# Giving an outside developer access to App Store Connect and Google Play Console

Invite the developer by their own email with a limited role. Keep the Apple Account Holder and the Play Console owner inside your company.

Updated: November 10, 2026

When a studio or freelancer builds your app, they have to upload builds and look after the store listing. Neither store needs you to share the main login for that. App Store Connect and Google Play Console both invite people by their own email address, with a role you choose. The role your company must keep is the one at the top: the Account Holder at Apple and the account owner at Google.

## The role your company keeps

On the Apple side, one person holds the Account Holder role. Apple reserves four things for that person: accepting legal agreements, renewing the membership, creating Developer ID certificates and approving banking changes.

On the Google side, the account owner is the one person tied to the money. Play Console Help reserves two things for the owner: linking a payments profile so you can sell paid apps, and working on the Payments profile page.

So whoever holds these two roles controls the contract with the store and where the money goes. If a studio registers the accounts for you under its own name, the studio holds both. Register them yourself, in the name of someone at your company who has the authority to sign for it.

When that person changes, hand the role over, and do it before they leave. At Apple, only the current Account Holder can start the transfer. The new holder has to be a team member with the legal authority to sign for your organization. For an individual membership, Apple allows a transfer only in narrow cases, such as the Account Holder's death, and only through Apple Developer Support.

In Play Console, too, only the current owner can start the transfer, and the new owner has to be an existing user. Play then puts the change on hold for seven days, during which anyone with access to the account can call it off. Not every account qualifies. Play Console Help says personal accounts that earn money from their apps aren't eligible, and have to open a new account and move the apps to it. If the owner is already out of reach, the self-serve transfer won't work, and you have to contact Google's support team.

## App Store Connect: invite with a role and chosen apps

In App Store Connect, an Account Holder, Admin or App Manager opens Users and Access and, under People, selects the plus button. Enter the person's name and email address, choose one or more roles, and select Invite. The person has three days to accept before the invitation lapses, and you can send it again.

The developer signs in with their own Apple Account. If their email address isn't tied to one yet, they create one when they accept. That account needs two-factor authentication or two-step verification turned on before it can sign in to App Store Connect. With one account per person, the codes go to each person's own device and nobody has to pass them along.

The roles differ in whether you can limit them to certain apps.

| Role | Can be limited to chosen apps |
| --- | --- |
| Admin | No. Sees all app information |
| Finance | No. Sees all app information |
| App Manager | Yes |
| Developer | Yes |
| Marketing | Yes |
| Sales | Yes |
| Customer Support | Yes |

For a studio that builds one of your apps, start with Developer limited to that app. In Apple's role list, Developer covers building and delivering the app, while App Manager adds pricing and the App Store information and can also add users. Use App Manager only if the studio does that work too. Two additions remove the limit: access to reports, and access to Certificates, Identifiers & Profiles (the signing files an app needs). Apple says a user with either one sees every app's information. Give those only when the work needs them.

How you enrolled matters too. An individual membership stops at 50 extra users, who get App Store Connect and nothing else from the program. An organization has no cap on team members, and each one gets the program's other resources. Users invited to an individual membership can't open Certificates, Identifiers & Profiles, so if the studio has to manage signing, enroll as an organization rather than share your login. Giving the studio that access also lets it see all your apps, not only the one it builds.

## Google Play Console: account access or app access

A Play Console account owner or admin adds users. Open Users and permissions, choose Invite new users, and type in the developer's email address. Use the address the developer will sign in with, because Play Console accepts only that address for the invited person.

Then decide between two levels.

- Account permissions cover all the apps in the account.
- App permissions cover the apps you pick.

For a studio working on one app, grant app permissions for that app and leave account permissions off. Don't turn on "Make this user an account admin" for an outside developer. That switch opens every resource in the account and lets the person manage all other users' permissions.

Play Console has one feature that fits contract work well. When you invite a user, you can select "Set access expiry date." Set it to the end of the contract and extend it if the work runs over. Without a date, Play Console Help says, the access never runs out. An invitation nobody accepts lapses after 30 days and has to be sent again.

## Removing the developer when the work ends

In App Store Connect, an Account Holder or Admin opens Users and Access, picks the person under People, and deletes them. Allow up to 10 minutes after that, because Apple warns that cached access can linger that long.

In Play Console, the account owner or an admin opens Users and permissions and removes the user from their User details page. If you set an expiry date, access also ends on that date without anyone acting. Who does the removing matters. An admin limited to certain apps can't remove a user who has account-wide access. An account-wide admin also gets the Activity log, Play Console's record of changes. Read it after the studio leaves.

Deleting the user ends their sign-in. In App Store Connect, also revoke any API team keys made for the studio's build tools, under Users and Access. If the studio created signing certificates or keys in your Apple developer account, revoke those separately. Apple Developer Help has a page for each, and both actions need the Account Holder or an Admin. Check what depends on them first. Apple says a revoked key stops working for every service that uses it, and that signing profiles built on a revoked certificate stop being valid.

Removing the user also doesn't change the other accounts the studio used to build and run the app. Go through those with the [checklist for taking back access when a vendor contract ends](/guides/outsourcing-access/access-recovery-at-contract-end).

## If the app lives in the studio's account

Sometimes the studio published the app under its own developer account, and you find out when the relationship ends. Both stores have a way to move an app, and both need the studio's cooperation, because the request starts from the account that holds the app.

Play Console Help lays out what a transfer carries. The audience comes with the app: its users, ratings and reviews, download statistics, content ratings and store listing arrive in your account. Some things don't come across. Bulk export, payout and earnings reports stay behind, so get copies from the studio before the transfer starts. Test groups have to be rebuilt, and links to services such as Firebase have to be set up again. On your side, you need a registered, active developer account, and a new one carries a $25 registration fee. For a paid app, or one with in-app products, you also need an active payments profile. Your account's owner approves the request. If the studio kept the app's upload key, the owner can also request a new one.

App Store Connect has its own app transfer, for apps that meet Apple's transfer criteria. An app with no release on the App Store yet doesn't qualify. The Account Holder of the account that holds the app starts it, using your Account Holder's Apple Account and your team's Team ID. Your Account Holder has 60 days to accept. After that, allow up to two business days for the app to move. When it's done, you have to create new signing profiles for the app in your own developer account.

Start the transfer while the contract is still running. Better still, put the rule in the contract before work begins: the app is published under your accounts, and the studio works as an invited user. [What your vendor contract should say about accounts](/guides/outsourcing-access/contract-clauses-for-accounts) covers what to write.


## Frequently asked questions

**Should we give our app developer the Apple ID and password?**

No. An Account Holder, Admin or App Manager can invite the developer by email in App Store Connect, and the developer signs in with their own Apple Account. The Account Holder's login stays with your company.

**Which App Store Connect role does an outside developer need?**

Start with Developer, limited to the one app the studio works on. Apple lets you limit five roles to chosen apps (App Manager, Developer, Marketing, Sales, Customer Support) but not Admin or Finance, so keep those two for your own staff.

**Can we set a Play Console user to expire automatically?**

Yes. When you invite the user, select "Set access expiry date" and pick the day the contract ends. Without a date, Play Console Help says, the access never runs out.

**How fast does removing a user take effect in App Store Connect?**

Give it up to 10 minutes. Apple says caching can keep access open that long after you delete the user.

**The studio published our app under its own Play account. Can we move it?**

Yes. Play Console has a transfer process between developer accounts. The app arrives with its users, ratings and reviews, download statistics and store listing. Earnings and payout reports don't, so get copies from the studio first.

## Sources

- [Apple Developer Help: Roles and access](https://developer.apple.com/help/account/access/roles/)
- [App Store Connect Help: Overview of accounts and roles](https://developer.apple.com/help/app-store-connect/manage-your-team/overview-of-accounts-and-roles/)
- [App Store Connect Help: Add and edit users](https://developer.apple.com/help/app-store-connect/manage-your-team/add-and-edit-users/)
- [Apple Developer Help: Invite team members](https://developer.apple.com/help/account/access/invite-team-members/)
- [App Store Connect Help: App Store Connect API](https://developer.apple.com/help/app-store-connect/get-started/app-store-connect-api/)
- [App Store Connect Help: Role permissions](https://developer.apple.com/help/app-store-connect/reference/account-management/role-permissions)
- [Apple Developer Help: Transfer the Account Holder role](https://developer.apple.com/help/account/access/transfer-the-account-holder-role)
- [Apple Developer Help: Revoke a certificate](https://developer.apple.com/help/account/certificates/revoke-a-certificate/)
- [Apple Developer Help: Revoke, edit, and download keys](https://developer.apple.com/help/account/keys/revoke-edit-and-download-keys/)
- [App Store Connect Help: Initiate an app transfer](https://developer.apple.com/help/app-store-connect/transfer-an-app/initiate-an-app-transfer/)
- [App Store Connect Help: App transfer criteria](https://developer.apple.com/help/app-store-connect/transfer-an-app/app-transfer-criteria/)
- [App Store Connect Help: Accept an app transfer](https://developer.apple.com/help/app-store-connect/transfer-an-app/accept-an-app-transfer/)
- [Play Console Help: Add developer account users and manage permissions](https://support.google.com/googleplay/android-developer/answer/9844686?hl=en)
- [Play Console Help: Transferring ownership of a Play Console developer account](https://support.google.com/googleplay/android-developer/answer/16909862?hl=en)
- [Play Console Help: Transfer apps to a different developer account](https://support.google.com/googleplay/android-developer/answer/6230247?hl=en)

## How Junify handles this

**Doing this by hand** You keep a list of which vendor staff use which of your accounts, shut off access every time a contract ends or a person changes, and keep checking how the vendor uses them.

**With Junify** Apple and Google invite each developer by their own email address, so use that. Junify is for the other web accounts the studio needs where the service gives your company only one login. Your admin adds that login to Junify. The studio's people verify on their own phone and sign in without seeing the password, and each use is recorded by person. When the project ends, your admin removes them from that login.

Junify is an access management service for handing work in your web accounts to employees, contractors and outside teams without giving them the password. Each person verifies on their own phone and clicks a card to sign in. The password is never shown, and Junify records who used which account and when.

- [Try the demo](https://www.junify.com/bpo/try?lang=en&scenario=bpo&from=guide&cluster=outsourcing-access&slug=app-store-connect-google-play-developer-access)
- [Book a 30-minute demo](https://www.junify.com/bpo/demo)

## More on this topic

- [Giving an accountant or bookkeeper access to QuickBooks Online without sharing your login](/guides/outsourcing-access/quickbooks-online-accountant-bookkeeper-access): Invite an outside accounting firm from the Accountants tab, or add a bookkeeper as a user with a role. Keep the primary admin role with the business owner.
- [Giving a developer or agency access to your WordPress site](/guides/outsourcing-access/wordpress-developer-agency-access): Give each outside person their own WordPress user. A writer needs no more than the Editor role. Work on plugins, themes or code takes Administrator.
- [Checklist for taking back access when a vendor contract ends](/guides/outsourcing-access/access-recovery-at-contract-end): Work in this order. List the vendor's accounts, disable its users, change shared passwords, check the login records, and get written confirmation of deletion.