Store API keys

A store API key lets Bifrost upload builds to App Store Connect or Google Play on your behalf. Keys are stored once per team under Team → Integrations and reused by every app on the team. The wizard asks the team owner for one the first time a credential needs it, and you can add or replace it on the Integrations page at any time.

You can still upload a different key for a single app at the API key step of the wizard, or later from the credential page.

App Store Connect API key

Managed iOS signing needs a Team key with the Admin or App Manager role. Individual keys can't reach Apple's provisioning API.

1. Open the Integrations page in App Store Connect.
2. On the Team Keys tab click + to create a key.
3. Name it, for example "Bifrost", choose App Manager access, and click Generate.
4. Download the .p8 file. Apple lets you download it only once, so keep it somewhere safe.
5. Note the Key ID shown beside the key and the Issuer ID shown above the list.

Give Bifrost the .p8 file, the Key ID and the Issuer ID. Use one key per service rather than sharing a key you made for something else.

Play Store service account

1. In Google Cloud Console create a project, ideally under the same Google account as your Play Console.
2. Enable the Google Play Android Developer API for that project.
3. Under IAM & Admin → Service Accounts click Create service account, give it a name, and finish. Note its email address.
4. From the account's Actions menu choose Manage keys → Add key → Create new key, pick JSON, and download the file.
5. In Play Console go to Users and permissions, invite the service account's email address, and grant Draft apps, Releases and Store presence.

Give Bifrost the JSON file. Grant the permissions at the account level so one service account covers every app on the team; if you scope them to a single app, that app needs its own key in Bifrost.