App Store Connect API Automation

This catalog's default way to drive App Store Connect from scripts and CI: an Apple-native toolchain — a ~30-line Swift/CryptoKit script mints the JWT, plain curl calls the REST API. No fastlane/spaceship, no Ruby gems, no Homebrew, consistent with the catalog's mise + no-third-party baselines.

When to invoke

• Writing release tooling: distribute a build to TestFlight groups, set what's-new, create the next App Store version, submit for review
• Pulling sales or App Store analytics reports on a schedule
• Debugging ASC API auth failures (401 NOT_AUTHORIZED) or rate limiting (429)
• Asked "should I use fastlane for this?"

Scope

Owns: token minting, curl conventions, and the endpoint cookbook below. Does NOT own:

• Building / uploading the binary — builds arrive in ASC via Xcode Cloud (→ xcode-cloud-single-track-ci), a local xcodebuild -exportArchive / xcrun altool run (→ local-archive-export-upload), Xcode Organizer, Transporter, or the ASC API's Build Uploads resources (POST /v1/buildUploads + buildUploadFiles reserve / commit — not part of this cookbook). This skill picks up after the build exists in ASC.
• .p8 key storage & leak prevention → build-time-secret-injection (Layer 2 secrets/.env) + apple-public-repo-security (rotate-first SOP).
• What metadata will pass review → app-store-review-rejections; this skill is how to submit, not what.