# Apps and keys

> An app is one iOS bundle id with its own App ID. Which key goes in the app, which stays on your server, and how an agent signs in.

URL: https://docs.xulo.io/concepts/apps-and-keys

## Organizations and apps

An organization holds your apps. Each app is one iOS bundle id, and each app is billed on its own: its first 1,000 monthly active users are free, and apps do not pool.

When you create an app, Xulo gives it an **App ID**. The App ID is a UUID and it never changes.

The bundle id is unique inside your account, so the same account cannot open a second app with the same bundle id. Another account can use that bundle id. If you typed the bundle id wrong, you can correct it. The App ID stays the same.

## Which key goes where

| Key | Where it lives | What it can do |
| --- | --- | --- |
| App ID | In the app, passed to `Xulo.start` | Register an install, record opens, sessions and purchases, and ask for an in-app card. It cannot send. It is not a secret. |
| REST API key | On your server only | Send a push to one app and read its counts. |
| Agent sign-in | In your agent tool | Draft and send for the apps in your organization. |

Both the App ID and the REST API key are in **Settings → Keys & IDs**.

The phone never carries a secret. The App ID in your app cannot send a push, so it is safe to ship inside the binary.

## REST API keys

A REST API key belongs to one app and starts with `xulo_`. The dashboard shows it once, when you create it. Store it on your server, for example in an environment variable.

- A key opens only its own app. Naming another app's App ID returns 404.
- You can lock a key to IP addresses or ranges. A call from anywhere else returns 403.
- A revoked key returns 401.

See [Authentication](https://docs.xulo.io/api/authentication).

## Agent sign-in

An agent connects to `https://mcp.xulo.io/mcp`. The tool opens a sign-in screen, you sign in with your dashboard account and allow it, and the tool comes back connected. There is no key to copy. The connection acts for the organization of the person who signed in. The setup prompt is at [xulo.io/mcp](https://xulo.io/mcp).

## Apple credentials

Each app sends through its own Apple credentials.

- A `.p8` auth key belongs to an Apple developer account. Upload it once with a name, then choose it on every app from that account.
- A `.p12` certificate stays on the one app it was uploaded to.

See [APNs setup](https://docs.xulo.io/ios/apns-setup).