App Store Connect has eight user roles, and only two of them can both submit the app and see the money.

Which user roles does App Store Connect document?

Eight, and Apple describes them in a single line each. The Account Holder is the person who completed program enrollment and is responsible for entering into legal agreements with Apple. The Admin is the secondary contact for the team and has many of the same responsibilities, with access to all apps, and on an organization team gets Certificates, Identifiers and Profiles by default. Finance manages financial information, including downloading reports and uploading tax forms, and can view all apps in Payments and Financial Reports, Sales and Trends, and App Analytics. App Manager manages all aspects of an app, such as pricing, App Store information, and app development and delivery.

The other four are narrower. Developer manages development and delivery of an app. Marketing manages marketing materials and promotional artwork, and is the role Apple contacts if your app is considered for featuring on the App Store. Sales analyzes sales, downloads and other analytics for an app. Customer Support analyzes and responds to customer reviews on the App Store. Notice what is missing from all four descriptions: none of them submits anything.

Two numbers come with the account rather than the role. An individual enrolled in the Apple Developer Program can give up to 50 additional users access to their content in App Store Connect, and those users only get App Store Connect: they are not part of a team and receive no other membership benefits. An organization can add an unlimited number of members, and all of them get App Store Connect plus the rest of the membership resources. Both figures were read on 21 October 2026 on Add and edit users and on Overview of accounts and roles.

Three smaller details from the same pages save a support ticket each. Signing in requires two step verification or two factor authentication on the Apple Account, so a new user with neither will stall at the door. An invitation expires 3 days after it is sent and can be resent after that. And when you delete a user, Apple warns that caching may take up to 10 minutes to complete before access is fully revoked, which is the gap people mistake for a failed deletion.

Apple, App Store Connect Help, Role permissions, read 21 October 2026

Which role do you need to submit an app?

Account Holder, Admin or App Manager. The Submit an app page in App Store Connect Help carries that Required role line, and the Submit apps row of the permissions matrix marks exactly the same three roles with full access and leaves the other five blank. So if the person who built the app holds the Developer role, they cannot send it to review, no matter whose Mac the archive came from.

The steps either side of submission have different lists, and that is where teams trip. Uploading a build is Account Holder, Admin, App Manager or Developer, so a Developer gets the binary into the account. Creating the app version is Account Holder, Admin, App Manager or Marketing, so a Marketing user can prepare a release nobody has told them they cannot ship. Answering the app privacy questions is Account Holder, Admin or App Manager. Replying to App Review once a message arrives is full access for those three, and read only for Developer and Marketing, which means the person who wrote the code can read the rejection and cannot answer it.

TestFlight splits the same way. Adding internal testers is the widest permission on the list, Account Holder, Admin, App Manager, Developer or Marketing. Inviting external testers narrows back to Account Holder, Admin or App Manager, and the matrix marks Developer and Marketing as read only on external groups. That is a sensible split once you see it: anyone on the team can be handed a build, while putting one in front of strangers goes through someone who can also submit.

One more row is worth knowing before you promote somebody to App Manager to get them unblocked. An App Manager cannot reply to a customer review, cannot reach any banking or payment screen, and can only add Developer or Marketing users, and only to apps they already have permission to view. An Admin has none of those limits. The practical reading is that App Manager is the release role and Admin is the account role, and promoting past the first one hands over the whole account.

Which roles can see the money?

Account Holder, Admin or Finance. That same trio is the Required role on View payments and proceeds, on Download financial reports, on Enter banking information and on Provide tax information, all read on 21 October 2026. The matrix agrees: the View payments and financial reports row marks those three and nobody else. Finance is a single purpose role and it is the only one of the five junior roles that reaches money at all.

Sales is the role people misread, because there are two kinds of revenue screen. Sales has full access to sales and trends and to app analytics, which is where units and proceeds per territory live, and no access to Payments and Financial Reports, which is where the actual bank transfer lives. So a Sales user can tell you what the app earned last month and cannot tell you what Apple paid you. For sales and trends reports specifically, the matrix marks Sales as needing reports access, which an Admin grants separately when inviting them.

Here is the one place Apple's own pages do not line up, and it is worth knowing before you panic. The View units, proceeds, sales, and pre-orders page gives its Required role as Admin, Finance or Sales, with no Account Holder in the list, while the Role permissions page says the Account Holder can access all aspects of App Store Connect and the matrix marks the Account Holder with full access to View sales and trends. Two first party pages, two answers. Treat the matrix as the wider statement and expect the Account Holder to get in.

Before any of this matters there is a signature, and it cannot be delegated. Selling a paid app or offering in-app purchases requires the Paid Applications Agreement, and Apple states the Account Holder is the one who signs it on behalf of the organization. Agreements also get updated, and when they do, the Account Holder is notified and has to accept by the date shown on the developer account landing page to keep full access to App Store Connect and the App Store Connect API. An Admin cannot do it for them. If your Account Holder left the company, that is the problem to solve first.

Apple Developer, Roles and access, the full permissions matrix, read 21 October 2026

What does a role not give you?

Two permissions sit outside the eight roles, and both are handed out in Users and Access rather than chosen from a role menu. The first is access to Certificates, Identifiers and Profiles. The matrix gives it to Account Holder and Admin outright, and marks App Manager and Developer as needing it granted separately, which is also what lets them upload a build and which brings CloudKit Console with it. A Developer without it signs in, sees the app, and fails at the upload. The second is access to reports, which is what a Sales user needs for sales and trends reports.

Both of them break the app level fence, and this is the part that catches security minded people out. When you invite an App Manager, Developer, Marketing, Sales or Customer Support user, Apple asks which apps they may access. Admin and Finance cannot be limited at all. But Apple also states that users with access to reports or to Certificates, Identifiers and Profiles can view all app information and cannot have their app access limited. So granting either one turns a one app contractor into someone who can see the whole catalogue.

API keys follow their own rules, which is why they are worth reading about separately before you automate anything. Requesting access to the app store connect api is Account Holder only, and Apple reviews the request case by case. Generating a team key afterwards is Account Holder or Admin, and a team key applies across all apps, so app access cannot be limited for one. Every other user can generate one individual key for themselves by default, each person limited to one active key, and an Admin can take that ability away by clearing Generate Individual API Keys under Additional Resources on their user record.

The last thing no role covers is a key you hold yourself. App Store Connect roles decide who may press which button in Apple's console. They have nothing to say about the Android side, where the thing you cannot delegate and cannot replace is a signing key rather than a permission, which is why the google play app signing key and the google play signing upload key are separate problems with separate pages. Losing a role costs you an email to an Admin. Losing the other thing costs you the app.