Generate and sign an ES256 JWT for App Store Connect API authentication (team key vs individual key) and use it as a Bearer token

Documented steps

1. Obtain an API key in App Store Connect. TEAM key: an Admin goes to Users and Access > Integrations > App Store Connect API > Team Keys > Generate API Key, names it and assigns a role. INDIVIDUAL key: the user goes to their own profile > Individual API Key > Generate API Key.
2. Download the private key (.p8) immediately — App Store Connect offers the download exactly once and Apple keeps no copy. Store it in a secret manager, never in a repo or client-side code.
3. Record the Key ID (kid) shown next to the key, e.g. 2X9R4HXF34.
4. For a TEAM key only, also copy the Issuer ID shown near the top of Users and Access > Integrations, e.g. 57246542-96fe-1a63-e053-0824d011072a. Individual keys do not use an issuer ID.
5. Build the JWT header: {"alg":"ES256","kid":"<key id>","typ":"JWT"}. ES256 is mandatory; any other alg is rejected.
6. Build the TEAM key payload: {"iss":"<issuer id>","iat":<unix seconds now>,"exp":<iat+lifetime>,"aud":"appstoreconnect-v1"}. Do NOT include sub.
7. Build the INDIVIDUAL key payload instead: {"sub":"user","iat":<unix seconds now>,"exp":<iat+lifetime>,"aud":"appstoreconnect-v1"}. Individual keys use sub:"user" and omit iss.
8. Set exp so that (exp - iat) is at most 20 minutes. Apple suggests ~2 minutes for one-off calls and up to 20 minutes for long-running processes.
9. Optionally add a scope claim, an array of strings such as ["GET /v1/apps?filter[platform]=IOS"], to restrict what the token may do. App Store Connect ignores limit, cursor and sort when matching a request against scope.
10. Only if you need a long-lived token: exp may be up to 6 months out, but ONLY when the payload defines a scope containing GET requests exclusively AND every referenced resource is on Apple's long-lived allowlist: Build Actions, Build Runs, Git References, Issues, macOS Versions, Products, Providers, Power and Performance Metrics and Logs, Pull Requests, Repositories, Test Results, Workflows, Xcode Versions.
11. Sign header+payload with the .p8 key using ES256 (ECDSA P-256 + SHA-256) via a JWT library to produce the compact JWS string.
12. Send it as a bearer token: curl -v -H 'Authorization: Bearer <signed token>' "https://api.appstoreconnect.apple.com/v1/apps"
13. Reuse the same signed token across requests until it expires rather than minting one per call.
14. To rotate or retire a key: Users and Access > Keys (Team or Individual) > Edit next to Active keys > select > Revoke Key > confirm. Revocation is permanent and irreversible; the revoked key stays listed under Revoked for 30 days.
15. Official docs: https://developer.apple.com/documentation/appstoreconnectapi/generating-tokens-for-api-requests | https://developer.apple.com/documentation/appstoreconnectapi/creating-api-keys-for-app-store-connect-api | https://developer.apple.com/documentation/appstoreconnectapi/revoking-api-keys