Class

JWTGenerator

Generates ES256-signed JWTs for App Store Connect API authentication.

actor JWTGenerator

Overview

Tokens are cached and reused until near expiry (default: 15 min lifetime). Supports both Team API Keys and Individual API Keys.

Lifetime guidance:

Standard operations: use the default 15-minute lifetime.
Long-lived GET-only tokens (e.g. for read-only CI dashboards): pass lifetime: .months(6) together with a scope array. Apple only allows extended lifetimes for scoped tokens on select read endpoints.

Usage

let generator = JWTGenerator(
    keyID: "2X9R4HXF34",
    issuerID: "57246542-96fe-1a63-e053-0824d011072a",
    privateKey: p8KeyData
)
// Standard short-lived token
let token = try await generator.generateToken()

// Long-lived scoped read token (up to 6 months)
let readToken = try await generator.generateToken(
    scope: ["GET /v1/apps"],
    lifetime: .months(6)
)

Topics

Initializers

init(keyID: String, issuerID: String, privateKeyData: Data)
Creates a JWTGenerator.

Instance Methods

func cachedOrNewToken() async throws -> String
Return the cached token if still valid (with a 60-second buffer), otherwise generate and cache a new one.
func generateToken(scope: [String]?, lifetime: Duration) async throws -> String
Generate a new signed JWT.

Type Properties

static let defaultLifetime: Duration
Token lifetime used when no explicit value is provided.