How do you authenticate to the App Store Server API, and what do you use it for?

Predict first

What does the JWT contain, and is its lifetime acceptable?

import Foundation
import CryptoKit

func b64url(_ d: Data) -> String {
    d.base64EncodedString().replacingOccurrences(of: "+", with: "-").replacingOccurrences(of: "/", with: "_").replacingOccurrences(of: "=", with: "")
}
func unb64url(_ s: String) -> Data {
    var t = s.replacingOccurrences(of: "-", with: "+").replacingOccurrences(of: "_", with: "/")
    while t.count % 4 != 0 { t += "=" }
    return Data(base64Encoded: t)!
}
func makeJWT(key: P256.Signing.PrivateKey, keyID: String, issuer: String, bundleID: String, now: Int) -> String {
    let h = try! JSONSerialization.data(withJSONObject: ["alg": "ES256", "kid": keyID, "typ": "JWT"], options: [.sortedKeys])
    let c = try! JSONSerialization.data(withJSONObject: ["iss": issuer, "iat": now, "exp": now + 1800, "aud": "appstoreconnect-v1", "bid": bundleID] as [String: Any], options: [.sortedKeys])
    let input = b64url(h) + "." + b64url(c)
    return input + "." + b64url(try! key.signature(for: Data(input.utf8)).rawRepresentation)
}
let key = P256.Signing.PrivateKey()
let jwt = makeJWT(key: key, keyID: "ABC123DEFG", issuer: "69a6de70-0000-0000-0000-000000000000", bundleID: "com.example.app", now: 1_800_000_000)
let p = jwt.split(separator: ".").map(String.init)
print(String(data: unb64url(p[0]), encoding: .utf8)!)
print(String(data: unb64url(p[1]), encoding: .utf8)!)
let ok = key.publicKey.isValidSignature(try! P256.Signing.ECDSASignature(rawRepresentation: unb64url(p[2])), for: Data((p[0] + "." + p[1]).utf8))
print("signature valid:", ok)
let claims = try! JSONSerialization.jsonObject(with: unb64url(p[1])) as! [String: Any]
print("lifetime minutes:", ((claims["exp"] as! Int) - (claims["iat"] as! Int)) / 60, "(must be at most 60)")
let tid = "2000000123456789"
for (env, host) in [("production", "api.storekit.itunes.apple.com"), ("sandbox", "api.storekit-sandbox.itunes.apple.com")] {
    print(env, URL(string: "https://\(host)/inApps/v1/history/\(tid)")!.absoluteString)
}

• header kid ABC123DEFG, claims with aud appstoreconnect-v1, valid signature, 30 minutes
• the lifetime is 90 minutes
• the signature does not verify