By Specita
App Store Connect roles: who can do what on a release
App Store Connect roles mapped to release tasks: who can reply to App Review, answer compliance, add testers, and accept agreements, with setup advice.
App Store Connect roles decide what each person can do in your account. The main ones are Account Holder, Admin, App Manager, Developer, Marketing, Finance, Sales, and Customer Support. For release work, most tasks need Account Holder, Admin, or App Manager, and a few need the Account Holder alone. Give people the lowest role that lets them do their job, and grant access per app where you can.
Apple's role page has the full permission matrix. This article takes a different view, by listing the jobs that come up during a release and the role each one needs.
The details below follow Apple's documentation. Roles can change, so check the "Required role" line on the page for the task you are doing.
App Store Connect roles by release task
Each row comes from the Required Role line on Apple's help page for that task.
| Task | Roles Apple lists |
|---|---|
| Add internal testers | Account Holder, Admin, App Manager, Developer, Marketing |
| View build status and metrics | Account Holder, Admin, App Manager, Developer, Marketing |
| Answer export compliance for a beta build | Account Holder, Admin, App Manager |
| Expire a TestFlight build | Account Holder, Admin, App Manager |
| Release in phases, pause, or resume | Account Holder, Admin, App Manager |
| Create webhooks | Account Holder, Admin, App Manager |
| Set availability | Account Holder, Admin, App Manager |
| Reply to App Review | Account Holder, Admin, App Manager |
| Start or accept an app transfer | Account Holder |
| Accept legal agreements | Account Holder |
A person with the Developer role can upload a build and test it, but can't answer Missing Compliance, and can't reply to a rejection. Developers can still receive Apple's App Status Reports emails when an app changes state. So your developer may be the first to know, and unable to respond. Make sure there's someone with the App Manager role available.
The Account Holder
Your team has one Account Holder, and Apple names that person as the one who renews the annual membership and accepts legal agreements for your organization. Treat this as a responsibility to plan around.
If the Account Holder is unavailable, agreement updates can stall, and that can hold up a release. For a company, use a person who'll be around for years and who reads email. Apple has a process to transfer the role if someone leaves, but it takes time, so arrange it before they go.
For agencies, the client's Account Holder is often a founder or a finance person, who has never opened App Store Connect. Introduce yourself before your first release, and explain what they may be asked to accept.
App Manager or Admin?
App Manager suits your release owner. Apple's task pages show that it covers nearly everything a release needs. Admin adds access-level power: managing users and more of the account. You probably need one or two Admins, and no more.
| Person | Suggested role |
|---|---|
| Founder, or person responsible for the account | Account Holder |
| Technical lead managing people | Admin |
| Release owner | App Manager |
| Mobile developer | Developer |
| Marketing person editing listings | Marketing |
| Finance contact | Finance |
| Support lead | Customer Support |
| Client stakeholder who only tests | External TestFlight tester, with no role |
This is our suggestion, so adjust it to your team. A person can hold more than one role, which helps on small teams.
Limit access by app
Roles are only half of it. Apple lets you restrict which apps a person can reach. If your account holds several client or product apps, give each person access to the apps they work on. Don't tick "all apps" as the easy option. See Apple's guide to editing users.
Everyone also needs two-factor authentication or two-step verification, which Apple requires to sign in.
Individual accounts and organizations differ too. Apple's overview says individuals can give up to 50 other people access to App Store Connect, while organizations can add unlimited members.
API keys need the same care
An API key has a role too. If a key is compromised, its role sets the damage. A CI key that only uploads builds needs far less than a tool that manages users. Avoid an Admin key. For a read-only tool, pick the lowest role it can work with, and read our guide to individual vs team API keys.
A review every quarter
Open Users and Access every few months, and ask three questions:
- Does each person still work on this?
- Is the role still right? A developer who moved to product may not need upload access.
- Do we have at least two people who can reply to App Review?
The third matters on the day of an urgent release. A hypothetical example: Apple rejects a critical fix on a Friday afternoon. The only App Manager is on a plane. The developer can see the rejection and can't reply. Nothing moves until Monday.
If you use both stores, compare this to Google Play Console permissions. Google uses fine-grained permissions in place of fixed roles.
Show the status without handing out roles
Plenty of people want to know a release's status, and few need to change anything. Giving them an App Store Connect login for that is more access than the question deserves. Specita has its own workspace members, separate from App Store Connect, and connects to Apple through a key you control. Set that up with the App Store Connect guide.
Apple guidance checked on November 4, 2026.