> ## Documentation Index
> Fetch the complete documentation index at: https://docs.asccli.sh/llms.txt
> Use this file to discover all available pages before exploring further.

# Auth

# Authentication Commands

> Manage App Store Connect API credentials and authentication

## Overview

Authentication commands manage your App Store Connect API credentials. Credentials are stored securely in the system keychain when available, with a config file fallback.

## Authentication Resolution

Credentials are resolved in this order:

1. Selected profile (keychain or config)
2. Environment variables (fallback for missing fields)

Use `--strict-auth` or `ASC_STRICT_AUTH=true` to fail when sources are mixed.

## Commands

### `asc auth init`

Create a template config.json for authentication.

<ParamField path="--force" type="boolean" default="false">
  Overwrite existing config.json
</ParamField>

<ParamField path="--local" type="boolean" default="false">
  Write config.json to `./.asc` in the current repo instead of `~/.asc`
</ParamField>

<ParamField path="--open" type="boolean" default="false">
  Open the App Store Connect API keys page in your browser
</ParamField>

**Examples:**

```bash theme={null} theme={null}
asc auth init
asc auth init --local
asc auth init --force
asc auth init --open
```

**Response:**

```json theme={null} theme={null}
{
  "config_path": "/Users/name/.asc/config.json",
  "created": true,
  "config": {}
}
```

***

### `asc auth login`

Register and store App Store Connect API key credentials.

<ParamField path="--name" type="string" required>
  Friendly name for this key
</ParamField>

<ParamField path="--key-id" type="string" required>
  App Store Connect API Key ID
</ParamField>

<ParamField path="--issuer-id" type="string" required>
  App Store Connect Issuer ID
</ParamField>

<ParamField path="--private-key" type="string" required>
  Path to private key (.p8) file
</ParamField>

<ParamField path="--bypass-keychain" type="boolean" default="false">
  Store credentials in config.json instead of keychain
</ParamField>

<ParamField path="--local" type="boolean" default="false">
  When bypassing keychain, write to `./.asc/config.json`
</ParamField>

<ParamField path="--network" type="boolean" default="false">
  Validate credentials with a lightweight API request
</ParamField>

<ParamField path="--skip-validation" type="boolean" default="false">
  Skip JWT and network validation checks
</ParamField>

**Examples:**

```bash theme={null} theme={null}
asc auth login --name "MyKey" --key-id "ABC123" --issuer-id "DEF456" --private-key /path/to/AuthKey.p8
asc auth login --bypass-keychain --local --name "MyKey" --key-id "ABC123" --issuer-id "DEF456" --private-key /path/to/AuthKey.p8
asc auth login --network --name "MyKey" --key-id "ABC123" --issuer-id "DEF456" --private-key /path/to/AuthKey.p8
```

**Output:**

```
Storing credentials in system keychain
Successfully registered API key 'MyKey'
```

***

### `asc auth switch`

Switch the default authentication profile.

<ParamField path="--name" type="string" required>
  Profile name to set as default
</ParamField>

**Examples:**

```bash theme={null} theme={null}
asc auth switch --name "Personal"
asc auth switch --name "Client"
```

**Output:**

```
Default profile set to 'Personal'
```

***

### `asc auth logout`

Remove stored API credentials.

<ParamField path="--all" type="boolean" default="false">
  Remove all stored credentials (default behavior)
</ParamField>

<ParamField path="--name" type="string">
  Remove a named credential
</ParamField>

**Examples:**

```bash theme={null} theme={null}
asc auth logout
asc auth logout --all
asc auth logout --name "MyKey"
```

**Output:**

```
Successfully removed stored credential 'MyKey'
```

***

### `asc auth status`

Show current authentication status.

<ParamField path="--output" type="string" default="table">
  Output format: `table`, `json`
</ParamField>

<ParamField path="--verbose" type="boolean" default="false">
  Show detailed storage information
</ParamField>

<ParamField path="--validate" type="boolean" default="false">
  Validate stored credentials via network
</ParamField>

**Examples:**

```bash theme={null} theme={null}
asc auth status
asc auth status --output json
asc auth status --verbose
asc auth status --validate
```

**Response (table):**

```
Credential storage: System Keychain
Location: system keychain

Stored credentials:
Name    Key ID   Default  Stored In
MyKey   ABC123   yes      keychain
```

**Response (JSON):**

```json theme={null} theme={null}
{
  "storageBackend": "System Keychain",
  "storageLocation": "system keychain",
  "credentials": [
    {
      "name": "MyKey",
      "keyId": "ABC123",
      "isDefault": true,
      "storedIn": "keychain"
    }
  ],
  "environmentCredentialsProvided": false,
  "environmentCredentialsComplete": false
}
```

***

### `asc auth doctor`

Diagnose authentication configuration issues.

<ParamField path="--output" type="string" default="text">
  Output format: `text`, `json`
</ParamField>

<ParamField path="--fix" type="boolean" default="false">
  Attempt to fix issues where possible
</ParamField>

<ParamField path="--confirm" type="boolean" default="false">
  Confirm applying fixes (required with `--fix`)
</ParamField>

**Examples:**

```bash theme={null} theme={null}
asc auth doctor
asc auth doctor --output json
asc auth doctor --fix --confirm
```

**Response:**

```
Auth Doctor

Keychain:
  [OK] Keychain available
  [OK] Keychain accessible

Config:
  [OK] Config file exists
  [OK] Config file readable

Profiles:
  [OK] Profile 'MyKey' valid

No issues found.
```

## Environment Variables

* `ASC_KEY_ID` - API Key ID
* `ASC_ISSUER_ID` - Issuer ID
* `ASC_PRIVATE_KEY_PATH` - Path to .p8 file
* `ASC_PRIVATE_KEY` - PEM-encoded private key
* `ASC_PRIVATE_KEY_B64` - Base64-encoded private key
* `ASC_BYPASS_KEYCHAIN` - Set to `1`, `true`, `yes`, `y`, or `on` to bypass keychain
* `ASC_STRICT_AUTH` - Set to `true`, `1`, `yes`, `y`, or `on` to fail on mixed credential sources
* `ASC_PROFILE` - Select a named profile

## Generating API Keys

Generate API keys at: [https://appstoreconnect.apple.com/access/integrations/api](https://appstoreconnect.apple.com/access/integrations/api)