A .p8 file is just a PEM-encoded ECDSA private key. Apple uses this format for two unrelated authentication flows: App Store Connect API keys (used to script account operations), and APNs auth keys (used to send push notifications via token-based auth). Despite the same file extension, they are not interchangeable.
App Store Connect API key
Created in App Store Connect under Users and Access > Integrations > App Store Connect API. The download gives you a .p8 plus an issuer ID and key ID. The same three values together let a client mint short-lived JSON Web Tokens that authenticate to the App Store Connect API.
The file arrives named AuthKey_<KEYID>.p8, where the key ID is the same ten-character string App Store Connect shows in the table. Keep that name: it is the only place the key ID is recorded once you navigate away, and most tooling parses it straight out of the filename.
- Issuer ID
- A UUID shown once at the top of the Integrations page, shared across every key in the team. Not in the file.
- Key ID
- Ten characters, unique per key, shown in the table and embedded in the downloaded filename.
- The .p8 itself
- The PEM-encoded private key. Downloadable exactly once, at creation.
All three are required. A .p8 on its own authenticates nothing, which is why teams that saved only the file end up revoking the key and starting again.
APNs auth key
Created in the Apple Developer portal under Certificates, Identifiers, Profiles > Keys. A single APNs .p8 can sign push tokens for every app in your team, never expires, and replaces the old per-app push certificate workflow.
How it differs from a .p12
- .p12
- Certificate plus matching private key, password-encrypted. Used to sign builds.
- .p8
- Bare private key, no certificate. Used to authenticate API calls (App Store Connect API) or sign short-lived push tokens (APNs).