From Keyword Selection to App Store Connect: Drafting iOS Listings with Your Own AI & .p8 API Keys

Why updating an iOS listing requires patching both `appInfoLocalizations` and `appStoreVersionLocalizations`

Developers writing their first App Store Connect API script are often surprised to discover that `title` (`name`) and `subtitle` do not live on the same endpoint as `keywords` and `description`. Apple splits localized store metadata across two distinct REST resources ([`connect.ts`](file:///Users/tarik/Desktop/TengrX-SEO/packages/core/src/aso/connect.ts#L156-L216)):

When you click Push to App Store Connect in Searchbop, the client resolves the matching locale (or creates the localization record if that language hasn’t been added to the version yet) and updates both resources in a single coordinated flow.

How Searchbop handles live, editable, and in-review versions

Apple only allows editing `name`, `subtitle`, `keywords`, and `description` when an app version sits in one of five editable states (`EDITABLE_STATES`):

• PREPARE_FOR_SUBMISSION
• DEVELOPER_REJECTED
• REJECTED
• METADATA_REJECTED
• INVALID_BINARY

What happens if your app’s only version is `1.2.0` in `READY_FOR_SALE` (live on the store)? Searchbop’s [`nextVersion()`](file:///Users/tarik/Desktop/TengrX-SEO/packages/core/src/aso/connect.ts#L79-L85) helper automatically computes `1.2.1`, sends `POST /v1/appStoreVersions` with `platform: "IOS"` and `versionString: "1.2.1"`, and writes your new metadata into that fresh `PREPARE_FOR_SUBMISSION` draft. Conversely, if you already have a newer version sitting in `WAITING_FOR_REVIEW` or `IN_REVIEW` (`blocking`), Searchbop warns you immediately and refuses to overwrite or corrupt your in-flight review.

Supporting both Team API keys (`iss`) and Individual keys (`sub: "user"`)

Apple’s App Store Connect API uses 15-minute `ES256` JSON Web Tokens (`aud: "appstoreconnect-v1"`). While company developer accounts issue Team keys that include an Issuer ID (`iss`), solo indie developers on Individual Apple Developer accounts often generate Individual API keys that have no Issuer ID and require `sub: "user"` in the JWT payload instead:

export function connectToken(c: ConnectCredentials, now = Date.now()): string {
  const seconds = Math.floor(now / 1000);
  // Team keys include Issuer ID (iss); Individual keys omit iss and use sub: "user"
  const claims = c.issuerId ? { iss: c.issuerId } : { sub: "user" };
  const header = { alg: "ES256", kid: c.keyId, typ: "JWT" };
  const payload = { ...claims, iat: seconds, exp: seconds + 900, aud: "appstoreconnect-v1" };
  // Signed locally with your .p8 private key using SHA256 + ieee-p1363 DSA encoding
}

How `draftListing()` turns your chosen keywords into compliant copy

When your connected AI model drafts a listing ([`listing.ts`](file:///Users/tarik/Desktop/TengrX-SEO/packages/core/src/aso/listing.ts)), Searchbop passes your current App Store listing, your selected high-opportunity keywords (sorted by Popularity and Difficulty), and the storefront’s language. It instructs the model to treat all store text strictly as data (preventing prompt injection from scraped store descriptions), bans unverifiable `#1 / best / free` claims in Title and Subtitle, and trims the comma-separated `keywords` list to fit inside `100` UTF-8 bytes (`fitKeywords()`).