How to connect App Store Connect to Broctic (step by step)
Generating an App Store Connect API key that can read sales reports, finding your Issuer ID, Key ID and Vendor Number, and what each error means when it does not work.
Four values, from three different places
Reading an App Store account's sales figures needs four things, and Apple keeps them in three places, which is the reason this is a documented procedure rather than a form. You need an Issuer ID and a Key ID, which identify the credential; a .p8 private key file, which is the credential; and a Vendor Number, which identifies the account the reports are filed under.
The first three come from Users and Access. The fourth deliberately does not, and it is not available from Apple's API at all — which is why every tool that reads App Store sales asks you for it by hand.
It has to be a Team key
In App Store Connect, open Users and Access, choose the Integrations tab, and select Team Keys. This is the step people get wrong, because the same tab also offers individual keys, and an individual key looks like it should work.
It does not. Sales and Finance reports are only available to Team keys. An individual key authenticates perfectly and then fails to download a report — a 403, not a 401 — which reads like a credentials problem and is actually a key-type problem.
Generate the key with the Admin role, or with Finance or Sales access. All three can read sales reports; the narrower one is the better habit.
The Issuer ID, the Key ID, and the one download you get
Once the key exists, the Issuer ID appears above the keys table. It is a UUID, and it belongs to the whole account rather than to this key, so it is the same value any other tool you have connected is using.
The Key ID sits in the key's row — about ten alphanumeric characters. It has to match the .p8 you download next, and mixing a Key ID from one key with a .p8 from another is the most common cause of a 400 from Apple.
Then click Download API Key. Apple allows this exactly once. There is no re-download, no recovery, and no support path back to it: if you lose the file you revoke the key and generate another. Put it in a password manager before you do anything else.
The Vendor Number, which is somewhere else entirely
Leave Users and Access and open Payments and Financial Reports. Your vendor number is at the top of that page, in the form Vendor #87654321. Copy the digits without the hash.
A wrong vendor number is the nastiest failure in this whole procedure, because it does not fail. Authentication succeeds, the request succeeds, and Apple answers that this vendor has no reports for that day — which is indistinguishable from an app that made no sales. If a connection verifies and then never produces a single report, check this field first.
Pasting it into Broctic
In Broctic, go to Settings → Integrations → App Store Connect and enter the Issuer ID, Key ID and Vendor Number, then paste the entire contents of the .p8 file, BEGIN and END lines included. Line breaks mangled by copying through a terminal or a chat window are repaired for you.
Broctic calls Apple with the key before storing it. A key Apple rejects is never written down, so a typo gives you an error rather than a connection that silently does nothing. A key that works is sealed with AES-256-GCM, decrypted only by the code path that signs a request to Apple, and returned by no route — and the apps it can see are listed immediately, which is also how you import an app you already shipped.
What happens in the first hour
The first sync pulls the newest 21 days, so the current week is on the page in the first minute rather than after a full backfill. History then fills in over the following hours, up to Apple's one-year horizon for daily sales reports.
After that a scheduled job syncs hourly, whether or not anyone has the console open, which is what makes yesterday's figure already on the page instead of fetched while you wait.
Apple publishes each day's report by 08:00 Pacific the next morning. Before that deadline a missing day means 'not published yet'; after it, a missing day means Apple reported no sales, which is a real zero. Those are different facts and Broctic states which one it is rather than drawing a zero either way.
Frequently asked
- Why can't an individual App Store Connect key read sales reports?
- Apple restricts Sales and Finance report access to keys generated under Users and Access → Integrations → Team Keys. An individual key authenticates as a person and is rejected with a 403 when it asks for a sales report, whatever role that person holds.
- Where do I find my App Store Connect vendor number?
- In App Store Connect under Payments and Financial Reports, shown at the top of the page as Vendor #87654321. It is not on the API keys page, and Apple's API does not expose it, so it has to be entered by hand.
- I lost the .p8 file. Can I download it again?
- No. Apple allows the download once and cannot re-issue it. Revoke the key in App Store Connect, generate a new one, and paste the new Issuer ID, Key ID and .p8 into Broctic. Data already ingested is unaffected.
- What does a 400 from Apple mean when connecting?
- The Issuer ID, Key ID and .p8 do not agree with each other — usually a Key ID copied from a different key than the downloaded file. Re-copy both from the same row. A 403 means the opposite: the credential is valid but is not allowed to read sales, so it is an individual key or a role without Sales or Finance access.