Connect Apple Business

Agent markdown

Before you start

Apple Business uses customer client credentials (oauth2_client_credentials + customer_credentials). There is no Init platform OAuth app for this provider.

Connection admin/user creates an Apple Business API account, downloads the private key, and submits the Business API client ID, key ID, and PKCS#8 PEM through Init Connect.

You need:

• An Apple Business user with the Organisation Administrator role (required to create API accounts).
• Secure storage for the downloaded private key (shown/downloadable only at creation).
• Access to Init Connect for the tenant that will own the connection.

Configure the provider

Create an Apple Business API account (Connection admin/user)

1. Sign in to Apple Business as an Organisation Administrator.
2. Open Settings → API and add an API account.
3. Generate and download the private key when prompted. Store it in a secret manager; Apple does not re-download the same key later.
4. Open the API account details and copy the Client ID (Business API client id, often prefixed like BUSINESSAPI.) and the Key ID.
5. Confirm the private key material is PKCS#8 PEM suitable for Init (see Connect fields below). Convert wrapped/encrypted downloads to an unencrypted PKCS#8 PEM before submission if your download is not already in that form.

There is no one-time Init platform Apple client registration.

Connect to Init

Connection admin/user starts an Apple Business Connect session and submits only these contract fields:

private_key_pem must be PKCS#8: the value must include the standard header line that begins with BEGIN PRIVATE KEY and the matching footer line that begins with END PRIVATE KEY. Do not submit traditional EC PRIVATE KEY or RSA PRIVATE KEY formats. Never paste a real private key into tickets or documentation.

Safe documentation placeholder only: [REDACTED]. Do not include a full PEM example in public content.

Init signs an ES256 client assertion and exchanges it at Apple’s token endpoint for a business.api access token.

Permissions

Apple Business API account role and organization membership control which org devices, users, groups, apps, and audit resources Init can read. Match the API account role to least privilege for the generated actions.

There is no separate OAuth scope picker in Connect beyond the Business API credential set; capability labels on the generated matrix describe Init’s action requirements.

Verify the connection

1. Complete Connect and confirm the connection is active.
2. Run Init’s connection test or a safe read such as listing organization devices.
3. Success looks like Apple Business API returning org data without token or assertion failures.

Rotate or revoke access

1. In Apple Business, revoke the existing private key and generate a replacement for the API account (or create a new API account).
2. Reconnect in Init with the new key_id and private_key_pem (and updated client_id if you created a new API account).
3. Confirm the old key is revoked in Apple Business after cutover.

If a private key is exposed, revoke it immediately in Apple Business, then reconnect with a replacement.

Troubleshooting