There is no single App Store Connect CLI, and the tool everyone calls deprecated still uploads your app.
Search for an App Store Connect CLI and you get two answers that contradict each other. One says altool is deprecated and you must move to notarytool. The other says altool is how you upload a build. Both quote Apple correctly, because the deprecation was real and it was narrow. Underneath all of these tools sits the App Store Connect API, and once you know which tool talks to which service, the contradiction disappears.
This page covers the four things that answer to the name, what Apple deprecated and on what date, what an upload looks like in 2026, and why a successful upload does not mean you have a build yet.
See which tool does which jobThe short version
One deprecation notice, two tools people keep confusing.
notarytool replaced altool for notarization. Notarization is a macOS thing: you send a Mac app, installer or disk image to the Apple notary service and get a ticket back so Gatekeeper will open it. Uploading an iOS build to App Store Connect is a different service, and notarytool has no command for it.
So the sentence worth keeping is this. altool was deprecated for one job and kept for the other. If you came here to upload an .ipa from a build server, the notice you read was about something else, and swapping in notarytool will simply fail.
Four tools answer to the same name
Apple does not ship one binary called the App Store Connect CLI. Four separate things do the work. altool validates and uploads app binaries. notarytool submits macOS software to the notary service. Transporter is a macOS app from the Mac App Store that carries a command line tool. And the App Store Connect API is a REST interface you can call from any machine.
Apple lists the routes in one sentence: after adding an app to your account, you can upload a build using Xcode, Swift Playground, altool, or Transporter. The same page adds that if you already use the API, you can upload the binary with the Transporter command line tool and the same JSON Web Tokens. Upload for all target types is supported for Transporter and altool, and Xcode Cloud is listed as a fifth route.
Two requirements on that page matter before you pick anything. Apple says that starting in 2026 you are required to use Xcode 14 or later to upload to App Store Connect. Building is stricter: iOS apps, iOS app extensions and watchOS app extensions have to be built using Xcode 26 or later. Whoever runs the command also needs the Account Holder, Admin, App Manager or Developer role.
Apple, App Store Connect Help: Upload builds
Try it
Which tool for which job
Pick what you are actually trying to do. The tool follows from the job, and only one of these four jobs is a notarization job.
xcrun altool, or Transporter
Both validate and upload app binaries for every target type. The altool deprecation covered notarization, not uploads.
What Apple deprecated, and the date it stopped working
Apple's technote on the migration is direct about the scope. It says Apple has deprecated altool for the purposes of notarization and announced that it will stop working for notarization on 1 November 2023. The very next sentence says altool is still a good way to perform other tasks, like submitting an app to the App Store. Further down: notarytool only replaces the notarization aspects of altool.
That is the whole of it. No Apple page says altool cannot upload an app, and Apple's upload help still prints both commands, validate-app and upload-app, each taking a file, a platform and a username with a password or an API key. The advice to swap your upload script for notarytool is a misreading of a notarization notice, repeated until it sounded official.
If you do notarize a Mac app, the migration is small. notarytool accepts the same credentials, either an app-specific password or an App Store Connect API key, and its submit, info, log and history subcommands replace the old flags. One catch: the notary service emailed you when altool finished but does not for notarytool, so use the wait or webhook options instead.
What an upload from the command line actually looks like
Strip the tool names away and an upload is four steps. You have a signed archive. You prove who you are. You hand the file over. You wait while Apple processes it. The tools differ only in who holds the file and how you authenticate, which is why swapping one for another is a small change.
altool is the shortest path on a Mac that already has Xcode: one xcrun invocation with the file, the platform, your Apple ID and either an app-specific password or an API key. Transporter is the same delivery with a window around it, showing progress, warnings, errors and past deliveries, plus a command line tool that takes the same tokens as the API. The wider release sequence is covered in publish to app store.
The API route is what has genuinely changed, and it is the answer when your CI is not a Mac. The App Store Connect API now carries a build upload resource: create a build upload with the bundle version and platform, create a file record per part, push the bytes to the URLs it hands back, then commit each file with its checksum. The upload reports a state of awaiting upload, processing, failed or complete, so a script can poll instead of guessing.
All of this assumes the .ipa exists and is signed with a profile that matches the bundle ID. That is a separate fight, and on an Expo project most people are building the binary first on a hosted service. Signing is where uploads actually fail, far more often than transport is.
The upload returns before the build exists
A successful upload is not a build anyone can install. Apple is explicit that the build needs to be processed in its system before it appears in App Store Connect, and that you get an email when that is complete. The first upload also creates a beta version of the app in your account. A script that uploads and then immediately assigns testers will fail.
Apple matches an upload to a record using the bundle ID and version number inside the app bundle, and the build string uniquely identifies the build throughout the system. That is why a reused build number is rejected rather than quietly overwriting, and why the fix is always to increment the build string.
What you have after processing is a TestFlight build first and a release candidate second. Testers, export compliance and beta review all come after this point, and all of them have API endpoints, which is what makes the sequence scriptable end to end. The testing half is covered in ios testflight.
What each tool actually does
| Tool | Uploads a build | Notarizes macOS software | Works without a Mac | Credentials |
|---|---|---|---|---|
| xcrun altool | Yes | No | No | Apple ID password or API key |
| xcrun notarytool | No | Yes | No | Apple ID password or API key |
| Transporter | Yes | No | No | Apple ID, or the same JWT as the API |
| App Store Connect API | Yes | No | Yes | API key signed JWT |
| Xcode Organizer | Yes | Yes | No | the Apple Account signed in to Xcode |
Building the pipeline around these commands
If you are writing this yourself, the upload command is the easy part. The work is around it: a Mac to make the archive, certificates and profiles that do not expire mid release, an API key a CI job can read without printing it to a log, a build number that increments under parallel jobs, and a poll loop that waits for processing.
Newly is an AI app builder. You describe the app in plain English, it writes a real React Native and Expo project you own, runs it on a cloud iPhone or Android simulator while it builds, and the Deploy tab uploads iOS builds to TestFlight through App Store Connect. You bring your own Apple Developer account, because the App Store relationship is always yours. Plans start at $25 a month, there is no free plan, and the project pulls down to your machine with the newly CLI.
It does not replace the tools on this page. If you need a custom upload step, a signing arrangement Apple does not offer, or delivery somewhere that is not the App Store, you are back to altool, Transporter or the API. Knowing which tool does which job is what lets you reach for the right one, instead of the one a blog post from 2022 said was gone.
Questions about the App Store Connect command line
Partly, and the part matters. Apple deprecated altool for the purposes of notarization and said it would stop working for notarization on 1 November 2023. App Store uploads were not covered. Apple's technote says in the same paragraph that altool is still a good way to perform other tasks, like submitting an app to the App Store.
Ship the build, skip the pipeline
Describe the app you want, get a real React Native project you own, and send the iOS build to TestFlight without writing the upload step yourself.
Start building