Apple Music — how to connect

The plugin ships one node type, AppleMusic/Music: a node whose page is the Apple Music catalog plus — once you authorize — your own library. Getting the plugin puts a My Music node in your own space; that copy is yours and nobody else can read it. Always use your own copy — the plugin space's showcase node is rewritten from the repo on every sync.

Who sets what

	Who	Where
The MusicKit developer key (team id, key id, `.p8`)	an administrator, once per installation	Administration › Integrations (stored in Key Vault, never in node content)
Your Music User Token (your own library)	you	the Your Apple sign-in box on your My Music page, minted by the one-time Apple sign-in (step 3)

You never paste a developer key. If the page says Apple Music is not set up, ask an administrator to enter the key. A node that already holds a key of its own and a library token keeps using that key (a Music User Token is minted under one specific developer token), and says so on its page.

1. For administrators: create a MusicKit key (Apple Developer Program required)

In developer.apple.com/account:

Certificates, Identifiers & Profiles ▸ Keys ▸ + — name the key and enable Media Services (MusicKit). A key made for push notifications or Sign in with Apple signs happily and is refused by the Music API — the checkbox is the part that matters.
Download the .p8 — Apple offers this exactly once. Note the 10-character Key ID shown beside it.
Your 10-character Team ID is under Membership details.

2. For administrators: set it on the installation

Open Administration › Integrations and save AppleMusic:TeamId, AppleMusic:KeyId and AppleMusic:PrivateKey (the full text of the .p8 file, BEGIN/END lines included). Each is written to Key Vault and shown only as a mask afterwards.

Optional on your own node:

Setting	Value
`storefront`	the catalog country to browse (`us`, `ch`, `de`, …). Once you authorize, your subscription's real storefront is detected and wins.
`limit`	hits per result section (default 10)

The page now shows your storefront's most-played chart; type into Search the catalog and press Search for anything else. Every song card plays Apple's DRM-free ~30-second preview in place.

The dashboard's Your library card links to the plugin's authorize page, carrying a fresh short-lived developer token. The page loads Apple's MusicKit, signs you in with your Apple account, and shows your Music User Token — copy it, paste it into the Your Apple sign-in box on your My Music page and press Save (not the node's Edit view: Save also keeps the token paired with the installation key it was minted under). The header flips to “library unlocked” and your playlists and recent additions appear. The token lives about six months; when Apple refuses it, the page says so and offers the same link again.

If your browser downloads authorize.html instead of opening it, save it together with its script authorize.js (the same address with .js in place of .html) in ONE folder and open the page locally, then paste the developer token by hand (the dashboard link carries it as the dt parameter). The page's code lives in that script — the portal runs no inline script — so the page alone does nothing. The page works from anywhere — the token in the link expires within the hour and can only read the catalog.

Security, by design

The .p8 key signs server-side. Only short-lived (1 hour) developer tokens ever leave the mesh; the key itself never travels. Losing a developer token loses an hour of catalog access, nothing more.
Secrets render only as masks — ···· plus the last four characters. The one surface that contains the real values is your own node's Edit view, and only for a key a node held before the installation key existed; the installation key lives in Key Vault.
Revocation is instant: delete the key in the developer portal (kills catalog access) or sign the device out of the authorize page's Apple session; user tokens also expire on their own after ~6 months.
No playback of full tracks. Apple's DRM keeps those in Apple's own players; this page deliberately offers the previews and deep links (↗) into music.apple.com instead.

What the mesh calls