We are calling these App Store Connect API endpoints from our server:
curl --request POST \
--url https://api.appstoreconnect.apple.com/v1/gameCenterLeaderboardEntrySubmissions \
--header 'Authorization: Bearer JWT_Token' \
--header 'Content-Type: application/json' \
--data '{
"data": {
"type": "gameCenterLeaderboardEntrySubmissions",
"attributes": {
"bundleId": "bundleId",
"score": "1",
"scopedPlayerId": "scopedPlayerId,
"submittedDate": "date",
"preReleased": true,
"vendorIdentifier": "vendorIdentifier"
}
}
}'
curl --request POST \
--url https://api.appstoreconnect.apple.com/v1/gameCenterPlayerAchievementSubmissions \
--header 'Authorization: Bearer JWT_Token' \
--header 'Content-Type: application/json' \
--data '{
"data": {
"type": "gameCenterPlayerAchievementSubmissions",
"attributes": {
"bundleId": "bundleId",
"vendorIdentifier": "vendorIdentifier",
"percentageAchieved": 1,
"scopedPlayerId": "scopedPlayerId,
"submittedDate": "Date",
"preReleased": true
}
}
}'
According to https://developer.apple.com/documentation/appstoreconnectapi/app-store-connect-api-3-2-release-notes We should be able to set player score and achievements.
We use an active Team App Store Connect API key and generate an unscoped ES256 JWT with aud: appstoreconnect-v1.
The key has high-level App Store Connect permissions.
We followed documentation:
https://developer.apple.com/documentation/appstoreconnectapi
https://developer.apple.com/documentation/appstoreconnectapi/post-v1-gamecenterplayerachievementsubmissions
https://developer.apple.com/documentation/appstoreconnectapi/post-v1-gamecenterleaderboardentrysubmissions
Both requests return:
{
"status": "403",
"code": "FORBIDDEN_ERROR",
"title": "This request is forbidden for security reasons",
"detail": "The API key in use does not allow this request"
}
The player is authorised via GameKit on the mobile app.
The API key can read:
https://api.appstoreconnect.apple.com/v1/apps/:id
https://api.appstoreconnect.apple.com/v2/gameCenterLeaderboards/:id.
Which exact App Store Connect API key role or permission is required for these endpoints?
Is server-to-server submission supported using a Team API key?
0
0
125