v0.1.3

What's new

jwt-p8 auth type

Apple's APIs (App Store Connect, APNs, Sign in with Apple) require short-lived ES256 JWTs signed with a .p8 ECDSA private key. The new jwt-p8 auth type handles this automatically — store the key once in your OS keychain, and authbear generates a fresh signed JWT on every request.

Setup:

authbear profile add appstore \
  --base-url https://api.appstoreconnect.apple.com \
  --auth-type jwt-p8 \
  --key-id XXXXXXXXXX \
  --issuer-id xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx

authbear login appstore --key-file ~/Downloads/AuthKey_XXXXXXXXXX.p8 --delete-after-store

authbear call appstore GET /v1/apps

--delete-after-store — new flag on authbear login for jwt-p8 profiles. Deletes the .p8 file from disk after it has been safely stored in the keychain.

authbear token appstore — prints the generated JWT for inspection or use in other tools.

JWTs have a 20-minute lifetime and are regenerated on every invocation. No manual rotation required.

Storage

P8 private keys are stored in the OS keychain under profile:<name>:jwt-p8.

Full changelog

See CHANGELOG.md.