Slowlane

Slowlane is a Python command-line application for automating selected App Store Connect and Apple Developer Portal workflows. App Store Connect REST and upload commands use API-key authentication; Developer Portal signing commands use an Apple ID session. The CLI also provides structured JSON output and CI environment helpers.

Documentation | Installation | CLI reference | Changelog

Capabilities

Developer Portal commands use Apple's private web-service endpoints and can require updates when Apple changes those services. Upload commands require Apple tooling that is normally available only on macOS.

Requirements

• Python 3.14 or newer
• An App Store Connect API key for REST API and upload workflows
• Chromium for interactive Apple ID login
• Xcode or the Transporter app on macOS for IPA and PKG uploads

Installation

Install the base package for API-key and pre-existing session workflows:

python -m pip install slowlane

Install the interactive-login extra and its Chromium browser:

python -m pip install "slowlane[interactive]"
python -m playwright install chromium

Verify the installation:

slowlane version

Quick start

App Store Connect API key

Create an API key in App Store Connect, then provide its key ID, issuer ID, and private key:

export ASC_KEY_ID="XXXXXXXXXX"
export ASC_ISSUER_ID="xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
export ASC_PRIVATE_KEY_PATH="/absolute/path/to/AuthKey_XXXXXXXXXX.p8"

slowlane asc apps list
slowlane asc builds list --app APP_RESOURCE_ID

Use ASC_PRIVATE_KEY instead of ASC_PRIVATE_KEY_PATH when the private-key contents are supplied directly by a secret manager.

Interactive Apple ID session

Interactive login is required for Developer Portal signing operations:

slowlane spaceauth login --service developer --email developer@example.com
slowlane spaceauth verify --email developer@example.com
slowlane spaceauth export --email developer@example.com

Store the exported value as the FASTLANE_SESSION secret in CI. Treat it as a credential.

JSON output

The global --json option must precede the command:

slowlane --json asc apps list

Command overview

Run slowlane COMMAND --help for complete options and examples.

Configuration

Slowlane reads TOML configuration from:

• Linux and macOS: ~/.config/slowlane/config.toml, or $XDG_CONFIG_HOME/slowlane/config.toml
• Windows: %APPDATA%\slowlane\config.toml

[auth]
key_id = "XXXXXXXXXX"
issuer_id = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
private_key_path = "/absolute/path/to/AuthKey_XXXXXXXXXX.p8"

[http]
timeout = 30
max_retries = 3
backoff_factor = 0.5

[output]
format = "text"
verbose = false

[devportal]
team_id = "TEAM_ID"

Environment variables override file-based authentication and output settings:

See the configuration reference for details.

Security

• Never commit API private keys or exported session values.
• Store credentials in the operating-system keychain or your CI provider's secret store.
• Use narrowly scoped App Store Connect roles and rotate credentials regularly.
• Review the security policy before reporting a vulnerability.

Development

poetry install --all-extras --with docs,release,security
poetry run ruff check src tests
poetry run ruff format --check src tests
poetry run mypy src/slowlane
poetry run pytest
poetry run mkdocs build --strict

See the contribution guide for the contribution workflow.

License

Slowlane is available under the MIT License.

Apple, App Store Connect, TestFlight, Xcode, and Transporter are trademarks of Apple Inc. Slowlane is an independent project and is not affiliated with or endorsed by Apple Inc.