Where is the Apple Team ID? Issuer ID, Key ID & API key for Expo

Short answer — these are four different things, on two different Apple sites:

• Team ID — developer.apple.com/account#MembershipDetailsCard. 10 characters. This is your Apple Developer Program membership, not an API key.
• Issuer ID — top of appstoreconnect.apple.com/access/integrations/api. A UUID for the whole team.
• Key ID — same API page, listed next to the key you created. Also ~10 characters. Easy to mix up with Team ID.
• Private key (.p8) — download once from that same page. Filename looks like AuthKey_XXXXXXXXXX.p8. If you lose it, you cannot re-download. Revoke and make a new key.

If an AI agent, Cursor, Claude Code, Codex, or EAS CI is asking you to “paste your Apple credentials so I can submit the iOS app,” those four values (plus an Expo access token) are what it actually wants.

Bookmark the URLs. Or press ⌘K and type apple team id.

Why this page exists

Apple split identity across two products that look related and are not.

Apple Developer (developer.apple.com/account) is membership, certificates, bundle IDs, and provisioning profiles. Team ID lives here.

App Store Connect (appstoreconnect.apple.com) is apps, TestFlight, App Review, and the App Store Connect API. Issuer ID, Key ID, and the .p8 live here.

Expo EAS, Fastlane, GitHub Actions, and every “ship this iOS app for me” agent need pieces from both. People paste Team ID into ascApiKeyIssuerId, paste Issuer ID into appleTeamId, then spend an afternoon on Invalid ASC json key.

The mix-up is the product. The URLs below are the fix.

The four values, side by side

Value	Looks like	Where	What it's for
Team ID	ABCD123456 (10 chars)	Membership details	Signing, certificates, Xcode, EAS Build, appleTeamId in eas.json
Issuer ID	UUID, 57246542-96fe-1a63-e053-0824d011072a	Integrations → API (top of the page)	JWT iss claim. ascApiKeyIssuerId in eas.json
Key ID	AB12CD34EF (10 chars)	Same API page, per key	JWT kid. ascApiKeyId in eas.json
.p8 private key	AuthKey_AB12CD34EF.p8	Download on that same page, once	Signs the JWT. ascApiKeyPath in eas.json

Not on this list: your Apple ID email. That is a login, not a credential you hand to a bot. Prefer an API key over an app-specific password.

Also not on this list: the numeric Apple ID of an app in App Store Connect (App Information → General → Apple ID). That is ascAppId in eas.json — a fifth value, per app, not per team.

Where is the Apple Team ID?

1. Sign in at developer.apple.com/account.
2. Open Membership details. Direct link: developer.apple.com/account#MembershipDetailsCard.
3. Copy Team ID. Ten characters, under the team name.

Apple's own glossary: Team ID is “a unique 10-character string generated by Apple that’s assigned to a membership.” If you cannot see Membership details, you probably have App Store Connect access but not Certificates, Identifiers & Profiles access. Ask the Account Holder.

You will type this into:

• Xcode → Signing & Capabilities
• eas.json → submit.production.ios.appleTeamId
• Some CI templates as APPLE_TEAM_ID

You will not type it into ascApiKeyIssuerId. That field wants the UUID.

Where are App Store Connect API keys, Issuer ID, and Key ID?

All three live on one page:

appstoreconnect.apple.com/access/integrations/api

Nav path if the deep link dumps you elsewhere: App Store Connect → Users and Access → Integrations → App Store Connect API. Stay on Team Keys.

Create a key Expo / an agent can actually use

1. Open that Integrations API page.
2. Copy Issuer ID from the top of the page. One per team. It does not change when you mint a new key.
3. Click Generate API Key (or the +).
4. Name it after the job, not the person: eas-submit-prod, cursor-ios-ship, github-actions-ios.
5. Role: Expo's own walkthrough uses Admin for EAS Submit. Admin can create apps, upload builds, and manage TestFlight. If your org will not grant Admin, App Manager is the next role that can submit; Developer is often not enough. Apple's API key docs list the roles.
6. Generate. Copy Key ID.
7. Download the .p8. Put it somewhere that is not git. The download button disappears after the first click.

If a teammate already generated a key and nobody saved the .p8, you cannot recover it. Revoke, generate, download, update env vars in the same sitting.

Apple also offers Individual Keys on that page. Team Keys are what EAS and CI expect. Don't mix them unless you know you need an individual key.

Wire it into Expo EAS

You do not have to paste Apple's password into a chat window. You also do not have to run eas submit on a Mac.

The interactive path (fine for a human, bad for an agent)

eas credentials --platform ios

Pick the production profile → App Store Connect: Manage your API Key → Set up your project to use an API Key for EAS Submit. Expo stores the key on their side, encrypted. Details in EAS Submit for iOS.

The “here are the files, ship it” path (what AI tools need)

In eas.json:

{
  "submit": {
    "production": {
      "ios": {
        "ascAppId": "1234567890",
        "appleTeamId": "ABCD123456",
        "ascApiKeyPath": "./AuthKey_AB12CD34EF.p8",
        "ascApiKeyIssuerId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
        "ascApiKeyId": "AB12CD34EF"
      }
    }
  }
}

Field names from Expo's eas.json schema:

• ascApiKeyPath — path to the .p8
• ascApiKeyIssuerId — Issuer ID (UUID)
• ascApiKeyId — Key ID
• appleTeamId — Team ID (10 chars)
• ascAppId — the app's numeric Apple ID in App Store Connect (Apps → your app → App Information)

Keep the .p8 out of git (.gitignore it). In CI, put the file contents in a secret and write it to disk before eas submit, or let EAS hold the key after eas credentials.

The token the agent needs for Expo

Apple creds get you onto App Store Connect. They do not log the agent into Expo.

Create an Expo personal access token at expo.dev/settings/access-tokens (account-scoped URL is expo.dev/accounts/<you>/settings/access-tokens). Set:

export EXPO_TOKEN=your-token

Then eas build / eas submit / eas workflow:run can run non-interactively. Treat EXPO_TOKEN like a password. Revoke it on the same page if it leaks.

What to hand an AI coding agent

A complete “you can submit iOS for me” kit is:

1. EXPO_TOKEN — Expo access token
2. APPLE_TEAM_ID — 10-character Team ID
3. ASC_ISSUER_ID — UUID from the API page
4. ASC_KEY_ID — Key ID of the generated key
5. ASC_API_KEY_P8 — full contents of the .p8 (including -----BEGIN PRIVATE KEY-----)
6. ASC_APP_ID — numeric App Store Connect app id, if the app already exists
7. Bundle identifier — com.yourcompany.yourapp in app.json / app.config

Tell the agent those names. If it asks for “your Apple password,” stop and give it the API key instead. App-specific passwords still work via EXPO_APPLE_APP_SPECIFIC_PASSWORD + appleId, but they are the legacy path and they 2FA-prompt you at the worst time.

Do not paste the .p8 into a public gist, a Linear ticket, or a screenshot. A Team key with Admin role can upload binaries and change App Store metadata for every app on the team.

The other Apple pages you will lose the same week

You came for Team ID. You will need these next.

Apps — appstoreconnect.apple.com/apps
Where TestFlight processing happens, where App Review lives, where you grab ascAppId.

Users and Access — appstoreconnect.apple.com/access/users
Invite the person who can actually click Generate API Key. Roles here are not the same as “I can log into developer.apple.com.”

Certificates — developer.apple.com/account/resources/certificates/list
Distribution certs. EAS can create these for you. If a build fails on “no valid certificate,” this is the page, not the API key page.

Identifiers / bundle IDs — developer.apple.com/account/resources/identifiers/list
com.yourcompany.yourapp has to exist before the first store build. Capabilities (Push, Sign in with Apple, Associated Domains) are toggled here.

Provisioning profiles — developer.apple.com/account/resources/profiles/list
EAS manages these if you let it. You only open this page when you didn't.

APNs / Sign in with Apple keys — developer.apple.com/account/resources/authkeys/list
Different keys from the App Store Connect API key. Same “download once” trap. Push and Sign in with Apple live here; submitting the binary does not.

Webhooks — appstoreconnect.apple.com/access/integrations/webhooks
Build processed, review status changed. Useful once you are past “please just upload the IPA.”

Agreements — appstoreconnect.apple.com/agreements
Paid Apps agreement + banking. If submit succeeds and the app is stuck, check this before you rewrite eas.json.

Developer system status — developer.apple.com/system-status
App Store Connect, TestFlight, and the API have their own lights. Consumer Apple status is a different page.

Full jump list: App Store Connect on devlinkspad · Expo on devlinkspad.

Errors that are almost always “you swapped the IDs”

Invalid ASC json key - check your key id, issuer id and api key values
One of Issuer ID, Key ID, or .p8 contents is wrong — or you put Team ID in the Issuer ID field. Open the API page, copy Issuer ID from the top, Key ID from the row, and re-download or re-paste the .p8. The .p8 is PEM; if a tool wants JSON, it wants the three fields together, not a converted certificate.

Can't see Membership details / no Team ID
You are in the wrong Apple ID, or your role cannot see Certificates, Identifiers & Profiles. Account Holder has to grant that on the developer site, not only in App Store Connect.

EAS Submit asks for an Apple ID password in CI
You did not attach an API key. Run eas credentials or set ascApiKeyPath / ascApiKeyIssuerId / ascApiKeyId. Password + app-specific password is the fallback, not the default.

Build signed, submit 403
The API key role is too weak, or the key is Individual and the app belongs to the team. Use a Team key with Admin or App Manager.

First submit of a new bundle ID
Create the app record in App Store Connect first (or let EAS create it while authenticated), then put ascAppId in eas.json so CI can skip the prompt.

Bookmarks rot. The URLs don't have to.

Apple will move “Users and Access” again. The Integrations API URL and the Membership details hash have been the stable ones through the last few redesigns — that's why they're in devlinkspad. Type apple team id or issuer id, hit enter.

If you keep losing dashboard pages, that's literally what this site is for. ⌘K → devlinkspad.com.

---

Related:

• Where is the Vercel tokens page? Env vars & domains too
• Where is the Stripe webhook URL? Live + test + API keys
• App Store Connect deep links → · Expo deep links →

Not affiliated with Apple or Expo. Don't commit the .p8.