Before you start. Prepare the iPhone first — Developer Mode on, StandBy off, Appearance set to Light, Auto-Lock set to Never. Full one-time checklist: Prepare your devices →
Use this path when the legacy Apple ID install fails with Authentication Error. Xcode 7.3 or later is required (resultCode 3019) — or simply because you'd rather not store an Apple ID password in the app. The flow takes about two minutes end to end.
Is this safe?
Yes — this is the official, Apple-supported way to authenticate with the developer account. The App Store Connect API uses short-lived JWT tokens signed locally with your .p8 private key. The key never leaves your machine, no Apple ID password is stored, and Apple's standard 2FA on the account is left untouched.
Clout Uploader operates strictly inside the development sandbox of your team:
- Only Development (test) certificates and provisioning profiles are created — the same kind Xcode would generate when you run a project on a connected iPhone.
- Production / App Store / Distribution certificates and profiles are not touched. Apps you ship to the App Store, TestFlight builds, and any in-house Distribution profiles are completely independent of this flow.
- Permissions on the API key are limited to what's needed for installing on registered devices. Revoking the key in App Store Connect immediately cuts off access.
In short: this only affects test installs on the iPhones you've registered for development — your live apps and store listings keep running exactly as they were.
What you'll need
- An Apple Developer account with role App Manager or higher — Developer role is blocked from creating signing profiles.
- A Team Key (not Individual Key) generated in App Store Connect.
- The downloaded .p8 private key file — Apple lets you download it exactly once.
1. Generate a Team Key in App Store Connect
About two minutes.
- Open appstoreconnect.apple.com/access/integrations/api
- Switch to the Team Keys tab — not Individual Keys.
- Click Generate API Key. Pick role = App Manager or higher. Developer won't work — Apple blocks that role from creating signing profiles.
- Apple shows the Issuer ID and Key ID, and lets you download the .p8 file. Save it now — you only get one shot.
Must-haves: Team Key (Individual keys can't create signing profiles), App Manager role or higher, and the
.p8saved on first download.
2. Enter the key in Clout Uploader
- Open the Devices page.
- Expand the App Store Connect API section.
- Fill in Key ID, Issuer ID, and drop the .p8 file into the upload area.
- Click Test connection & save.
The Team ID is auto-detected from your account. If your team is brand new with no registered identifiers yet, the wizard will ask for the Team ID manually — it's the 10-character string in the top-right corner at developer.apple.com/account.
3. Sign and install
Once the key is saved, the Install and Reinstall buttons activate per device. Signing now goes over JWT through the App Store Connect API — the legacy Apple ID auth path is bypassed entirely.
Existing certificates, profiles, and registered UDIDs from the legacy path keep working — Apple uses a single registry behind both paths, so nothing has to be re-registered.
Troubleshooting
| Message | What to do |
|---|---|
| "This key is Individual" | Key was created on the Individual Keys tab. Recreate it as a Team Key. |
| "Regenerate as App Manager →" | Role on the key is too low. Reissue the key with role = App Manager or higher. |
| "Open Apple Developer Portal →" (cert quota 2/2) | Team has hit the certificate quota. Open the developer portal, find your own orphan certificate (CREATED BY = your name), revoke it, and retry. Don't touch other team members' certificates. |
| "Waiting for the first device's certificate to register with Apple…" | Expected on fleets of 5+ devices during the first parallel install — devices 2..N wait for the first device to finish registering. No action needed. |
"Install configured correctly" checklist
- Key generated on the Team Keys tab in App Store Connect
- Role on the key is App Manager or higher
.p8file saved at first download (it can't be re-downloaded later)- Key ID, Issuer ID, and
.p8all entered in the App Store Connect API section on the Devices page - Test connection & save succeeded — Team ID was auto-detected (or entered manually for brand-new teams)
Related guides
- Folder structure — how to lay out media for Upload, Warm-up, and Seeding modes once your devices are set up.
- Upload mode — the main publishing flow once the app is installed.