smbcloud-ascapi
smbcloud-ascapi is the app stores coolest API.
Nine crates, split by domain and layered so neither front end can drift
from the other:
| Crate | What it is |
|---|
smbcloud-ascapi-core | Shared transport: JWT auth, the HTTP client, JSON:API envelopes, error types |
smbcloud-ascapi-play | Google Play (Edits v3): store listings, listing images, track release notes; service-account auth, independent of core |
smbcloud-ascapi-appgallery | Huawei AppGallery Connect Publishing API (Android): app info and listings, file and package upload, submit, phased release, release time, GMS flag, package list and status; Service Account auth (PS256 JWT), independent of core |
smbcloud-ascapi-msstore | Microsoft Store submission API v1.0: listing text on an MSIX app's pending submission; Entra client-credentials auth, independent of core |
smbcloud-ascapi-aso | App Metadata: apps, app infos, versions, builds, pre-release versions, review submissions, bundle IDs, localizations, screenshots |
smbcloud-ascapi-pricing | Pricing: app price schedules, and the per-territory prices joined with their price points and currencies |
smbcloud-ascapi-signing | Code signing: certificates and provisioning profiles, plus local RSA key pair and CSR generation |
smbcloud-ascapi-reports | Sales reports: account-level sales data, as Apple's gzip-compressed TSV |
smbcloud-ascapi-frontend | Operations both surfaces share, so the CLI and the MCP server agree by construction, plus the CLI's xcrun altool upload |
smbcloud-ascapi-mcp | The MCP contract and stdio server |
smbcloud-ascapi-cli | The asc binary: clap command tree, plus --mcp |
aso, play, appgallery, msstore, pricing, signing and reports know nothing about each other, and neither knows
anything about the front ends. Each adds its calls to
smbcloud_ascapi_core::Client as extension traits, since Rust only
allows inherent impls in the crate that defines a type:
use smbcloud_ascapi_core::{ApiKey, Client};
use smbcloud_ascapi_aso::prelude::*; // or pricing::prelude, signing::prelude
MCP Registry name: mcp-name: io.github.smbcloudXYZ/ascapi
Credentials
The CLI signs requests with an App Store Connect API key:
| Flag | Environment variable | Notes |
|---|
--key-id | ASC_API_KEY | The key id. There is no ASC_KEY_ID. |
--issuer-id | ASC_ISSUER_ID | The issuer id from App Store Connect. |
--private-key-path | ASC_PRIVATE_KEY_PATH | Defaults to ~/.appstoreconnect/private_keys/AuthKey_<key-id>.p8. |
With --mcp, credentials are resolved on each tool call, so the server can
list its tools before they are configured.
AppGallery credentials
asc appgallery uses an AppGallery Connect Service Account (developer-level,
with a publishing role), not the App Store Connect key:
| Flag | Environment variable | Notes |
|---|
--service-account | APPGALLERY_SERVICE_ACCOUNT_JSON_PATH | The *private.json file; or its contents in APPGALLERY_SERVICE_ACCOUNT_JSON. |
--client-id | APPGALLERY_CLIENT_ID | Optional client_id header. |
asc appgallery app-id xyz.smbcloud.SiGit
asc appgallery listings list <APP> [--lang en-US] # every field the API returns
asc appgallery listings update <APP> --lang en-US --brief "..." --release-notes-file notes.txt
asc appgallery listings delete <APP> --lang id
asc appgallery info update <APP> --privacy-policy URL [--category ID --category-tag ID]
[--publish-country CODES] [--developer-website URL] [--device-types JSON] ...
asc appgallery files upload <APP> --type icon --lang en-US icon-216.png
asc appgallery files upload <APP> --type screenshots --orientation portrait --lang en-US 1.png 2.png
asc appgallery files upload <APP> --type package siGit.apk # chineseMainlandFlag=0 unless --chinese-mainland
asc appgallery packages list <APP>
asc appgallery packages status <APP> <PKG_ID>...
asc appgallery gms <APP> --needs-gms false
asc appgallery submit <APP> [--release-time T] [--remark TEXT] [--phased-start T --phased-end T --phased-percent P --phased-description D]
asc appgallery phased-release <APP> (--to-full | --state SUSPEND|RELEASE | --phased-percent P ...)
asc appgallery release-time <APP> (--immediately | --at T)
<APP> is the numeric app id or the package name. Every write takes
--dry-run. Binding an image or video for a language clears that language's
text; files upload reads the text first and writes it back if it went
missing. MCP has three read-only tools: appgallery_app_info_get,
appgallery_package_list and appgallery_package_status.
Not covered: the "download mode" submit and package calls, which need a
public package URL and a callback server for Huawei to report to.
Copyright
© 2026 PT Sigit Mitra Bangun (smbCloud).
