Skip to main content

I lost my .p8 file — how to recover

Patrick Hill
Updated

Short answer: You cannot get the same .p8 back. Apple does not store a copy. The only path forward is to revoke the old key in Apple Podcasters Connect (PCC), generate a new one, and re-upload that new .p8 to Disctopia.

This article walks through exactly how to do that, plus what to expect afterwards.

Why can't I just re-download it?

Apple's .p8/.pem keys are designed so that only you ever hold the private half. When you generate a key in PCC, Apple keeps the public half on their servers, hands you the private half (the .pem file) as a one-time download, and then forgets the private half exists. There is no "resend" button on Apple's side — not because Apple is being difficult, but because the security model depends on the file never being re-transmissible.

This is the same model Apple uses for their developer API keys, push notification keys, and Apple Music API keys. If you've used any other Apple API before, the recovery path here will feel familiar.

The recovery flow

Step 1 — Revoke the old key in PCC

This makes the lost .pem permanently unusable (in case it's sitting on a wiped laptop in a drawer somewhere). It also lets you reuse the same key slot if you have Apple's per-account key limit.

  1. Sign in to Apple Podcasters Connect.
  2. Click Account in the top navigation, then open the API Keys tab.
  3. Find the row for the key you were using with Disctopia. You can identify it by the Key ID that's currently on file in Disctopia (visible in Apps → Apple Podcasts in the app).
  4. Click Edit in the top-right of the Active list, then click the trash/revoke icon on that row and confirm.

Apple Podcasts Connect Account page open on the API Keys tab. Shows the Issuer ID at the top, an Edit button on the top-right of the Active keys table, and one existing key row you would target for revocation.

Apple immediately marks the key as revoked. Any further API calls signed with the lost .pem will fail.

💡 If you can't tell which key was the Disctopia one, you can safely revoke all of them and start fresh — Apple lets you generate a new key in the next step. Only revoke keys for other integrations (transcript service, analytics tools, etc.) if you're prepared to reconnect those too.

Step 2 — Generate a new key in PCC

  1. Still on the Account → API Keys page, click the purple + next to Active (or Generate API Key).
  2. Give it a meaningful name like Disctopia (regenerated YYYY-MM-DD).
  3. Pick Show Manager access (or higher).
  4. Apple downloads a new {IssuerID}_{NewKeyID}.pem file to your computer. Instantly. No save dialog. Look in your Downloads folder immediately.

⚠️ Do not skip this: save the new file somewhere durable right now, before you do anything else. Common safe homes:

  • A password manager (1Password, Bitwarden, Dashlane) as a secure file attachment
  • An encrypted volume on an external drive
  • A locked folder in iCloud Drive, OneDrive, or Google Drive

Do not email it to yourself or paste it into Slack/Notion/Discord.

  1. Note the new Key ID (10-12 characters, in the KEY ID column) — you'll need it in a moment.

Step 3 — Reconnect Apple Podcasts on Disctopia

  1. Sign in to Disctopia.
  2. Open Apps → Apple Podcasts.
  3. You'll see your current connection status. Click Reconnect (or Update credentials).
  4. Paste in:
    • Your Issuer ID (this didn't change — it's the same as before, since it's tied to your Apple account not the key)
    • The new Key ID from Step 2
    • The new .pem file from Step 2
  5. Click Verify & Connect.

Disctopia verifies the new credentials against Apple, replaces the encrypted .pem in our Key Vault, and updates the Key ID on file. You're back in business.

What stays the same after a key regeneration

Almost everything:

  • ✅ Your shows on Apple Podcasts stay where they are. Apple identifies them by show ID, not by your API key.
  • ✅ Listeners' subscriptions, ratings, and reviews are untouched.
  • ✅ Premium subscribers on the Apple Podcasters Program stay subscribed and keep paying.
  • ✅ Already-delivered premium episodes stay delivered.
  • ✅ Apple Podcast Video staging in progress continues normally as soon as the new key is in place.

The only thing that changes is the key Disctopia uses to sign requests to Apple. Nothing about your content, subscribers, or settings is affected.

What if I'm waiting on something Apple-bound?

If a premium episode delivery or video stage was in flight when the old key stopped working, you'll see those episodes in My Library with status Auth failed — credentials needed. Once you complete Step 3 above, Disctopia automatically retries the queued operations within a few minutes.

You don't need to manually re-upload anything.

Preventing this next time

When you generate the new key, take 60 seconds to:

  1. Save the .pem to your password manager immediately. Don't leave it sitting in ~/Downloads/.
  2. Note the Key ID alongside it so you can identify the row in PCC later if you need to revoke.
  3. Tag the entry with the date you generated it. Apple's keys don't expire on their own, but knowing how old a key is helps with annual rotation hygiene.

If you work with a team, treat the .pem like a database root password — it should be in a shared secrets vault that your finance/ops team can also access, not just on one person's laptop.

Related articles

Related articles