Is my API key safe?

Your App Store Connect API key (.p8 file) is sensitive — it grants access to your App Store Connect account. Yeethook takes several measures to keep it safe.

Encryption at rest

Your .p8 key is encrypted with AES-256-GCM before it is written to the database. The encryption key is stored separately from the database and is never committed to source control. Even if the database were compromised, the raw key material would be unreadable without the encryption key.

Never exposed in the UI

Once uploaded, your API key content is never sent back to the browser. The UI only displays metadata like the Key ID and a label you choose — never the key itself.

Server-side only

Your key is only decrypted server-side, in memory, for the brief moment it is needed to authenticate with Apple's App Store Connect API. It is used for three purposes:

• Registering App Store Server Notification URLs for your apps
• Configuring App Store Connect Webhooks on your behalf
• Fetching additional context (build metadata, tester details, transaction history) to enrich Slack notifications

After each API call, the decrypted key is discarded from memory.

Key management

You can replace or delete your API key at any time from the Setup page. Deleting the key removes all stored key material from the database. Webhooks that were already configured in App Store Connect will continue to deliver events, but enrichment will stop until a new key is uploaded.

You stay in control

Your API key belongs to you. If you ever want to cut off Yeethook's access, simply revoke the key in App Store Connect — Yeethook will immediately lose the ability to call Apple's APIs on your behalf. No need to contact us or wait for anything.

Recommendations

• Use a dedicated API key for Yeethook rather than sharing one across services.
• Choose the Admin role — this is required for webhook management and API access.
• Keep a backup of your .p8 file in a secure location. Apple only allows you to download it once.