Authentication

How an AI agent connects to App Listing Agent, and how App Store Connect and Google Play credentials are added.

MCP is the supported programmatic interface

App Listing Agent does not offer a public REST API, CLI or SDK. Agents and scripts use the MCP server at https://applistingagent.com/api/mcp. The routes under /api serve the web dashboard and are not a documented, stable contract.

Connecting an agent

There are three ways to authorize an agent:

OAuth — clients that support remote-MCP OAuth open a browser sign-in. You choose one app workspace and the authority the agent gets.
One-time pairing — during onboarding, choose Connect my agent. App Listing Agent shows a single-use code that expires after 15 minutes and a setup prompt to paste into your agent. The agent exchanges the code for a scoped key.
Scoped API key — create a key yourself and add it to your MCP client configuration.

Step-by-step instructions are in Connect an AI agent.

API keys

API keys are available on the Pro, Studio and Enterprise plans. In an organization, only admins and owners can create them.

Creating a key

Open Settings in the dashboard and find Agent & API Keys.
Give the key a name and choose its permissions.
Optionally set an expiry of 1 to 365 days.
Copy the key when it is shown. It starts with asc_live_ and is not shown again.

You can revoke a key from the same screen at any time.

Permissions

A key only lists and runs the MCP tools its permissions allow. The tool reference shows the permission each tool needs.

Permission	Allows
`read`	Read project data, metadata, screenshots and legal documents
`write`	Change project data and local drafts
`translate`	Use AI translation
`screenshots`	Create and change screenshots, graphics and icons
`publish`	Request store uploads and public legal-page changes (each still needs your approval)
`all`	Every tool available to your account

Using a key

Send the key as a bearer token in your MCP client configuration:

Remote MCP configurationjson

{
  "mcpServers": {
    "applistingagent": {
      "url": "https://applistingagent.com/api/mcp",
      "headers": {
        "Authorization": "Bearer <ASC_API_KEY>"
      }
    }
  }
}

Keep your key secret

Store the key in your client's secret store or an environment variable. Never commit it to a repository or paste it into a chat.

Store credentials

Reading from and uploading to the stores needs App Store Connect and/or Google Play credentials. Add them in the browser: Settings → Store Credentials, or the secure link an agent gets from get_store_connection_link. They are never entered in chat.

App Store Connect

You need an App Store Connect API key:

Issuer ID — shown in Users and Access → Integrations → App Store Connect API
Key ID — the identifier of your API key
Private key — the contents of the downloaded .p8 file

Creating an App Store Connect API key

In App Store Connect, open Users and Access → Integrations → App Store Connect API and create a team key with the Admin or App Manager role.

Google Play Console

You need a Google Cloud service account with Play Console access:

Enable the Google Play Android Developer API in Google Cloud Console
Create a service account (no Google Cloud roles needed)
Open the account → Keys → Add key → Create new key → JSON, and download it
In Google Play Console → Users and permissions, invite the service account email with Admin access

Activation delay

New service account credentials can take up to 36 hours to start working with the Google Play Developer API.

How credentials are stored

Store credentials are encrypted with AES-256-GCM before they are saved, using a data key that is itself encrypted with Google Cloud KMS. They are never stored in plain text and are not returned to agents.