Apple key with Admin access

This guide fixes a publishing error that looks like one of these:

• “Signed in to Apple, but the account lacks the rights required for this operation.”
• “Apple refuses to create your app’s distribution certificate.”
• “You do not have permission to create this certificate. Only Team Admins can create Distribution certificates.”

Your app is fine. The problem is the access level of the App Store Connect key connected to Bloxks.

Why it happens

To publish, your app must be signed with a distribution certificate. Bloxks creates it for you, using your App Store Connect key. But Apple only allows two roles to create this certificate: Account Holder and Admin. A key created with another access (App Manager, Developer…) connects fine, but gets refused at this exact step.

And Apple does not let you change a key’s access after it is created. The only fix is to create a new key with Admin access.

Before you start: check your own role

Only the Account Holder or an Admin of the Apple Developer account can create this key.

• You enrolled in the Apple Developer Program yourself? You are the Account Holder: go ahead.
• Someone else manages the account (your company, a client)? Ask them to follow step 1 for you, or to give you the Admin role in Users and Access.

Step 1: create the key on App Store Connect

1. Open App Store Connect and sign in.
2. Click Users and Access, then the Integrations tab. The App Store Connect API page opens.
3. Click Team Keys.
4. Click Generate API Key (or the + button if you already have keys).
5. Name it, for example Bloxks Admin. This name is only for you.
6. Under Access, select Admin. This is the step that matters.
7. Click Generate.
8. On the key’s line, click Download API Key and keep the .p8 file safe. Careful: Apple lets you download it only once.
9. Note the Key ID of this new key, and the Issuer ID shown at the top of the page.

First time on this page? Apple may ask the Account Holder to click Request Access first. Approval usually comes quickly.

Step 2: replace the key in Bloxks

1. In Bloxks, open Connections, then App Store Connect.
2. Keep the Issuer ID (it does not change) and enter the new Key ID.
3. Import the new .p8 file (or paste its content).
4. Click Save credentials, then Test connection.

If the test shows an orange warning saying the role is not Admin, the key was created with another access: go back to step 1.

Step 3: relaunch publishing

Go back to your project and click Publish again. Bloxks creates the certificate with the new key and continues where it stopped. You do not need to change anything in your app.

Good to know

• Revoke the old key once everything works: in Integrations, click Edit, select it, then Revoke Key. A revoked key can never be restored.
• One Admin key is enough for all your Bloxks projects.
• Your .p8 key is encrypted on our servers and only used to talk to Apple for you.

Official Apple sources: App Store Connect API keys and role permissions.