DEV Community: Ernist Isabekov

Apple's public App Store reviews feed in 2026: what still works, and a fix for empty results

Ernist Isabekov — Mon, 05 Oct 2026 08:15:27 +0000

I wanted a free tool that answers one question about any iOS app: is the latest release rated worse than the ones before it? No sign-up, no App Store Connect key, just paste a link.

That means using Apple's public data. There are two endpoints, both old, both undocumented in 2026, and one of them is much flakier than it looks. Here's what I learned building it.

1. The lookup API: solid

https://itunes.apple.com/lookup?id=284882215&country=us

This one is reliable. You get the app's name, developer, icon, current version, currentVersionReleaseDate, averageUserRating and userRatingCount. You can pass up to about 100 comma-separated ids in one request, which is handy for scanning charts.

Two gotchas:

It's per country. An app that isn't sold in the US store returns resultCount: 0 with the default country.
Don't count on averageUserRatingForCurrentVersion. In my test it was identical to the all-time average, so it didn't help compare versions.

Want all apps by a developer? Look up their artistId with entity=software:

https://itunes.apple.com/lookup?id=<artistId>&entity=software&limit=200

The first result is the developer; the rest are their apps.

2. The customer reviews RSS feed: works, but flaky

https://itunes.apple.com/us/rss/customerreviews/page=1/id=284882215/sortby=mostrecent/json

Each entry has im:rating, title, content, updated and, importantly, im:version, the app version the review was written for. That's exactly what you need to compare releases.

The limits:

50 reviews per page, and in my tests page 2 was always empty. So in practice you get the 50 most recent reviews for one country.
No developer replies. You can't tell which reviews were answered.
One country per request. The US feed only has US reviews.

The flaky part

For many apps, the feed returns a perfectly valid response with no entry at all. Instagram, WhatsApp and Facebook all came back empty for me at various times, while other apps worked fine, and the same app could work one hour and be empty the next.

Then I noticed something odd. These URLs should mean the same thing:

/us/rss/customerreviews/page=1/id=<id>/sortby=mostrecent/json
/us/rss/customerreviews/id=<id>/sortby=mostrecent/json
/us/rss/customerreviews/id=<id>/sortBy=mostRecent/json
/us/rss/customerreviews/id=<id>/json

They don't return the same thing. For Duolingo, only the first spelling returned reviews (50 of them); for WhatsApp, only the third one did. My best guess is that each spelling is cached separately on Apple's side, and any one cache can be empty.

The fix: ask all of them at once

So I request every spelling in parallel and keep the first one that has reviews:

interface FeedEntry {
  "im:rating"?: { label: string };
  "im:version"?: { label: string };
  title?: { label: string };
  content?: { label: string };
  updated?: { label: string };
}

interface PublicReview {
  rating: number;
  title: string;
  body: string;
  version: string | null;
  date: string;
}

async function feedPage(country: string, path: string): Promise<PublicReview[]> {
  try {
    const res = await fetch(`https://itunes.apple.com/${country}/rss/customerreviews/${path}`, {
      signal: AbortSignal.timeout(10_000),
    });
    if (!res.ok) return [];
    const data = (await res.json()) as { feed?: { entry?: FeedEntry | FeedEntry[] } };
    const raw = data.feed?.entry;
    // A single review comes back as an object, not an array.
    const entries = Array.isArray(raw) ? raw : raw ? [raw] : [];
    return entries
      .filter((e) => e["im:rating"]) // old feeds put the app itself in the first entry
      .map((e) => ({
        rating: Number(e["im:rating"]!.label),
        title: e.title?.label ?? "",
        body: e.content?.label ?? "",
        version: e["im:version"]?.label || null,
        date: e.updated?.label ?? "",
      }));
  } catch {
    return [];
  }
}

export async function recentReviews(id: string, country = "us"): Promise<PublicReview[]> {
  const paths = [
    `page=1/id=${id}/sortby=mostrecent/json`,
    `id=${id}/sortby=mostrecent/json`,
    `id=${id}/sortBy=mostRecent/json`,
    `id=${id}/json`,
  ];
  const results = await Promise.all(paths.map((p) => feedPage(country, p)));
  return results.find((r) => r.length > 0) ?? [];
}

It isn't perfect. Some apps still come back empty, and then the honest thing is to say so rather than guess. But in my tests it turned "usually empty" into "usually works".

Don't fall back to "most helpful"

There's also sortby=mosthelpful, and it's tempting to use it when the recent feed is empty. I tried that as a baseline ("earlier versions") and it was a mistake: most-helpful reviews are much more positive than recent ones, so every app's latest release looked broken next to them. Only compare versions within the same sample.

3. Comparing the latest version with earlier ones

With im:version on each review, the comparison is simple. Take the newest version that has reviews, average its ratings, and compare with every other version in the same sample:

function stats(reviews: PublicReview[]) {
  const n = reviews.length;
  const avg = reviews.reduce((s, r) => s + r.rating, 0) / n;
  const lowShare = reviews.filter((r) => r.rating <= 2).length / n;
  return { n, avg, lowShare };
}

function verdict(latest: ReturnType<typeof stats>, previous: ReturnType<typeof stats>) {
  if (latest.n < 5 || previous.n < 5) return "not enough reviews";
  const drop = previous.avg - latest.avg;
  const moreLow = latest.lowShare - previous.lowShare;
  if (drop >= 0.8 || (moreLow >= 0.25 && latest.lowShare >= 0.4)) return "looks broken";
  if (drop >= 0.4 || moreLow >= 0.12) return "worth a look";
  return "looks healthy";
}

One thing that surprised me: for big apps, all 50 recent reviews are often for the latest version, so there's nothing earlier to compare with. That's not a bug in your code; the feed just doesn't go back far enough. Smaller apps, which get fewer reviews, usually span several versions, and that's where this works best.

Takeaways

The lookup API is reliable: use it for app details and developer catalogs.
The reviews feed gives you the latest 50 reviews per country with versions, but no replies, and it's often empty.
Request several URL spellings in parallel and take the first non-empty result.
Compare versions within one sample, never against "most helpful" reviews.
For full history, every country and replies, you still need the official App Store Connect API with a key (I wrote about that here).

I built all this into a free tool: paste any App Store link and it compares the latest version with earlier ones and groups what people complain about. It's at starquill.app/tools/app-release-check. If you find an app where the feed misbehaves in a new way, I'd love to hear about it in the comments.

How to read (and reply to) App Store and Google Play reviews with their APIs

Ernist Isabekov — Sat, 03 Oct 2026 16:57:18 +0000

A practical TypeScript guide to the App Store Connect and Google Play review APIs, with the gotchas I hit along the way.

tags: ios, android, typescript, tutorial

I make small iOS and Android apps, and for a long time I read reviews the slow way: open App Store Connect, scroll, open Play Console, scroll. I missed a lot. A 1★ crash report I found two weeks late. A review in Russian I skipped because I couldn't read it quickly.

So I started pulling reviews through the official APIs instead. Both stores have one, both are free, and both have a few surprises. Here's everything you need, in TypeScript, plus the gotchas that cost me time.

App Store Connect

1. Create an API key

In App Store Connect → Users and Access → Integrations → App Store Connect API, create a team key. For reviews, the Customer Support role is enough: it can read reviews and reply, nothing else.

You get three things:

Issuer ID (a UUID at the top of the page)
Key ID (10 characters)
a .p8 file, which you can download only once, so keep it safe

2. Sign a JWT

Apple wants a short-lived ES256 JWT on every request. I use jose:

import { importPKCS8, SignJWT } from "jose";

async function appStoreToken(issuerId: string, keyId: string, p8: string) {
  const key = await importPKCS8(p8, "ES256");
  const now = Math.floor(Date.now() / 1000);
  return new SignJWT({})
    .setProtectedHeader({ alg: "ES256", kid: keyId, typ: "JWT" })
    .setIssuer(issuerId)
    .setIssuedAt(now)
    .setExpirationTime(now + 15 * 60) // Apple allows 20 minutes max
    .setAudience("appstoreconnect-v1")
    .sign(key);
}

Reuse the token until it's about to expire. Signing one per request works, but it's wasteful.

3. Fetch reviews

You need the app's numeric Apple ID (it's in the App Store URL, e.g. id1234567890).

const API = "https://api.appstoreconnect.apple.com";

async function appStoreReviews(appId: string, token: string) {
  const params = new URLSearchParams({
    sort: "-createdDate",
    limit: "200",
    include: "response", // also return your existing replies
  });
  let url: string | undefined = `${API}/v1/apps/${appId}/customerReviews?${params}`;
  const reviews = [];
  while (url) {
    const res: Response = await fetch(url, { headers: { Authorization: `Bearer ${token}` } });
    if (!res.ok) throw new Error(`App Store Connect: ${res.status} ${await res.text()}`);
    const page: { data: any[]; links?: { next?: string } } = await res.json();
    for (const r of page.data) {
      const { rating, title, body, reviewerNickname, createdDate, territory } = r.attributes;
      reviews.push({ id: r.id, rating, title, body, author: reviewerNickname, date: createdDate, territory });
    }
    url = page.links?.next; // follow pagination
  }
  return reviews;
}

territory is a 3-letter country code (USA, DEU, KGZ). Reviews come from every country, which is the part App Store Connect's web UI makes painful.

4. Reply

async function appStoreReply(reviewId: string, text: string, token: string) {
  const res = await fetch(`${API}/v1/customerReviewResponses`, {
    method: "POST",
    headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json" },
    body: JSON.stringify({
      data: {
        type: "customerReviewResponses",
        attributes: { responseBody: text },
        relationships: { review: { data: { type: "customerReviews", id: reviewId } } },
      },
    }),
  });
  if (!res.ok) throw new Error(`Reply failed: ${res.status} ${await res.text()}`);
  return res.json(); // state is PENDING_PUBLISH until Apple shows it
}

Posting again to the same review replaces your previous reply. Replies aren't public instantly: they stay PENDING_PUBLISH for a while.

Google Play

1. Create a service account

In Google Cloud Console, create a service account and download its JSON key.
Enable the Google Play Android Developer API for that project.
In Play Console → Users and permissions, invite the service account's email and give it View app information and Reply to reviews for your apps.

Permissions can take a while (sometimes hours) to start working. If you get a 403 right after setting it up, wait before you start debugging.

2. Get an access token

Google uses OAuth with a JWT you sign with the service account's private key:

import { importPKCS8, SignJWT } from "jose";

async function playToken(sa: { client_email: string; private_key: string }) {
  const tokenUrl = "https://oauth2.googleapis.com/token";
  const key = await importPKCS8(sa.private_key, "RS256");
  const now = Math.floor(Date.now() / 1000);
  const assertion = await new SignJWT({ scope: "https://www.googleapis.com/auth/androidpublisher" })
    .setProtectedHeader({ alg: "RS256", typ: "JWT" })
    .setIssuer(sa.client_email)
    .setAudience(tokenUrl)
    .setIssuedAt(now)
    .setExpirationTime(now + 3600)
    .sign(key);
  const res = await fetch(tokenUrl, {
    method: "POST",
    headers: { "Content-Type": "application/x-www-form-urlencoded" },
    body: new URLSearchParams({ grant_type: "urn:ietf:params:oauth:grant-type:jwt-bearer", assertion }),
  });
  if (!res.ok) throw new Error(`Google token: ${res.status} ${await res.text()}`);
  return (await res.json()).access_token as string;
}

(You can also use the googleapis package; I wanted zero heavy dependencies.)

3. Fetch reviews

const PLAY = "https://androidpublisher.googleapis.com/androidpublisher/v3/applications";

async function playReviews(packageName: string, token: string) {
  const reviews = [];
  let pageToken: string | undefined;
  do {
    const params = new URLSearchParams({ maxResults: "100" });
    if (pageToken) params.set("token", pageToken);
    const res = await fetch(`${PLAY}/${packageName}/reviews?${params}`, { headers: { Authorization: `Bearer ${token}` } });
    if (!res.ok) throw new Error(`Google Play: ${res.status} ${await res.text()}`);
    const page = await res.json();
    for (const r of page.reviews ?? []) {
      const user = r.comments?.find((c: any) => c.userComment)?.userComment;
      if (!user) continue;
      reviews.push({
        id: r.reviewId,
        rating: user.starRating,
        text: user.text,
        language: user.reviewerLanguage,
        appVersion: user.appVersionName,
        device: user.deviceMetadata?.productName,
      });
    }
    pageToken = page.tokenPagination?.nextPageToken;
  } while (pageToken);
  return reviews;
}

4. Reply

async function playReply(packageName: string, reviewId: string, text: string, token: string) {
  const res = await fetch(`${PLAY}/${packageName}/reviews/${reviewId}:reply`, {
    method: "POST",
    headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json" },
    body: JSON.stringify({ replyText: text }),
  });
  if (!res.ok) throw new Error(`Reply failed: ${res.status} ${await res.text()}`);
  return res.json();
}

The gotchas

Google Play only returns the last 7 days. The reviews API only gives you reviews created or edited in roughly the last week. There's no way to fetch your full history through it. If you want history, sync regularly and store reviews yourself from day one. (Play Console offers older reviews as CSV exports in Google Cloud Storage, but that's a separate setup.)

Reply limits are very different. Google Play replies max out at 350 characters. App Store replies can be about 5,970. Write for the shorter one if you reuse templates.

Old Play reviews hide the title in the text. Some reviews come back as "Title\tBody" in a single field. Split on the tab.

Play has no "list my apps" endpoint. You need the package names yourself. A cheap way to check access is GET .../reviews?maxResults=1 for each one: a 403 means the service account isn't invited to that app yet.

Handle 429s. Both APIs rate-limit. Retry with exponential backoff and respect Retry-After.

Reviews come in every language. Both APIs give you the language or country, so you can translate before you read, and reply in the reviewer's language. Users notice.

What I did with it

Once I had all reviews in one place, the useful part wasn't reading them. It was grouping them. Ten reviews saying "widget doesn't update" in five languages is one bug, not ten complaints.

I ended up turning my scripts into a small tool called Starquill: it syncs both stores, groups reviews into issues, pings me on Telegram when a 1★ comes in, and drafts replies in the reviewer's language. It's free for one app if you don't want to build this yourself. But the code above is everything you need to roll your own.

If you've hit other gotchas with these APIs, I'd love to hear them in the comments.

I built an iOS app that turns screenshots into tasks

Ernist Isabekov — Wed, 04 Feb 2026 18:02:56 +0000

I realized I was constantly screenshotting emails, messages, and notes… and then forgetting about them.
So I built Clutch, an iOS app that uses AI to extract tasks, deadlines, and reminders from screenshots and save them to Apple Reminders / Todoist / Notion.
It’s free to try (5 screenshots/week).
I’d love feedback — what would you add or change?

https://apps.apple.com/us/app/clutch-screenshot-tasks/id6758516999