# Installing Clout App via App Store Connect API (https://clout.wtf/guide/asc-api-guide/) > **Note:** **Before you start.** Prepare the iPhone first — Developer Mode on, StandBy off, Appearance set to Light, Auto-Lock set to Never. Full one-time checklist: [Prepare your devices →](https://clout.wtf/guide/device-setup/) Use this path when the legacy Apple ID install fails with `Authentication Error. Xcode 7.3 or later is required (resultCode 3019)` — or simply because you'd rather not store an Apple ID password in the app. The flow takes about two minutes end to end. ## Is this safe? Yes — this is the official, Apple-supported way to authenticate with the developer account. The App Store Connect API uses short-lived **JWT tokens** signed locally with your `.p8` private key. The key never leaves your machine, no Apple ID password is stored, and Apple's standard 2FA on the account is left untouched. Clout Uploader operates strictly inside the **development sandbox** of your team: * Only **Development (test) certificates and provisioning profiles** are created — the same kind Xcode would generate when you run a project on a connected iPhone. * Production / App Store / Distribution certificates and profiles are **not touched**. Apps you ship to the App Store, TestFlight builds, and any in-house Distribution profiles are completely independent of this flow. * Permissions on the API key are limited to what's needed for installing on registered devices. Revoking the key in App Store Connect immediately cuts off access. In short: this only affects test installs on the iPhones you've registered for development — your live apps and store listings keep running exactly as they were. *** ## What you'll need * An Apple Developer account with role **App Manager** or higher — Developer role is blocked from creating signing profiles. * A **Team Key** (not Individual Key) generated in App Store Connect. * The downloaded **.p8** private key file — Apple lets you download it exactly once. ## 1. Generate a Team Key in App Store Connect About two minutes. 1. Open [appstoreconnect.apple.com/access/integrations/api](https://appstoreconnect.apple.com/access/integrations/api) 2. Switch to the **Team Keys** tab — **not** Individual Keys. 3. Click **Generate API Key**. Pick role = **App Manager** or higher. Developer won't work — Apple blocks that role from creating signing profiles. 4. Apple shows the **Issuer ID** and **Key ID**, and lets you download the **.p8** file. Save it now — you only get one shot. > **Note:** **Must-haves:** Team Key (Individual keys can't create signing profiles), App Manager role or higher, and the `.p8` saved on first download. ## 2. Enter the key in Clout Uploader 1. Open the **Devices** page. 2. Expand the **App Store Connect API** section. 3. Fill in **Key ID**, **Issuer ID**, and drop the **.p8** file into the upload area. 4. Click **Test connection & save**. The **Team ID** is auto-detected from your account. If your team is brand new with no registered identifiers yet, the wizard will ask for the Team ID manually — it's the 10-character string in the top-right corner at [developer.apple.com/account](https://developer.apple.com/account). ## 3. Sign and install Once the key is saved, the **Install** and **Reinstall** buttons activate per device. Signing now goes over JWT through the App Store Connect API — the legacy Apple ID auth path is bypassed entirely. Existing certificates, profiles, and registered UDIDs from the legacy path keep working — Apple uses a single registry behind both paths, so nothing has to be re-registered. ## Troubleshooting | Message | What to do | | -------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | "This key is Individual" | Key was created on the Individual Keys tab. Recreate it as a **Team Key**. | | "Regenerate as App Manager →" | Role on the key is too low. Reissue the key with role = **App Manager** or higher. | | "Open Apple Developer Portal →" (cert quota 2/2) | Team has hit the certificate quota. Open the developer portal, find your own orphan certificate (CREATED BY = your name), revoke it, and retry. Don't touch other team members' certificates. | | "Waiting for the first device's certificate to register with Apple…" | Expected on fleets of 5+ devices during the first parallel install — devices 2..N wait for the first device to finish registering. No action needed. | ## "Install configured correctly" checklist * [ ] Key generated on the **Team Keys** tab in App Store Connect * [ ] Role on the key is **App Manager** or higher * [ ] `.p8` file saved at first download (it can't be re-downloaded later) * [ ] Key ID, Issuer ID, and `.p8` all entered in the App Store Connect API section on the Devices page * [ ] **Test connection & save** succeeded — Team ID was auto-detected (or entered manually for brand-new teams) ## Related guides * [Folder structure](https://clout.wtf/guide/folder-structure-guide/) — how to lay out media for Upload, Warm-up, and Seeding modes once your devices are set up. * [Upload mode](https://clout.wtf/guide/upload-guide/) — the main publishing flow once the app is installed.