The short version
- Your key lives in your devices’ Keychain. Your devices sign their own requests and send them straight to Apple.
- Apple receives short-lived signed tokens, never the key itself. Neither do we.
- Live alerts come from Apple’s signed notifications and never need your key.
- SaapVue asks for the fewest roles each feature needs, and tells you which ones it doesn’t.
Where your key is kept
When you add a key, SaapVue reads the .p8 file you pick and stores it in the Keychain as a private key, not as a password. By default it syncs to your other Apple devices through iCloud Keychain, which is end-to-end encrypted. Turn on This device only and it stays where it is.
The key is readable after the device’s first unlock, so widgets and background refresh can update while the device is locked. Remove the key in Settings and SaapVue first stops any sync in progress, then deletes it from the Keychain.
How requests are signed
Apple’s API takes a JSON Web Token signed with your key (ES256). SaapVue makes them on the device as it needs them, each good for 15 minutes by default and never more than Apple’s limit of 20. The token goes to Apple with each request. The key stays in the Keychain.
The key, and any token made from it, is never written to a log, shown in an error message, or sent anywhere but Apple. SaapVue’s own tests use throwaway keys generated as they run, so no real key is ever part of the code.
Which roles to give the key
A key can do everything its roles allow, so give it as little as you can. Setup makes one small request per role, then shows what the key unlocks and which role would add the rest.
| Role | What SaapVue uses it for |
|---|---|
| Sales and Reports | Sales, subscriptions and true profit. Required. |
| Customer Support | Reading and replying to reviews. Recommended. |
| Finance | The payouts Apple actually made. Optional. |
| Marketing or App Manager | The listing editor and screenshot upload. Only if you use them, because these roles can change your listing. |
| Admin | Once, to switch on Apple’s analytics reports. SaapVue uses it on your device, then suggests going back to a smaller key. |
SaapVue changes nothing in App Store Connect unless you ask it to: replying to a review, applying a listing change, or switching on analytics reports.
Live alerts
Apple sends App Store Server Notifications to one URL per app. To get live alerts you give Apple a SaapVue URL made for that app alone, and we check Apple’s signature on every notification before acting on it, using Apple’s own library. Then we push it to your devices and pass it on, with retries, to the URL you used before, such as RevenueCat or your own server.
None of this needs your API key. Alerts need a SaapVue account, which is Sign in with Apple only.
Cloud history (Pro)
Cloud history keeps your data beyond Apple’s limits and syncs it to every device. It is the one feature that needs your key on a server, it is off unless you turn it on, and it isn’t available yet. Before it is, this page will describe exactly how the key is held, who can use it, and how you can delete it.
Taking access away
- Remove the key in SaapVue’s Settings: it is deleted from the Keychain on that device and, if it synced, from iCloud Keychain.
- Revoke the key in App Store Connect, under Users and Access, Integrations. It stops working everywhere at once.
- Point your notification URL back at its old address in App Store Connect, and live alerts stop.
Reporting a problem
If you find a security issue, email security@saapvue.com. Please give us a chance to fix it before telling anyone else.