When you connect Lance, the recommended path asks you to sign in with your Apple Account instead of pasting an API key. Why does an App Store tool need your login? Because Apple's App Store Connect API doesn't cover everything, and the missing parts are the ones that block new apps.
Day to day, Lance runs on an API key
Most of Lance's work (listings, screenshots, TestFlight, in-app purchases, review submission) goes through an official App Store Connect API key, the same .p8 team key any CI system uses. Signing in lets Lance create that key for you. Your password is used once, directly against Apple's sign-in, and never stored; you approve the session with your own two-factor code.
What the API key alone can't do
Some steps only exist on the App Store Connect website. No API key of any role can reach them.
Creating the app record. The API can read and update apps but not create them. Apple returns "The resource 'apps' does not allow 'CREATE'." Every new app starts with someone clicking through the New App form, or a signed-in session doing it for you.
App Privacy details. The privacy "nutrition labels" every app must complete before submission have no public API.
App Review's rejection messages. When your app is rejected, the explanation and the back-and-forth with the review team live in a message thread inside App Store Connect. Reading a rejection and replying requires a signed-in session. (Customer reviews from users are different; the API covers those.)
The updated age rating questionnaire. Apple's expanded age rating system added required questions, answered in the App Information section of the website. Skip them and you can't submit updates.
Agreements, tax, and banking. Accepting the Paid Apps agreement and filling out tax and banking forms happens on the website only. This is the step that blocks paid apps and in-app purchases most often.
The API key itself. There is no API for creating API keys. Someone has to sign in to mint one, which is exactly what the sign-in does.
What signing in gets you
Lance can do all of the above for you: create the app, fill out App Privacy, respond to App Review, answer the age rating questions, and mint the team API key it uses for everything else. Your password is never stored, the two-factor code stays on your device, and you can revoke the session or the key at any time, from Lance or from Apple's side.
Prefer to paste a key yourself?
That works too. Create a key in App Store Connect under Users and Access → Integrations, then add it in Settings → App Store Connect → Manual. Lance validates it with Apple and stores the private key encrypted. The website-only steps above stay yours to do by hand.