API key roles
What each App Store Connect API key role unlocks in RevenueHog, how the capability sweep detects it, and how to read the KEY CAPABILITIES matrix in Settings.
Every RevenueHog feature reads from Apple except two writes: setting server-notification URLs and creating App Store Connect webhooks. The role you give the key is a choice about how much it can see and do. Each rung includes the ones below it.
Role ladder
| Key role | What it unlocks |
|---|---|
| Sales or Finance | Daily sales and subscription reports: revenue, subscribers, trials, the funnel and metrics. Analytics report reads work at this level too. |
| Finance | Payout reports: what Apple actually pays you, per fiscal period. Sales access is included. |
| App Manager | Setting server-notification URLs for you (auto-wiring). Also reads TestFlight builds, testers and beta feedback. The Developer role reads TestFlight too but cannot write URLs. |
| Admin | Everything above, plus creating App Store Connect webhooks and analytics report requests. RevenueHog recognizes an Admin key by its ability to list your team's users, which only Admin can do. |
The KEY CAPABILITIES matrix
Under Settings → Connections → APP STORE CONNECT, the matrix shows each feature with a state: AVAILABLE, MISSING or UNKNOWN.
| Row | When available | When missing |
|---|---|---|
| Revenue reports | Daily sales, subscriptions and events | Needs sales and reports access plus a vendor number |
| Payout reports | What Apple actually pays, per fiscal period | Needs the Finance or Admin role |
| Analytics | Usage, installs, attribution and crashes | Needs report access; creating report requests needs Admin |
| TestFlight | Builds, testers and beta feedback | Needs the App Manager, Developer, or Admin role |
| Webhooks | Real-time version and TestFlight events | Needs the Admin role |
| Auto-wiring | Sets S2S notification URLs for you | Needs the App Manager or Admin role |
| Webhook wiring | Creates ASC webhook subscriptions for you | Needs the Admin role; manual setup instructions are shown instead |
Press Re-check (shows "Checking…") to run the sweep again, for example after changing the key's role. The matrix shows when it was last checked.
How detection works
Saving credentials runs a sweep of six read-only GET requests against Apple, one after another:
| Capability | Probe |
|---|---|
| Revenue reports | A daily sales summary from 3 days ago |
| Payout reports | The all-region financial report for a recently closed fiscal period |
| Analytics | An app's analytics report requests |
| Admin | The team's users list |
| TestFlight | An app's builds |
| Webhooks | An app's webhooks |
Results map like this:
- 200: available.
- 403: missing. The key is valid but its role lacks access.
- 404 on a report: available. Nothing was posted for that period, but access was accepted ("No report was posted for the probe period, but access was accepted.").
- Anything else, a network failure, or a probe that cannot run: unknown, with a note.
- 401 on any probe: the key itself is bad. The sweep stops and clears the matrix.
Notes you may see on an unknown row:
| Note | Meaning |
|---|---|
| Add a vendor number to check report access. | Report probes need a vendor number. |
| No imported app to probe against yet. Re-check after your first sync. | App-scoped probes need an imported app. |
| Probe request failed. | Network trouble; try Re-check. |
| Resolved on the first auto-wire attempt. | Auto-wiring has no safe probe; see below. |
| Resolved on the first webhook wiring attempt. | Same for webhook wiring. |
| Implied by the Admin role. | An Admin key can do both writes. |
Why the writes are not probed
Probing a write would change your App Store Connect settings. So Auto-wiring and Webhook wiring stay unknown ("Detected on first use") until the first real attempt resolves them, or become available immediately when the key is proven Admin.
Related
Last updated on
Connect App Store Connect
Create an App Store Connect API key, add it to RevenueHog, run the first sync, wire Apple server notifications and verify it, with every field and error.
Server notifications
Route App Store Server Notifications V2 through RevenueHog with the per-app ingest URL, the S2S audit, one-step auto-wiring, test sends and history import.