Connect a store

Before you can pull in apps, connect at least one store credential. Open Stores → Credentials. Credentials are encrypted at rest — secrets never leave the server.

If the workspace has no credentials yet, the Apps tab shows a Connect a store to get started panel with Connect Apple and Connect Google buttons. Otherwise use Add Apple / Add Google on the Credentials tab.

---

Apple App Store Connect

Apple credentials use an App Store Connect API key (a .p8 PKCS#8 private key). This is the only Apple auth method.

Click Add Apple. Athena round-trips a request against Apple to verify the key before saving — invalid keys never persist.

Field	Notes
Label	A name to recognise the key, e.g. Production key. Required.
Issuer ID	The issuer ID Apple gave you — a UUID.
Key ID	The 10-character identifier Apple shows next to the .p8.
Private key (.p8 PEM)	Paste the full PKCS#8 PEM block (-----BEGIN PRIVATE KEY----- … -----END PRIVATE KEY-----), or use Upload .p8 to load the file.

You can paste the PEM text directly or upload the .p8 file — both populate the same field. On success you’ll see Apple credential saved, and Athena immediately syncs the apps that key can see.

---

Google Play

Google credentials use interactive Google sign-in (OAuth). Click Add Google, give the account a Label, then Sign in with Google — Athena redirects you to Google’s consent screen and requests the Android Publisher scope. After you approve, you’re returned to Athena and the Play app import picker opens automatically.

Caution

Google sign-in must be enabled on your deployment. If it isn’t, the dialog shows: “Sign in with Google is disabled on this deployment.” An operator must set GOOGLE_OAUTH_CLIENT_ID, GOOGLE_OAUTH_CLIENT_SECRET, and GOOGLE_OAUTH_REDIRECT_URI on the API server (these are backend settings — the client secret never reaches the browser).

Play Console developer id

Each Google credential has a Play Console developer id field — the numeric id from your Play Console URL (play.google.com/console/u/0/developers/{id}/…). Enter it and click Save to enable deep links into the right Play Console account.

---

Validate & delete

Each credential row shows its label, provider, auth mode, and when it was last validated. Two actions are available:

• Test — re-validates the credential against the provider. Shows “<label> validated” on success.
• Delete (trash icon) — removes the credential from the vault. The underlying App Store Connect / Play Console account is not affected.

Note

If a Google credential was created before the Play reporting scope was added, re-consent is required: delete the credential and sign in with Google again.