> ## Documentation Index
> Fetch the complete documentation index at: https://docs.asobeast.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Store console credentials

> What asobeast stores when an owner connects an App Store Connect key or a Google Play service account, how the key is sealed at rest, who can use it and how to revoke it or rotate the encryption key.

Connecting a store console is optional. Without `STORE_CONNECT_ENCRYPTION_KEY` the feature is off, nothing contacts Apple or Google, and asobeast reads public store data only.

## What is stored

| Value | How |
| - | - |
| Issuer ID and key ID | In clear, so the store connections card can name the key |
| Key fingerprint | The first sixteen hex characters of the SHA-256 of the public key, so you can tell two keys apart without either being shown |
| Private key | Sealed with AES-256-GCM under `STORE_CONNECT_ENCRYPTION_KEY`, together with the issuer ID and the key ID |

A Google Play connection stores the same way:

| Value | How |
| - | - |
| Service account email, private key id and bucket id | In clear, so the store connections card can name the account and the bucket |
| Key fingerprint | The first sixteen hex characters of the SHA-256 of the service account's public key |
| Service account private key | Sealed with AES-256-GCM under `STORE_CONNECT_ENCRYPTION_KEY`, together with the email, the private key id and the bucket id. The rest of the JSON key file is not kept |

To read reports, asobeast asks Google for a token limited to reading Cloud Storage, and reads only the store performance files in the bucket. To post a review reply, it asks for a separate token for the Google Play Android Developer API and calls only its review reply endpoint.

The sealed value is bound to its workspace and store. A sealed value copied into another workspace's row cannot be opened there.

The private key is never returned by the API, never written to an export, never sent to OpenAI and never logged. A PEM private key block or a signed token that reaches a log line is replaced with `[redacted]` before it is written.

## Who can use it

Only the workspace owner connects, verifies, syncs or disconnects, and only through a signed in session. A personal API token, even one with the write scope, is refused, so a leaked agent token cannot replace or remove the key. Members see the connection and the numbers it brings.

The key can also write one thing: a public reply to a review of the workspace's own apps. A reply is posted, updated or withdrawn only when a member or the owner confirms it on the reviews page through a signed in session; a personal API token and the MCP tools cannot post one, and nothing posts on a schedule. asobeast sends the reply text it keeps for that review and nothing else. See [Reply to reviews](https://docs.asobeast.com/guides/reviews.md#reply-to-reviews).

## How to revoke it

Press **Disconnect** in **Integrations**, then revoke the key in App Store Connect under **Users and Access**, **Integrations**. For Google Play, delete the key of the service account in the Google Cloud console, or remove the account from **Users and permissions** in Play Console. Disconnecting deletes the sealed key and the report requests and keeps the numbers already stored.

A key revoked at the store first is noticed on the next sync: the connection is marked rejected and nothing more is requested with it.

## How to rotate the encryption key

**1. Keep the old key as the previous one**

Set `STORE_CONNECT_ENCRYPTION_KEY_PREVIOUS` to the current value and `STORE_CONNECT_ENCRYPTION_KEY` to a new one from `openssl rand -base64 32`, then restart.

**2. Let every connection reseal**

A stored key sealed with the previous value is opened with it and sealed again with the new one the first time it is used. Press **Verify**, or wait for the daily sync.

**3. Remove the previous key**

Unset `STORE_CONNECT_ENCRYPTION_KEY_PREVIOUS` and restart.

Losing `STORE_CONNECT_ENCRYPTION_KEY` loses every stored console key. The numbers already stored stay, and every owner connects again. Keep the value with your other secrets and out of the repository.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.