What causes "ASC_KEY_ID, ASC_ISSUER_ID, and ASC_KEY_PATH are required." in tinyhumansai/openhuman?

Create an App Store Connect API key (appstoreconnect.apple.com → Users and Access → Integrations → App Manager role or higher) and download the .p8

tinyhumansai/openhuman · error · Error

ASC_KEY_ID, ASC_ISSUER_ID, and ASC_KEY_PATH are required.

Error message

ASC_KEY_ID, ASC_ISSUER_ID, and ASC_KEY_PATH are required.

What it means

scripts/ios-appstore-metadata.mjs is a top-level-await ESM script that talks to the App Store Connect API; it fails fast at startup unless all three credentials are present: ASC_KEY_ID (the API key id), ASC_ISSUER_ID (the team's issuer id), and ASC_KEY_PATH (path to the .p8 private key file). Other knobs have defaults (ASC_APP_ID defaults to 6761229174, ASC_LOCALE to en-US), but the key material never does.

Source

Thrown at scripts/ios-appstore-metadata.mjs:28

const screenshotDir = path.join(rootDir, "fastlane/screenshots/en-US");
const apiBase = "https://api.appstoreconnect.apple.com/v1";

const appId = process.env.ASC_APP_ID || "6761229174";
const locale = process.env.ASC_LOCALE || "en-US";
const platform = process.env.ASC_PLATFORM || "IOS";
const screenshotDisplayType =
  process.env.ASC_SCREENSHOT_DISPLAY_TYPE || "APP_IPHONE_67";
const versionString =
  process.env.ASC_VERSION_STRING ||
  JSON.parse(await readFile(path.join(rootDir, "app/package.json"), "utf8"))
    .version;

const keyId = process.env.ASC_KEY_ID;
const issuerId = process.env.ASC_ISSUER_ID;
const keyPath = process.env.ASC_KEY_PATH;

if (!keyId || !issuerId || !keyPath) {
  throw new Error("ASC_KEY_ID, ASC_ISSUER_ID, and ASC_KEY_PATH are required.");
}

function base64Url(input) {
  return Buffer.from(input)
    .toString("base64")
    .replaceAll("+", "-")
    .replaceAll("/", "_")
    .replaceAll("=", "");
}

async function createJwt() {
  const privateKey = await readFile(keyPath, "utf8");
  const now = Math.floor(Date.now() / 1000);
  const header = { alg: "ES256", kid: keyId, typ: "JWT" };
  const payload = {
    iss: issuerId,
    aud: "appstoreconnect-v1",
    iat: now,

View on GitHub (pinned to a221052e0d)

Solutions

Create an App Store Connect API key (appstoreconnect.apple.com → Users and Access → Integrations → App Manager role or higher) and download the .p8
Export the triple before running: `ASC_KEY_ID=ABCDE12345 ASC_ISSUER_ID=xxxxxxxx-xxxx-... ASC_KEY_PATH=/path/AuthKey_ABCDE12345.p8 node scripts/ios-appstore-metadata.mjs`
In CI, store key id / issuer id / key file as secrets and map all three into the step env (the key file itself can be written from a base64 secret)

Example fix

# before
node scripts/ios-appstore-metadata.mjs
# → Error: ASC_KEY_ID, ASC_ISSUER_ID, and ASC_KEY_PATH are required.

# after
export ASC_KEY_ID="ABCDE12345"
export ASC_ISSUER_ID="69a6de7f-...-847e5f5c4aa"
export ASC_KEY_PATH="$HOME/Downloads/AuthKey_ABCDE12345.p8"
node scripts/ios-appstore-metadata.mjs

Defensive patterns

Strategy: validation

Validate before calling

const required = ['ASC_KEY_ID', 'ASC_ISSUER_ID', 'ASC_KEY_PATH'];
const missing = required.filter(k => !process.env[k]);
if (missing.length) {
  console.error(`Missing App Store Connect env: ${missing.join(', ')}`);
  process.exit(1);
}
// then: node scripts/ios-appstore-metadata.mjs

Prevention

Wrap the release run in a tiny preflight script that checks the three ASC_* variables and the .p8 file's existence before starting the long upload run
Keep the triple together in CI secrets and map all three in one step env block — partial exports always fail
After rotating an ASC key, update key id, issuer (if team changed) and key path in the same change; the script fails fast so nothing half-applies

When it happens

Trigger: Running `node scripts/ios-appstore-metadata.mjs` locally without exporting the three env vars; a CI job where the ASC secrets were not mapped into the step's env; ASC_KEY_PATH set but ASC_KEY_ID/ASC_ISSUER_ID forgotten (all three are checked together, the error fires on the first missing one).

Common situations: Fresh machine without the release .env; rotating a revoked ASC key and forgetting to update one of the three values; secrets stored in the CI vault but not referenced in the workflow step.

Related errors

AI-assisted analysis of tinyhumansai/openhuman@a221052e0d (2026-08-16). Data as JSON: /api/errors/19ff4bfe703d9745. Report an issue: GitHub.