics arrive a day or two later. AppMeta Pulse refreshes in the background about hourly (iOS decides the exact timing) and syncs again when you open the app. It shows whatever Apple has published for your account so far.
Financial Reports
Apple publishes monthly Financial Reports after each fiscal month closes. These are the canonical reconciliation source for tax filing and accounting. AppMeta Pulse only reads Sales and Trends figures (next-day), not Payments and Financial Reports; for tax filing, reconcile against Apple's monthly downloadable Financial Reports.

What we do not promise

Honest limits
  • Numbers can never be fresher than Apple's reporting cadence. Pulse can't make Apple publish its reports sooner.
  • Pulse converts every amount into your display currency with the European Central Bank's monthly average rates. Apple pays with its own exchange rates and after withholding and bank fees, so converted totals will not match what hits your bank account.
  • If your API key's role can't read a data source (an App Manager or Developer key can't download reports), Settings → Connection says which one failed and why, so you don't get silently empty charts.
  • Apple sets the App Store Connect API rate limits. Very frequent syncing can be throttled for a while.
What is under our control
  • Where the .p8 key lives (the iPhone Keychain, never iCloud Drive, a plaintext file, or a third-party server).
  • Where your data goes when iCloud Sync is on (your own private iCloud database, which we can't access; the .p8 key never syncs).
  • What the app does with your data after fetching it (keeps it on your iPhone; nothing is sent to us, and there is no Pulse server).
  • Which App Store Connect writes the app makes (only the review replies you send and analytics report requests, listed above).

About AppMeta Pulse

AppMeta Pulse Your App Store sales, subscriptions, and reviews on your iPhone, with the history kept. App Store Connect dashboard for iPhone: proceeds, MRR, and reviews for every app, sales history kept past Apple's one year, and 12 widgets. Free · ProRated 4.0 · 4 ratingsiPhone

Use it

Try AppMeta Pulse

App Store Connect sales, subscriptions, and reviews on your iPhone. Pulse can't change your prices, builds, or metadata, the .p8 key stays in your iPhone Keychain, and your requests go only to Apple.

Learn about AppMeta Pulse AppMeta Pulse vs AppStats