Lines 2-42typescript
2import { z } from "zod";
3//#region src/client/auth.d.ts
5 debug?(...args: unknown[]): void;
6 warn?(...args: unknown[]): void;
7 error?(...args: unknown[]): void;
10 * A pluggable source of bearer tokens. The REST client calls `getToken()` on
11 * every request and `invalidate()` on a 401 to force the next call to remint.
14 getToken(): Promise<string>;
17type JwtCredentials = {
18 /** The Key ID (`kid`) of the App Store Connect API key (10 chars). */
20 /** The Issuer ID — a UUID from Users and Access → Integrations → Keys. */
22 /** The `.p8` private key, PEM-encoded (`-----BEGIN PRIVATE KEY-----`). */
CriticalCritical Secret
Package contains a critical-looking secret pattern.
dist/index.d.tsView on unpkg · L22 25 * Team-scoped keys (created under a specific role) reject a token that has no
26 * `scope`; individual keys reject one that has it. Leave undefined for the
27 * common case and only set it if you hit a 401 with `NOT_AUTHORIZED`.
28 * Each entry is `"METHOD /v1/path"`, e.g. `"GET /v1/apps"`.
30 scope?: string[] | undefined;
33 * Mint a signed App Store Connect JWT. The API requires ES256 with the raw
34 * `r || s` signature form (JOSE / IEEE P1363) — Node's default ECDSA output is
35 * ASN.1/DER, which Apple rejects with `401 NOT_AUTHORIZED`, hence `dsaEncoding`.
37declare const signJwt: (creds: JwtCredentials, nowSeconds: number, ttlSeconds: number) => string;
38type TokenProviderOptions = {
39 credentials: JwtCredentials;
42 * Token lifetime in seconds. Apple caps this at 20 minutes (1200s); default to