# App Store Connect

> Ships apps to the App Store through App Store Connect: the asc CLI, fastlane API-key lanes and the App Store Connect API keys and JWTs, builds, version and build numbers, signing and uploads, TestFlight, review submissions, release options and phased release, product page metadata, screenshots, previews and creative assets, in-app events, in-app purchases, subscriptions and pricing with the US and EU external purchase rules, privacy manifests, privacy labels, ATT, account deletion and Sign in with Apple, the App Review Guidelines, preflight scans for rejection patterns, and analytics reports and crash triage. Use when uploading or signing an iOS build, distributing through TestFlight, submitting for review or releasing, editing App Store metadata or screenshots, setting up in-app purchases or subscriptions, preparing privacy answers, checking an app against the App Review Guidelines, or fixing a rejection.

- Skill: `quegenx/app-store-connect` (Agent Skill, multi-file: 14 files)
- Install (CLI): `npx get-skill add quegenx/app-store-connect`
- Raw SKILL.md: https://api.skillmd.com/api/skills/quegenx/app-store-connect/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Data & Analytics
- Author: Quegenx (https://skillmd.com/u/quegenx)
- Updated: 2026-11-12
- Page: https://skillmd.com/skills/quegenx/app-store-connect

---


# App Store Connect

App Store Connect is where an Apple-platform app gets its record, builds, testers, product page, products and review submissions. Three things decide most outcomes: whether the build meets Apple's current upload minimums and carries a valid privacy manifest (App Store Connect rejects it at upload otherwise), whether App Review can reach every feature and purchase with the demo account and notes you gave it, and whether the metadata, purchases and privacy answers match what the app really does. Apple's own documentation and the App Review Guidelines (current text dated October 16, 2026) are the authority here. The `asc` CLI (rorkai) and the preflight rules and `greenlight` scanner (truongduy2611, RevylAI) are third-party: their facts are tagged in each file, and where they differ from Apple, Apple wins. Flutter projects produce the Xcode project these steps archive: [flutter SKILL.md](https://github.com/Quegenx/agent-skills/blob/main/skills/mobile/flutter/SKILL.md). Android: [google-play SKILL.md](https://github.com/Quegenx/agent-skills/blob/main/skills/mobile/google-play/SKILL.md). Keywords and listing optimization: [aso SKILL.md](https://github.com/Quegenx/agent-skills/blob/main/skills/marketing/aso/SKILL.md).

Apply only the routes and checks for the selected job. Read a linked skill's named file from its installed folder when available, or from the linked source. Report an unavailable required reference instead of inventing it. [skill-authoring, DISTRIBUTION.md#composing-skills]

| The job | Read |
|---|---|
| The `asc` CLI: discovering commands, flags, output and pagination, App Store Connect API keys and JWTs, `asc` auth and web sessions, resolving IDs, creating the app record, availability bootstrap, workflows, Apple Ads through `asc` | [CLI.md](CLI.md) |
| Minimum Xcode and SDK, version and build numbers, archive and export, uploading and size limits, bundle IDs and capabilities, certificates and profiles, signing sync | [BUILD-AND-SIGNING.md](BUILD-AND-SIGNING.md) |
| TestFlight groups and limits, new versions, submitting for review, the `asc` release lanes, multi-item submissions, submission health and repairs, release options, phased release | [TESTFLIGHT-AND-RELEASE.md](TESTFLIGHT-AND-RELEASE.md) |
| Reviewer access notes and the six-section template, rejection diagnosis, Resolution Center replies, appeals and expedited review | [REVIEW-OPERATIONS.md](REVIEW-OPERATIONS.md) |
| Fastlane API-key lanes for Flutter IPA artifacts, metadata and version preparation, review submission and release | [FASTLANE.md](FASTLANE.md) |
| Ad hoc (release-testing) distribution to registered devices with `asc distribute`: the private spec, plan and hash-confirmed apply, resume and verify, the lower-level IPA publish | [AD-HOC-DISTRIBUTION.md](AD-HOC-DISTRIBUTION.md) |
| Product page field limits, review rules for metadata, `asc metadata` sync, localization, What's New and promotional text, screenshots, previews, creative assets and the Asset Library, custom product pages | [METADATA-AND-SCREENSHOTS.md](METADATA-AND-SCREENSHOTS.md) |
| In-app event limits, event types, media, creating, localizing and submitting events | [IN-APP-EVENTS.md](IN-APP-EVENTS.md) |
| Purchase rules, product types and subscription groups, US and EU external purchase links, creating products and prices, purchasing-power pricing, price increases and subscriber consent, the Small Business rate, localizing product names, syncing to RevenueCat, TestFlight purchases | [PRICING-AND-SUBSCRIPTIONS.md](PRICING-AND-SUBSCRIPTIONS.md) |
| Privacy manifests, required reason APIs, privacy policy and App Privacy labels, App Tracking Transparency, third-party AI consent, account deletion, Sign in with Apple; review notes route to store operations | [PRIVACY-AND-COMPLIANCE.md](PRIVACY-AND-COMPLIANCE.md) |
| The App Review Guidelines section by section, recent changes, Apple's before-you-submit checklist, after you submit, where preflight summaries differ from Apple | [REVIEW-GUIDELINES.md](REVIEW-GUIDELINES.md) |
| Scanning for rejection patterns before submitting: `greenlight`, the rule-file workflow with `asc`, metadata, subscription, design, entitlement and privacy rules, checks by app type | [PREFLIGHT.md](PREFLIGHT.md) |
| Downloading and verifying Analytics reports, TestFlight crashes and feedback, performance diagnostics | [ANALYTICS-AND-CRASHES.md](ANALYTICS-AND-CRASHES.md) |

## The rules

1. **Build to Apple's current upload minimums,** and check `https://developer.apple.com/news/upcoming-requirements/` before each release: Xcode 26 with a 26 SDK since April 28, 2026, a deployment target of iOS 13 or later since September 9, 2026, and Xcode 27 with the 27 SDKs and a target of iOS 15 or later from April 2027. Increment the build string before every upload.
2. **Ship a valid privacy manifest.** Every required reason API your code uses is declared in `PrivacyInfo.xcprivacy` (for Flutter, `ios/Runner/PrivacyInfo.xcprivacy`), each listed third-party SDK carries its own valid, signed manifest, and every tracking domain is listed when `NSPrivacyTracking` is true.
3. **Unlock anything digital with in-app purchase (3.1.1).** Auto-renewable subscriptions last at least seven days, give ongoing value and say what the user gets before asking (3.1.2). Outside the United States storefront, no button, link or call to action points to another purchase method unless the app holds a regional entitlement (3.1.1(a)).
4. **Give App Review full access (2.1).** Submit a final, on-device-tested build with the backend live, a demo account that must not expire (or an approved demo mode), every configured in-app purchase reachable, and review notes that describe new and non-obvious features specifically, not generically (2.3.1(a)).
5. **Keep metadata accurate and inside its limits (2.3).** Name and subtitle at most 30 characters, apply the qualified price/off-type rule and approved interactive-functionality exception rather than a blanket ban ([metadata policy](REVIEW-GUIDELINES.md#23-accurate-metadata), 2.3.7, 2.3.10), screenshots that show the app in use (2.3.3), and previews made only of screen captures of the app (2.3.4).
6. **Make the app's privacy match its answers.** Link the privacy policy in App Store Connect and inside the app (5.1.1(i)); offer account deletion in the app when it supports account creation (5.1.1(v)); disclose and get explicit permission before sharing personal data with third parties, including third-party AI (5.1.2(i)); ask through ATT before tracking; and pair a third-party or social login for the primary account with an equivalent private login option (4.8).
7. **Release forward only.** "It's not possible to revert to a previous version on the App Store": ship a fix as a new version, and use phased release for updates when you want automatic updates throttled over 7 days.
8. **Never commit or ship an App Store Connect API key,** and with `asc` (third-party) resolve IDs with `--paginate`, run the dry run, then `--confirm`, and read the state back rather than trusting a receipt.

## Prove it

Apply build, metadata, privacy and review checks to the selected job. `asc` validation applies when using that CLI; `greenlight` preflight applies when using that scanner. For the fastlane lane, use [FASTLANE.md](FASTLANE.md) and its checks. A metadata-only task does not require a new archive or release. [rorkai, asc; truongduy2611; RevylAI; FASTLANE.md]

The archive's Xcode, SDK and deployment target meet the current minimums row; App Store Connect sends no invalid-manifest email after upload; the strict `asc validate` for the version reports no blocking issues and the build shows `VALID`; a reviewer with only the demo account and notes reaches every feature and in-app purchase; `greenlight preflight .` reports GREENLIT; no `.p8` key is in the repository, client code or logs; and every file's own Prove it checks pass for the parts you touched.