STORE_CONNECT_ENCRYPTION_KEY the feature is off, nothing contacts Apple or Google, and asobeast reads public store data only.
What is stored
A Google Play connection stores the same way:
To read reports, asobeast asks Google for a token limited to reading Cloud Storage, and reads only the store performance files in the bucket. To post a review reply, it asks for a separate token for the Google Play Android Developer API and calls only its review reply endpoint.
The sealed value is bound to its workspace and store. A sealed value copied into another workspace’s row cannot be opened there.
The private key is never returned by the API, never written to an export, never sent to OpenAI and never logged. A PEM private key block or a signed token that reaches a log line is replaced with
[redacted] before it is written.
Who can use it
Only the workspace owner connects, verifies, syncs or disconnects, and only through a signed in session. A personal API token, even one with the write scope, is refused, so a leaked agent token cannot replace or remove the key. Members see the connection and the numbers it brings. The key can also write one thing: a public reply to a review of the workspace’s own apps. A reply is posted, updated or withdrawn only when a member or the owner confirms it on the reviews page through a signed in session; a personal API token and the MCP tools cannot post one, and nothing posts on a schedule. asobeast sends the reply text it keeps for that review and nothing else. See Reply to reviews.How to revoke it
Press Disconnect in Integrations, then revoke the key in App Store Connect under Users and Access, Integrations. For Google Play, delete the key of the service account in the Google Cloud console, or remove the account from Users and permissions in Play Console. Disconnecting deletes the sealed key and the report requests and keeps the numbers already stored. A key revoked at the store first is noticed on the next sync: the connection is marked rejected and nothing more is requested with it.How to rotate the encryption key
1
Keep the old key as the previous one
Set
STORE_CONNECT_ENCRYPTION_KEY_PREVIOUS to the current value and STORE_CONNECT_ENCRYPTION_KEY to a new one from openssl rand -base64 32, then restart.2
Let every connection reseal
A stored key sealed with the previous value is opened with it and sealed again with the new one the first time it is used. Press Verify, or wait for the daily sync.
3
Remove the previous key
Unset
STORE_CONNECT_ENCRYPTION_KEY_PREVIOUS and restart.STORE_CONNECT_ENCRYPTION_KEY loses every stored console key. The numbers already stored stay, and every owner connects again. Keep the value with your other secrets and out of the repository.