v0.1.3

What's new

jwt-p8 auth type

Apple's APIs (App Store Connect, APNs, Sign in with Apple) require short-lived ES256 JWTs signed with a .p8 ECDSA private key. The new jwt-p8 auth type handles this automatically — store the key once in your OS keychain, and authbear generates a fresh signed JWT on every request.

Setup:

authbear profile add appstore \
  --base-url https://api.appstoreconnect.apple.com \
  --auth-type jwt-p8 \
  --key-id XXXXXXXXXX \
  --issuer-id xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx

authbear login appstore --key-file ~/Downloads/AuthKey_XXXXXXXXXX.p8 --delete-after-store

authbear call appstore GET /v1/apps

--delete-after-store — new flag on authbear login for jwt-p8 profiles. Deletes the .p8 file from disk after it has been safely stored in the keychain.

authbear token appstore — prints the generated JWT for inspection or use in other tools.

JWTs have a 20-minute lifetime and are regenerated on every invocation. No manual rotation required.

Storage

P8 private keys are stored in the OS keychain under profile:<name>:jwt-p8.

Full changelog

See CHANGELOG.md.

v0.1.2

What's new

Environment variable support for profiles

• authbear profile add --env KEY=VALUE — store plain (non-sensitive) env vars in a profile
• authbear env set <profile> <KEY> — store a secret env var in the keychain (prompts for value)
• authbear env unset <profile> <KEY> — remove a secret env var from keychain
• authbear env <profile> — print export KEY=VALUE lines for all env vars (plain + secret)

Usage example:

authbear env set myprofile REVENUECAT_API_KEY
eval $(authbear env myprofile)

v0.1.1

Enhancements to endpoint validation and automation workflows.\n\nHighlights:\n- Added authbear health with expected-status checks and latency output\n- Added --json output for machine-readable health results\n- Added --response-json output envelope for authbear call\n- Added profile-level --health-path support and updated docs

v0.1.0

Initial public release of authbear.\n\nHighlights:\n- Profile-based auth management for bearer, api-key, and oauth-device flows\n- Keychain-backed credential storage\n- Built-in endpoint calling with auth injection\n- OAuth device token refresh support\n- Homebrew tap formula included