AdPilot MCP
Sign in
Browse documentation
Last reviewed

Set up an Apple Ads account and API user

Set up Apple Ads (formerly Apple Search Ads) under the person or legal entity that should own the advertising account, link the correct App Store Connect account, and keep one Account Admin separate from a dedicated API user. Whether you are an individual developer or an organization, the Apple-side setup is complete when the invited API user can sign in and see Account Settings → API.

This guide covers Apple account ownership, business details, user invitations, roles, and access scope. It does not cover AdPilot keys or credentials. When the API tab is ready, continue with Connect Apple Ads to AdPilot MCP.

AdPilot supports customer-managed API credentials. The advertiser creates and controls the API user and client used by AdPilot. AdPilot does not currently offer Apple's separate service-provider Sign in with Apple authorization flow. The connection guide explains the exact credentials and setup AdPilot supports.

Decide who should own the Apple Ads account

The Apple Ads account should belong to whoever owns the advertising relationship and is billed by Apple:

  • Individual or sole proprietor: you own the account and remain responsible for billing, tax details, recovery, and access reviews.
  • Company or other organization: the legal entity owns the account, even when an employee, contractor, or agency operates it.
  • Agency-managed advertising: the client should create and own the account if the client wants direct billing and long-term ownership, then invite the agency with appropriate access. An agency-owned account is appropriate only when the agency is intentionally the entity billed by Apple.

Do not create a production advertising account under an employee or contractor merely because that person is performing the setup. Account ownership, invoicing, and offboarding become difficult when the wrong party owns the primary identity.

Set up Apple Ads as an individual

This path is suitable for an indie developer or sole proprietor who owns the app and pays for advertising personally or through a sole proprietorship.

  1. Sign in to Apple Ads with the Apple Account that will administer the advertising account.
  2. Create or complete an Apple Ads Advanced account.
  3. Enter the account name, country or region, currency, timezone, legal name, primary contact, and notification preferences.
  4. On Business Details, select the business-entity answer that truthfully describes you. Apple instructs sole proprietors to select No when asked whether they are a business entity.
  5. Enter the applicable tax information and legal address, then configure payment.
  6. Link the App Store Connect account that owns the app you want to promote.
  7. Keep this original identity as the Account Admin.

Choose currency and timezone carefully. Apple states that they cannot be changed after account creation, and billing uses UTC rather than the selected reporting timezone.

Create a separate API identity

Even for a one-person business, use a second Apple Account for production API access when practical:

  • create it with a durable email address you control;
  • enable two-factor authentication and document recovery methods;
  • store its password in your password manager;
  • keep your primary Account Admin identity separate;
  • never send its password or verification code to AdPilot.

The separation lets you revoke API access without risking the Apple Account that owns billing and user administration. If you choose to use an existing Apple Account instead, make sure it can be assigned an API role without removing the only Account Admin you rely on.

Set up Apple Ads as an organization

This path is suitable for a company, partnership, agency, educational institution, government institution, or other legal entity.

  1. Have an authorized company representative create or complete the Apple Ads Advanced account.
  2. Use the legal entity that Apple should invoice as the account owner.
  3. Enter the company’s registered legal name, address, tax information, primary contact, country or region, currency, timezone, and payment method.
  4. On Business Details, select Yes for business-entity status when the advertiser is a company, organization, partnership, or educational or government institution.
  5. Link the organization’s App Store Connect account. The Apple user performing the link needs an eligible role in both App Store Connect and Apple Ads.
  6. Retain at least one accountable Account Admin who can manage users, billing, and third-party API integration.
  7. Create a dedicated Apple Account for API access using a company-controlled email address.

Use a functional identity such as an address managed by the company rather than a personal mailbox that disappears when an employee leaves. Keep password recovery, two-factor authentication, and the accountable owner in the organization’s credential-management system.

For agencies, decide ownership before creating campaign groups. If a client should own the account or be billed directly, the client should create its own Apple Ads account and invite the agency. Campaign groups can then limit access when an account intentionally contains separate clients or teams.

Apple Ads must be linked to App Store Connect before it can promote an app. For linking or unlinking, Apple currently requires both:

  • an eligible App Store Connect role, such as Account Holder, Admin, App Manager, or Marketer; and
  • an eligible Apple Ads role, such as Account Admin, Campaign Group Manager, or Link Accounts.

Confirm the intended apps appear in Apple Ads before setting up the API user. If an app is newly published, Apple notes that it can take time to become available. A missing app can also indicate an incorrect App Store Connect link, insufficient roles, or an advertising-policy issue.

Have the Account Admin invite the API user

The Account Admin should complete the invitation from Apple Ads:

  1. Click the name in the upper-right corner and open Account Settings.
  2. Open User Management.
  3. Select Invite User.
  4. Enter the API user’s name and the exact email address attached to its Apple Account.
  5. Choose whole-account access or one or more campaign groups.
  6. Assign the appropriate API role.
  7. Send the invitation.

The invited user must accept with the same email address that received the invitation. Pending invitations remain visible in User Management. An Account Admin can cancel an incorrect pending invitation and send a new one.

Choose the API role and scope

Grant the smallest Apple-side scope that supports the intended work:

Apple Ads role Apple-side access Appropriate use
API Account Read Only Reporting and data across the whole account Analysis and synchronization without campaign writes
API Account Manager API read/write across the whole account Account-wide direct campaign operations
API Read Only API reporting for selected campaign groups Analysis limited to specific groups
API Read & Write API read/write for selected campaign groups Direct operations limited to specific groups

Do not grant Account Admin merely to enable API access. Account Admin includes user, billing, account-setting, campaign, and third-party integration powers; Apple provides dedicated API roles for programmatic access.

For AdPilot analysis only, start with API Account Read Only or limited API Read Only. When the account owner intentionally wants AdPilot to perform supported direct operations, use API Account Manager or limited API Read & Write. AdPilot’s own limits do not replace Apple’s provider-side permission boundary.

Accept the invitation as the API user

The dedicated API user should:

  1. Open the invitation email from Apple Ads.
  2. Follow the acceptance link.
  3. Sign in with the Apple Account whose email exactly matches the invitation.
  4. Complete any verification challenge.
  5. Confirm the expected Apple Ads account or assigned campaign groups are visible.
  6. Open Account Settings and confirm the API tab is available.

Be deliberate about the active identity. Creating API access while still signed in as the Account Admin can attach it to the wrong user and permission set.

Once the dedicated user can see the API tab, stop here and follow Connect Apple Ads to AdPilot MCP. That guide covers generating the AdPilot key, creating the Apple API client with that public key, copying identifiers, testing access, and synchronizing data.

Troubleshoot Apple account and user setup

The invitation remains pending

Confirm that the invitation email exactly matches the Apple Account email used to sign in. The Account Admin can inspect User Management, cancel the pending invitation, correct the address, and resend it.

The API tab is missing

Confirm that the active Apple Account is the invited user and that it has an API role. Account Finance, Account Read Only, Read & Write, and other non-API roles do not substitute for the API roles listed above.

The app is missing

Check the App Store Connect link and the roles held by the person linking the accounts. Also confirm the app is available on the App Store and eligible for Apple Ads. Newly published apps may not appear immediately.

The user sees only some campaign groups

Limited API roles expose only the campaign groups selected during invitation or later access management. Ask the Account Admin to review the assigned scope; do not broaden it unless the additional access is intentional.

The individual account has no separate administrator

Do not remove or downgrade your only recoverable Account Admin just to create an API user. Retain the primary administrative identity and invite a second Apple Account for the API role.

Review and remove Apple access

The Account Admin should periodically review User Management for pending invitations, inactive users, API roles, and campaign-group scope. Apple states that changing an API user to a non-API role revokes API access. Removing the user also revokes the provider-side access associated with that identity.

For offboarding:

  1. identify any service that still depends on the API user;
  2. disconnect that service before revoking Apple access when an orderly shutdown is required;
  3. have the Account Admin remove the API user or change its role;
  4. remove the Apple Account from company credential and recovery systems when it is no longer needed;
  5. record who completed the review and when.

Only an Account Admin can cancel invitations or remove users from the Apple Ads account.

How AdPilot uses this Apple setup

AdPilot does not receive the Apple Account password, two-factor authentication code, recovery key, billing access, or Account Admin session. The dedicated user and its API role define which Apple Ads account and campaign groups can later be exposed through an API client. The separate connection guide begins only after that Apple-side identity and permission boundary is ready.

Apple setup checklist

  • The correct individual or legal entity owns the Apple Ads account.
  • Country or region, currency, timezone, legal name, tax details, and payment information are correct.
  • The intended App Store Connect account is linked and the app appears in Apple Ads.
  • A recoverable Account Admin remains responsible for billing and user management.
  • The API identity uses a durable owner-controlled email and Apple Account.
  • Password recovery and two-factor authentication are documented privately.
  • The Account Admin invited the exact Apple Account email.
  • The selected API role and campaign-group scope follow least privilege.
  • The API user accepted the invitation using the same email address.
  • The API user can see the expected account or groups and Account Settings → API.
  • No Apple password, recovery method, or verification code was shared with AdPilot.

Next steps

Official sources

Need help with AdPilot MCP?

Contact support at support@kovacssoftware.com

AdPilot is an independent service and is not affiliated with, endorsed by, sponsored by, or operated by Apple Inc. Apple and Apple Ads are trademarks of Apple Inc.