StoreSteerv1.2
Launch Web App
Back to Overview

API Key Setup & Integration Guide

Connect App Store Connect and Google Play via invite (simpler) or by uploading your own API credentials.

1. Apple App Store Connect

Two paths: invite StoreSteer Apple ID, or upload your own API key (.p8)

Option A — Invite StoreSteer

  1. In Settings, add an iOS account and choose Invite StoreSteer.
  2. Copy the Apple ID email shown, then in App Store Connect → Users and Access invite that email with Admin or Finance.
  3. Enter your Vendor Number and save. Status stays Invite pending until StoreSteer accepts the email and attaches a .p8.
  4. The invited Apple ID receives a real email and must accept it (unlike Google service accounts).

Option B — Your own API key (.p8)

  1. Log in to App Store Connect → Users and Access > Keys.
  2. Generate an API Key named StoreSteer Metric Fetcher with Finance or Admin.
  3. Copy Issuer ID and Key ID, download the .p8 (once only), and locate your Vendor Number under Reports → Sales and Trends.
  4. In StoreSteer Settings choose My API key and paste Issuer, Key ID, Vendor Number, and .p8.
Sample App Store Connect Key Configuration (Option B):
Issuer ID:     a1b2c3d4-e5f6-7890-abcd-ef1234567890
Key ID:        YD3ZXUCHQA
Vendor Number: 89123456
Private Key:   -----BEGIN PRIVATE KEY----- ... -----END PRIVATE KEY-----

2. Google Play

Two setup paths: invite StoreSteer (no JSON) or use your own service account JSON

Option A — Invite StoreSteer

  1. In Settings, add an Android account and choose Invite StoreSteer.
  2. Copy the service-account email shown, then open Google Play Console > Users and permissions and invite that email at account level. There is no email to accept — service accounts have no inbox.
  3. Grant at least View app information and download bulk reports and View financial data under Account permissions (Global) — not only per-app permissions.
  4. Paste your Cloud Storage bucket id from Download reports (pubsite_prod_rev_… or sometimes pubsite_prod_…) and test.

Option B — Your own Service Account JSON (recommended if invite stays 403)

  1. In Play Console go to Setup → API access and confirm the linked Cloud project.
  2. Enable Google Play Android Developer API on that project (Library).
  3. Click Create service account, follow the Cloud Console link, create the SA (e.g. mrrhub-play-sync), then Keys → Add Key → JSON.
  4. Back in Play API access, click Done, then Grant access at account level with bulk reports + financial data. Creating the SA from this Play flow avoids “phantom” SAs that never get GCS ACL.
  5. Verify with gcloud storage ls gs://pubsite_prod_rev_…/ using that JSON. When it lists folders, paste the JSON + bucket id in StoreSteer Settings → My service account (pubsite_prod_rev_… or pubsite_prod_…).

GCS ACL can take minutes to 24h after an account-level invite. A 403 on storage.objects.list with a valid token usually means Play has not granted the SA bucket ACL yet (same error with gcloud / curl). First: enable Google Play Android Developer API. If 403 persists, recreate the SA from Play → API access (not a standalone Cloud IAM SA). Also use the bucket from Download reports for your apps (often pubsite_prod_rev_…) — a 403 on a different pubsite_prod_… id does not prove the rev bucket failed.

3. Google OAuth (production)

Leave Testing mode — External consent screen + redirect URIs

Privacy policy URL for the OAuth consent screen: /privacy → production https://mrrhub.kerweb.app/privacy

Authorized redirect URIs on the Web OAuth client:

  • http://localhost:3000/api/stores/google-oauth/callback
  • https://mrrhub.kerweb.app/api/stores/google-oauth/callback

Set NEXT_PUBLIC_SITE_URL=https://mrrhub.kerweb.app in production so redirects match. Full checklist: web/keys/GOOGLE_OAUTH_PUBLISH.md

Configure Store Keys Now