Connect your App Store and Google Play accounts.

What you will need

Mokbi never sees your store password. Instead you create a scoped key for each store and paste it in once. It is verified with the store, stored encrypted, and you can disconnect it at any time.

• Google Play: a Google Cloud service account key, downloaded as a JSON file, from a project that has the Google Play Android Developer API enabled, plus that service account invited into your Play Console.
• App Store Connect: an API key, downloaded as a .p8 file, plus its Key ID and your team's Issuer ID.

You only do this once per store. After that, publishing and re-publishing is a single click. Do Google first, it has more moving parts.

Google Play, part 1: create the service account key

This happens in the Google Cloud Console (console.cloud.google.com).

1. Create or pick a project, for example "Mokbi Publisher".
2. Go to APIs & Services → Library, search for Google Play Android Developer API, and click Enable.
3. Go to APIs & Services → Credentials → Create credentials → Service account. Give it a name like mokbi-play-publisher. You can leave the project roles empty, the real permissions come from the Play Console in part 2.
4. Open the service account, go to the Keys tab, then Add key → Create new key → JSON, and download the file. That JSON is what you paste into Mokbi. The client_email inside it (it ends in .iam.gserviceaccount.com) is the address you invite in the next step, so keep it handy.

Hit "Service account key creation is disabled"? That is a Google organization policy called iam.disableServiceAccountKeyCreation, on by default under "Secure by Default". Turn it off for this project: IAM & Admin → Organization Policies, find Disable service account key creation, choose Manage policy, select "Override parent's policy", set Enforcement: Off scoped to this project, and Save. Wait a couple of minutes and try the key again. You need the Organization Policy Administrator role, which an org owner has or can grant.

Google Play, part 2: grant access in the Play Console

This is the step that costs people hours, so read it carefully. Access to your app is granted only in the Google Play Console (play.google.com/console), never in Google Cloud IAM. There are two places to check:

1. Setup → API access: make sure the Google Cloud project that holds your service account is linked here. Without the link, the key can authenticate but gets a 403 on every app.
2. Users and permissions (at the bottom of the left column, at account level): choose Invite new users, paste the service account email (the .iam.gserviceaccount.com one), then under App permissions add your app and grant at least Manage store presence. That single app permission is enough to publish listing text and screenshots, you do not need account-level Admin.

Your app has to already exist in the Play Console. The listing API edits an existing package, it does not create a new app, and no APK or AAB needs to be uploaded yet. Make sure the package name you enter in Mokbi matches the app exactly.

The number one gotcha: Cloud IAM is not the Play Console

If you keep getting PERMISSION_DENIED, this is almost always why. Google Cloud IAM (the IAM & Admin → IAM page in the Cloud Console, where you assign "roles" to the service account) controls access to Google Cloud resources. It does nothing for access to your app's store listing. Assigning roles there will never fix a store permission error.

App access lives entirely in the Play Console, in the two places above: the API access link and the Users and permissions invite. Set those, and the same key that returned 403 starts working.

Apple: create an App Store Connect API key

This happens in App Store Connect (appstoreconnect.apple.com). Mokbi asks for three things: the .p8 contents, the Key ID, and the Issuer ID.

1. Go to Users and Access → Integrations → App Store Connect API. This section is only visible to your team's Account Holder or an Admin. If asked, allow team keys.
2. Click Generate API Key, name it (for example "Mokbi Publisher"), and give it the App Manager role.
3. Download the .p8 file. You can download it only once, so store it somewhere safe. Note the Key ID shown next to the key, and the Issuer ID, the UUID at the top of the Keys page.

As with Google, the app must already exist in App Store Connect. The API edits an existing listing and no build needs to be uploaded. Publishing with Mokbi stages the version for you and stops before the review submission, so you press Submit yourself in App Store Connect when you are ready.

Connect it in Mokbi

Open a project, go to the Publish step, and use the connect buttons:

• Connect Google Play: paste the full service account JSON, then Verify & connect. Enter your package name and run Test connection before publishing.
• Connect App Store Connect: open the .p8 file in a text editor and paste its contents, add the Key ID and Issuer ID, then Verify & connect.

Each key is verified with the store before anything is saved, stored encrypted in our vault, and removable at any time with Disconnect.

Common problems and how to fix them

"Service account key creation is disabled." An org policy is blocking JSON keys. Turn off iam.disableServiceAccountKeyCreation for the project (see Google Play part 1), wait two minutes, and retry.

PERMISSION_DENIED or 403 on every app. Access is not set in the Play Console. Confirm the Cloud project is linked under Setup → API access, and that the service account email is invited under Users and permissions with Manage store presence on your app. Roles in Cloud IAM do not count.

It still fails right after you grant access. Permission changes need a few minutes to propagate. Re-save the permission in the Play Console (open it and save again) or wait a little, then run Test connection once more. As a quick isolation test, granting the service account account-level Admin temporarily should make the dry run pass, if it does, the earlier failure was an app-scope or project-link issue.

Wrong app, or nothing happens. The package name in Mokbi must match the Play Console app exactly, and the app must already exist in both consoles. The listing API edits an existing app, it never creates one.

Lost your .p8 file. Apple only lets you download it once. If it is gone, revoke that key in App Store Connect and generate a fresh one, then reconnect in Mokbi.