Security

Your Connect keys stay on your device

Uploading screenshots to App Store Connect requires trust. Here is exactly how CaptoStudio treats API credentials.

What we store

Issuer ID, Key ID, and .p8 material in the iOS Keychain
Project canvases and screenshot assets locally on device
Optional last-used App Store Connect app binding for faster publish

What we do not do

We do not upload your .p8 to a CaptoStudio server
We do not put secrets in SwiftData, UserDefaults, or logs
We do not share credentials with third-party analytics

How upload works

CaptoStudio creates a short-lived ES256 JWT using your Keychain credentials and talks to Apple’s App Store Connect API to replace the target screenshot set for a device class and locale. Progress is shown in the publish UI.

Your responsibility

Create API keys with the minimum App Store Connect role you need
Revoke keys in App Store Connect if a device is lost
Keep iOS device passcode / biometrics enabled

Questions? security@captostudio.app