Apple Music API: tokens, endpoints and a working request

November 9, 2026

The Apple Music API gives you albums, songs, artists, playlists, music videos, stations, charts, search and, with the user's permission, their library, ratings and listening history source. This guide covers how the pieces fit, with a token script and requests you can run. For what it costs and the free iTunes Search API, see is the Apple Music API free.

How the Apple Music API works

On iOS, macOS, tvOS and watchOS you can skip the key and JWT: enable the MusicKit App Service on your App ID and MusicKit generates the developer token for you source. MusicKit also manages the Music User Token on Apple platforms and the web. On Android you fetch the user token yourself.

Step 1: create the key

1. In Certificates, Identifiers and Profiles, add a Media ID with a reverse-domain string. Its description is the app name users see when you ask for Apple Music access.
2. Create a private key with the media services enabled and download the .p8 file.
3. Note the 10-character key ID (kid) and your 10-character Team ID, shown under Membership.

If a key leaks, Apple's advice is to create a new key, move to it, then revoke the old one source.

Step 2: sign a developer token

Apple's token guide sets the rules: header alg must be ES256 with your kid; claims are iss (Team ID), iat and exp, and exp may be no more than 15,777,000 seconds (6 months) ahead. Any other algorithm gets a 401. For browser use, Apple recommends an origin claim listing the sites allowed to use the token.

# pip install pyjwt cryptography requests
import time, jwt, requests

TEAM_ID = "ABCDE12345"   # Membership page
KEY_ID = "XYZ9876543"    # from the key you created
key = open("AuthKey_XYZ9876543.p8").read()

now = int(time.time())
token = jwt.encode(
    {"iss": TEAM_ID, "iat": now, "exp": now + 12 * 3600},  # max 15777000 seconds
    key, algorithm="ES256", headers={"kid": KEY_ID},
)

r = requests.get(
    "https://api.music.apple.com/v1/catalog/us/search",
    params={"term": "beach bunny", "types": "songs,artists", "limit": 10},
    headers={"Authorization": "Bearer " + token},
)
for song in r.json()["results"].get("songs", {}).get("data", []):
    a = song["attributes"]
    print(song["id"], a["name"], a["artistName"], a.get("isrc"))

Keep the token on your server, or give web clients a short-lived one with an origin claim. Six months is a ceiling, not a target.

Step 3: catalog vs library endpoints

Every path starts with https://api.music.apple.com/v1, then /catalog/{storefront} for the public catalog or /me for the user source.

Things that trip people up:

• Storefront is required for catalog calls. It is a two-letter country code, and content differs by country. Add l=es-MX to localize, if the storefront supports that language source.
• Library IDs are not catalog IDs. A song removed and re-added to a library gets a new ID.
• Search returns 5 per type by default, 25 at most, with offset for more source. Allowed types include songs, albums, artists, playlists, music videos, stations, curators and record labels.
• One ISRC can return more than one song, for example a single and the album version source.
• Paging uses limit and a next path in the response. Keep requesting until next is gone source.

Errors and rate limits

Apple does not publish the request limit. It limits requests per developer token over a period of time source. Build retries with backoff from day one.

Checklist before you ship

1. Membership active and key stored outside your repo.
2. Token signer on the server, with exp well under 6 months and an origin claim for web.
3. Storefront taken from the user, not hard-coded to us.
4. Catalog and library IDs stored in separate columns.
5. Backoff on 429 and a re-auth path on 403.
6. Read the MusicKit agreements and guidelines linked from Apple's MusicKit page before you launch.

Doing it with ScrapeIO

If you need public catalog data and no user features, ScrapeIO skips the key and JWT: the Apple Music search API, Apple Music track API, Apple Music album API and Apple Music artist API take an ID or URL and cost 1 credit each, with one API key. Agents can call them through the Apple Music MCP server.

FAQ

Is there an official Apple Music API?

Yes. Apple documents it at developer.apple.com, with catalog, library, charts, search and recommendation endpoints. Access needs an Apple Developer Program membership.

How long does an Apple Music developer token last?

You choose, up to 15,777,000 seconds, about 6 months, from when it is issued.

What is the difference between a developer token and a music user token?

The developer token proves who you are and goes on every request. The Music User Token identifies a signed-in Apple Music subscriber and is needed only for their library and personal data.

What is the Apple Music API rate limit?

Apple doesn't publish a number. Over the limit, requests on that token get 429 until the rate drops.

Sources

Checked on 9 November 2026 from each vendor's own pages. Prices and limits change; follow the links before you decide.

• https://developer.apple.com/documentation/applemusicapi
• https://developer.apple.com/documentation/applemusicapi/generating-developer-tokens
• https://developer.apple.com/documentation/applemusicapi/user-authentication-for-musickit
• https://developer.apple.com/documentation/applemusicapi/handling-requests-and-responses
• https://developer.apple.com/documentation/applemusicapi/search-for-catalog-resources-(by-type)
• https://developer.apple.com/documentation/applemusicapi/get-multiple-catalog-songs-by-isrc
• https://developer.apple.com/documentation/applemusicapi/fetching-resources-by-page
• https://developer.apple.com/documentation/applemusicapi/storefronts-and-localization
• https://developer.apple.com/help/account/configure-app-capabilities/create-a-media-identifier-and-private-key/
• https://developer.apple.com/documentation/musickit/using-automatic-token-generation-for-apple-music-api
• https://developer.apple.com/musickit/
• https://developer.apple.com/programs/whats-included/