On release day, the most annoying step is the manual upload: the build machine produces the package, but a human still has to open the upload tool, pick the file, enter credentials, and watch the progress bar—then do it all over again if the network hiccups. Worse, these operations live on individual laptops, so handing off to someone else means walking them through the process again. To wire "upload the IPA" into CI/CD, the first thing to solve is actually authentication—letting a machine in the pipeline submit the build to App Store Connect as you, without scattering your Apple ID password everywhere.
Two types of credentials for CI
Credentials for automation fall into two categories. One is an app-specific password, generated in the Apple account backend in the xxxx-xxxx-xxxx-xxxx format, tied to an Apple ID, and suited to being typed manually into interactive tools. The other is an App Store Connect API key, which yields a .p8 private key plus two identifiers, a Key ID and an Issuer ID; requests are signed with JWT. It doesn't consume password quota, can be revoked independently, and its permissions can be scoped. In CI scenarios the .p8 route is handier: it doesn't trigger two-factor authentication, needs no human at a terminal, and if the key leaks only it is affected—rotating it doesn't disrupt other automation.
