ASO Skill CLI

Secure browser login and command-line access to the ASO Skill App Store data API.

For ChatGPT, Claude, and other cloud clients, use the hosted OAuth-protected MCP endpoint instead: https://api.asoskill.com/mcp. The CLI is the local companion for Agent Skills, terminals, servers, and automation. See the CLI guide and MCP guide.

The CLI does not ask you—or an AI agent—to copy an API key into .env. Before requesting a credential, it verifies that the selected credential store is writable. It then starts a ten-minute connection request, opens ASO Skill in your browser, and waits while you sign in and approve the exact permissions. The API returns the new key in an encrypted envelope that only this CLI can open. By default, the credential is saved in macOS Keychain, Windows Credential Manager, or the Linux Secret Service.

Install

Install the public npm package globally, then use aso-skill from any terminal:

npm install --global @aso-skill/cli
aso-skill login
aso-skill popularity "workout planner" --storefront US

Login requests data and credits access and creates a 90-day credential. Both choices are visible on the browser approval page. Checkout access is deliberately separate:

aso-skill login --allow-checkout

Use --expires-in 0 for no automatic expiration. On a trusted headless machine without an operating-system keyring, opt in to a local file protected with mode 0600:

aso-skill login --credential-store file --no-open

For CI, inject ASO_SKILL_API_KEY from the CI platform's secret manager. The environment value overrides local storage. The CLI never prints credentials from login, status, or logout.

Commands

aso-skill status
aso-skill search TERM [--storefront US] [--platform iphone]
aso-skill autocomplete TERM [--storefront US] [--platform iphone]
aso-skill popularity TERM [--storefront US]
aso-skill apps APP_ID... [--storefront US] [--platform iphone]
aso-skill credits
aso-skill packs
aso-skill checkout PACK_ID --confirm-checkout
aso-skill logout

Each successful search, autocomplete, popularity, or app lookup costs one ASO Skill credit. Autocomplete supports iphone, ipad, mac, appletv, watch, and vision and defaults to US iPhone. Checkout only creates a Polar payment URL; the account owner still completes payment in the browser.

Security model

• The client sends a SHA-256 challenge before browser approval and retains the verifier locally.
• The service stores only a hash of the device code.
• The API key is returned in an AES-256-GCM envelope derived from the verifier with HKDF-SHA-256.
• The encrypted retry envelope and authorization request expire after ten minutes.
• Permanent server records contain only the API-key hash and approved scopes.
• logout self-revokes the calling key and removes the local credential.

See the public OpenAPI contract for the complete API.