AppDeskConfigure AppDesk with Apple Ads
Follow this guide to create an Apple Ads API client and connect your campaign spend to AppDesk, so it sits next to the App Store revenue it brought in.
Prerequisite: You need an Account Admin in your Apple Ads account to hand out an API role, and you sign in under that API role to create the client. An Account Admin on its own cannot do it — see Step 1.
This is separate from your App Store Connect key. If you have not connected App Store Connect yet, start with the App Store Connect setup guide — Apple Ads spend is only useful once there is revenue to compare it against.
Step 1 — Give Yourself an API Role
Apple Ads keeps API access behind its own set of user roles. The screen where you create an API client is only visible to a user who holds one of them, which is why your existing admin login is not enough.
- Sign in to Apple Ads as an Account Admin.
- Open Account Settings (the gear icon, top right) and select the User Management tab.
- Click Invite Users and invite yourself — you can reuse the same Apple Account — with the API Account Read Only role.
- Accept the invitation from your email, then sign back in to Apple Ads as that API user.
Tip: AppDesk only reads reports, so API Account Read Only is all it needs. Choose API Account Manager instead only if you want the same credentials to create or edit campaigns from other tools.
Step 2 — Generate a Key Pair
Unlike App Store Connect, Apple Ads does not hand you a key file. You create the key pair yourself and give Apple the public half. Open Terminal and run these two commands:
openssl ecparam -genkey -name prime256v1 -noout -out private-key.pem openssl ec -in private-key.pem -pubout -out public-key.pem
This leaves two files in whatever folder you ran the commands in:
private-key.pem— stays on your machine. You add this to AppDesk in Step 4 and never share it.public-key.pem— you paste this into Apple Ads in Step 3.
Print the public key so you can copy it:
cat public-key.pem
Important: Keep private-key.pem somewhere safe. Nobody can re-issue it for you — if you lose it, you generate a new pair and register the new public key with Apple Ads again.
Step 3 — Create the API Client
- Still signed in to Apple Ads as your API user, open Account Settings and select the API tab.
- Paste the full contents of
public-key.peminto the Public Key field — including the-----BEGIN PUBLIC KEY-----and-----END PUBLIC KEY-----lines. - Click Generate API client.
Apple then shows three values above the Public Key field:
- Client ID — a long identifier beginning with
SEARCHADS.followed by a UUID. - Team ID — also begins with
SEARCHADS.; it is not your Apple Developer team id. - Key ID — a UUID identifying the key pair you just registered.
These three stay visible on this page, so you can come back for them later. Copy all three now.
Step 4 — Connect AppDesk
- Open AppDesk and go to Settings → Apple Ads.
- Paste the Client Id, Team Id, and Key Id from Step 3.
- Next to Private Key, click Add… and select your
private-key.pemfile. - Click Connect.
- If your key can see more than one Apple Ads organization, pick the one you want to track under Organization. AppDesk selects it for you when there is only one.
Your private key is stored in the Keychain on your device and is used only to sign requests to Apple. It is never sent to Rivolu LLC or any third party.
Step 5 — Choose What to Sync
Once connected, two optional settings appear. Both change how much AppDesk downloads.
Break spend down by country
One row per campaign, per country, per day instead of one per campaign per day. More detail, more to download. Changing it re-downloads your spend history, because the two levels of detail cannot be mixed without double-counting.
Track keyword performance
What each keyword cost and returned, pulled after every spend sync. Worth turning on early: Apple serves daily keyword data for about 90 days only, so history builds from the day you enable it and cannot be backfilled afterwards.
Apple serves daily campaign data for about 90 days. Your first sync reaches back that far and no further; everything after that accumulates as AppDesk keeps syncing.
Field Reference
| Field | Where to Find It |
|---|---|
| Client Id | Apple Ads → Account Settings → API (above the Public Key field) |
| Team Id | Same page, next to the Client ID |
| Key Id | Same page, identifies the key pair you registered |
| Private Key (.pem) | The file you generated with openssl in Step 2 |
| Organization | Chosen in AppDesk after clicking Connect |
Troubleshooting
“There is no API tab, or no Public Key field”
This is the most common snag. The field is hidden from Account Admins — it only appears for a user signed in with an API role. Go back to Step 1, invite yourself as API Account Read Only, accept the invitation, and sign in as that user.
“This API key has no Apple Ads organizations”
The credentials work, but the user behind them has not been granted access to any campaign group. Check in Account Settings → User Management that the API user still holds its role and that the invitation was accepted.
“That file doesn't look like a private key”
AppDesk needs private-key.pem, not public-key.pem. The right file starts with -----BEGIN EC PRIVATE KEY----- or -----BEGIN PRIVATE KEY-----.
“Apple Ads authentication failed”
The ids and the key file have to come from the same registration. If you generated a second key pair after copying the ids, paste the new public key into Apple Ads and copy the ids again — they change with the key.
“I lost my private key file”
Run the two openssl commands from Step 2 again, paste the new public key into Apple Ads → Account Settings → API, and update the Client Id, Team Id, and Key Id in AppDesk.
“My spend disappeared after switching organization”
Expected. Spend from one organization means nothing under another, so AppDesk clears what it downloaded and syncs the new organization from scratch. Your App Store data is untouched.
Still need help? Contact us at admin@rivolu.com