General: Forums topic: Code Signing Forums subtopics: Code Signing > General, Code Signing > Certificates, Identifiers & Profiles, Code Signing > Notarization, Code Signing > Entitlements Forums tags: Code Signing, Signing Certificates, Provisioning Profiles, Entitlements Developer Account Help — This document is good in general but, in particular, the Reference section is chock-full of useful information, including the names and purposes of all certificate types issued by Apple Developer web site, tables of which capabilities are supported by which distribution models on iOS and macOS, and information on how to use managed capabilities. Developer > Support > Certificates covers some important policy issues Bundle Resources > Entitlements documentation TN3125 Inside Code Signing: Provisioning Profiles — This includes links to the other technotes in the Inside Code Signing series. WWDC 2021 Session 10204 Distribute apps in Xcode with cloud signing Certificate Signing Requests Explained forums post --deep Considered Harmful forums post Don’t Run App Store Distribution-Signed Code forums post Resolving errSecInternalComponent errors during code signing forums post Finding a Capability’s Distribution Restrictions forums post Signing code with a hardware-based code-signing identity forums post New Capabilities Request Tab in Certificates, Identifiers & Profiles forums post Isolating Code Signing Problems from Build Problems forums post Investigating Third-Party IDE Code-Signing Problems forums post Determining if an entitlement is real forums post Code Signing Identifiers Explained forums post Mac code signing: Forums tag: Developer ID Creating distribution-signed code for macOS documentation Packaging Mac software for distribution documentation Placing Content in a Bundle documentation Embedding nonstandard code structures in a bundle documentation Embedding a command-line tool in a sandboxed app documentation Signing a daemon with a restricted entitlement documentation Defining launch environment and library constraints documentation WWDC 2023 Session 10266 Protect your Mac app with environment constraints TN2206 macOS Code Signing In Depth archived technote — This doc has mostly been replaced by the other resources linked to here but it still contains a few unique tidbits and it’s a great historical reference. Manual Code Signing Example forums post The Care and Feeding of Developer ID forums post TestFlight, Provisioning Profiles, and the Mac App Store forums post For problems with notarisation, see Notarisation Resources. For problems with the trusted execution system, including Gatekeeper, see Trusted Execution Resources. Share and Enjoy — Quinn “The Eskimo!” @ Developer Technical Support @ Apple let myEmail = "eskimo" + "1" + "@" + "apple.com"

You can now easily request access to managed capabilities for your App IDs directly from the new Capability Requests tab in Certificates, Identifiers & Profiles > Identifiers. With this update, view available capabilities in one convenient location, check the status of your requested capabilities, and see any notes from Apple related to your requests. Learn more about capability requests.

I'm posting this here after reading Quinn's post here: https://developer.apple.com/forums/thread/799000 The above entitlement is mentioned in IOUSBHostControllerInterface.h. It isn't an entitlement one can add using the + button on the Capabilities panel in Xcode. If I try to add it by hand, Xcode complains that it isn't in my profile. Is this a managed entitlement? We'd like to create a local USB "device" to represent a real device reachable over a network.

Our (sandboxed, distributed through the Mac App Store) app can optionally run as a CLI tool, to allow users to use it in scripts and other automation contexts. One of the usecases involves being a wrapper for the ssh command, but the ssh binary is not able to enable raw mode for stdin due to a sandbox violation (bug report). As a reduced example, I've created https://github.com/mihaip/sandboxed-cli-test, which has a minimal C program that uses tcsetattr to set attributes on stdin. That fails, and sandboxd logs to the console Sandbox: SandboxedCLI(30110) deny(1) file-ioctl /dev/ttys012. If I disable sandboxing on the binary then it works as expected. Looking through the sandbox profiles on /System/Library/Sandbox/Profiles, I'm not seeing cases where file-ioctl is enabled on /dev/tty. Are we out of luck, or is there a workaround?

Hello, I am Ahmed Hamade, founder of Pixel Ventures LLC, Apple Developer Program Team ID LM3P28DNVQ. I am asking Apple to grant the restricted entitlement com.apple.developer.vfs.snapshot to our team for a macOS backup application named PixelProtect. If this is not the right channel, please tell me where to send the request. PixelProtect backs up a whole Mac volume. It keeps one primary backup set on a local disk and a replica of that same set in cloud storage, protects both copies against deletion, and supports recovery. We built it for people whose AI coding agents can delete data. We need snapshots for three reasons. First, files change while a backup runs, so the backup must read from one point in time to copy a consistent state. Second, snapshots let us keep local restore points without copying the data again. Third, Time Machine takes local snapshots for the same purpose. The only alternative today is tmutil localsnapshot, whose snapshots the system manages and ages out, so we could not keep restore points of our own. We would use fs_snapshot_create, fs_snapshot_list, fs_snapshot_delete and fs_snapshot_mount. We do not use fs_snapshot_revert. Restores copy files out of a mounted snapshot. Only our privileged helper calls these functions. It runs as root, is registered with SMAppService, and is packaged as an app-like bundle (planned App ID ai.pixelventures.pixelprotect.daemon) so it can embed a provisioning profile. The main app (ai.pixelventures.pixelprotect) and our command line tool send requests to the helper and do not call these functions. We limit use as follows. Snapshots are created only on volumes the user chose to back up. The user controls how long snapshots are kept. The helper deletes only snapshots it created, which carry our own name prefix, and only under the user's retention rules or an action the user confirms. PixelProtect is signed with our Developer ID Application certificate, uses the hardened runtime, is notarized, and is distributed outside the Mac App Store to Pixel Ventures clients. It is not sandboxed, because a whole-volume backup reads the whole volume. It has no public marketing page yet, so a product description is attached. Please enable the entitlement for Team ID LM3P28DNVQ for development and for Developer ID distribution, or tell me what further information you need. I tried the code-level support request form and it requires a sample project, so I am asking here as the form suggested Thank you, Ahmed Hamade Founder, Pixel Ventures LLC Team ID LM3P28DNVQ I tried the code-level support request form and it requires a sample project, so I am asking here as the form suggested

For certain development tasks, I need to disable System Integrity Protection (SIP) (csrutil disable). After I am done doing my tests, I reenable SIP. Additionally, SIP has a number of unsupported configurations. For example, csrutil enable --without debug enables all system integrity protections except debugging. My question concerns the com.apple.rootless.install.heritable entitltement, which, from my understanding, allows any app to gain root access without authorization of the user. I would like to know whether any app give itself this entitlement without my authorization when (1) SIP is fully disabled (csrutil disable) and when (2) SIP is partially disabled in the aforementioned specific unsupported configuration (csrutil enable --without debug).

I have not seen a clear answer about this: https://developer.apple.com/forums/thread/776657 https://developer.apple.com/forums/thread/743639?answerId=775701022#775701022 Thus, I would like to pose: Is there any way to install a DriverKit extension locally for development and testing using a free developer account, or is development of DriverKit extensions gated behind a paid developer account? Thank you!

Could someone help expedite our pending DriverKit USB distribution review request? Our driver works under development signing, but approval is blocking a TestFlight pilot for our accessibility product. Request: 8AR5R3NKZD Submitted October 18, 2026 (still "Submitted") Team: 7U9T57JPF7 Capability: DriverKit USB Transport – VendorID USB: VID 6790 (0x1A86), PID 29987 (0x7523) Support case: 103013236358 Thank you!

Hello, I requested "Family Controls (Distribution)" for one of my apps. I received email that the entitlement is granted and I can use it: Hello XXXX The entitlement for Family Controls (Distribution) has been assigned to your account, and you can now configure this capability for eligible apps. If you’re enrolled as an organization, Admins on your team can also use this capability. However, on the identifiers page, the status still shows as "No Requests". Additionally, I see nowhere any other indicator. I opened a case with the ID 102999908799 but didnt receive any response. Anybody knows what to do? Thank you.

In August 2026 we requested the Local Push Connectivity entitlement. On September 12 we received two emails one minute apart: the automated "Network Extension (additional values) entitlement confirmation" from developer@email.apple.com, followed by a reply from Local Push Review ("Re: Requesting Network Extension App Push Entitlement") stating the request was "approved for development and testing purposes only. If and when you have a product ready for the store, please resubmit your request and include a description of your product." We built the NEAppPushProvider, tested it on the vessel's Wi-Fi, and resubmitted through the same request page on September 15. On October 20 we received only the same automated "Network Extension (additional values) entitlement confirmation" — identical wording to September 12 — and no reply from Local Push Review. Since the same automated confirmation accompanied the development-only approval, we can't tell what the October 20 assignment means. The App ID editor shows Network Extension (additional values) either way. Is our resubmission approved for App Store distribution, or is it still pending review? Our team ID is M4S46K7L33.

Heyo everyone! Since Xcode 27 (27.0, 27.1, and 27.2 RC), I have not been able to export builds to the App Store through Xcode Cloud that have app-usage on the com.apple.developer.user-fonts key in the entitlements file. For some inexplicable reason, it seems as though Xcode Cloud's automatic signing is trying to map to the Font Enumeration capability instead of the other Fonts capability? Since I don't have this, it fails. However, I can archive and export these builds to App Store just fine on my local device using 27.1. Here is what Xcode Cloud's logs are spitting back: error: exportArchive Automatic signing cannot update bundle identifier “XXX”. Automatic signing cannot update your registered bundle identifier to enable Font Enumeration. Update your bundle identifier on https://developer.apple.com/account and then try again. And ideas or am I alone on this island?

I have requested two entitlements for my driver: "DriverKit USB Transport - VendorID" and "DriverKit UserClient Access" I have submitted them in Sep 20, and got no response or ETA on it. It's the only thing blocking the release of my driver. Request ID: C9ULM24X2U Team: F34U2UUGXX Status: Submitted What can I do to expedite this?

Hello, we are ANeT, an EU-based manufacturer and developer of physical access control and attendance systems. We develop our own access control platform, including: our own NFC access readers (PASO), access controllers, backend and management software (Webguard), credential and user management. Our goal is to support employee/access credentials in Apple Wallet so that users can unlock doors using an iPhone or Apple Watch, ideally also using Express Mode. We would like to implement this directly into our own access control ecosystem, without using a third-party credential platform or third-party NFC reader hardware. From the Apple documentation, our understanding is that Access Keys use a credential stored in the Secure Element together with a pass in Apple Wallet, and that communication between Apple Wallet and the reader uses the Aliro protocol over NFC. We also understand that a physical access provider can act as a Credential Manager and that participation in the Apple Wallet Access Program is required. Our intended architecture is: Webguard / ANeT backend → Apple Wallet Access credential → iPhone / Apple Watch → our PASO NFC reader → ANeT access controller → door We would appreciate clarification on the following technical points: Is this architecture supported for a physical access control manufacturer using its own NFC reader hardware and firmware? What technical requirements must our NFC reader meet to communicate with Apple Wallet Access Keys using Aliro? Are there specific requirements or certification procedures for reader identification, ECP, certificates, keys, or the reader trust chain? Can our Webguard/backend platform act directly as the Credential Manager and provision, manage and revoke Access Keys through the Apple Access Platform? Can credential provisioning be initiated from a web interface using an “Add to Apple Wallet” flow, or is a native iOS application required? Which entitlements, certificates, APIs and technical documentation become available after joining the Apple Wallet Access Program? Is Apple Wallet Access for employee/physical access credentials available for access control providers operating in the European Union, including the Czech Republic? We contacted Apple Developer Support regarding this integration and were advised to ask the technical questions here on the Developer Forums. Developer Support case: 102991167219 Our objective is not to create a standard Wallet pass or QR credential. We want to integrate secure NFC-based physical access credentials directly with Apple Wallet, our own backend and our own reader hardware. Thank you for any guidance on the correct technical integration path.

I'm developing Androfest, a native Android app with a SwiftUI macOS companion. It provides user-authorized notification forwarding, automatic clipboard synchronization, file transfer, and phone-call controls, with experimental call-audio relay. I need a secure, direct connection between a nearby Android phone and a Mac without requiring both devices to join the same Wi-Fi network or using a cloud relay. Discovery, authenticated pairing, and a bidirectional IP data path are the requirements; application traffic uses certificate-pinned TLS. The Android side uses WifiAwareManager. My development devices are a Galaxy S24 FE running Android 16 / One UI 8 and an Apple silicon M4 Pro Mac running macOS 27.2. I read the DTS answer in “Do Mac computers support Wi-Fi Aware?” (https://developer.apple.com/forums/thread/827887), which explains that the presence of the framework for Mac Catalyst does not imply usable Wi-Fi Aware support on Mac. I am asking specifically about the provisioning information below and whether there is an approved path for this use case. In Certificates, Identifiers & Profiles → Register an App ID → Capabilities → Wi-Fi Aware, the information popover currently shows: Platform Support: iOS Provisioning Support: Development, Ad hoc, App Store Connect, Developer ID Entitlement Keys: com.apple.developer.wifi-aware This is confusing because Developer ID is listed while macOS is not listed under Platform Support. The native macOS SDK declarations I inspected mark the public Wi-Fi Aware APIs unavailable on macOS. Two previously generated Developer ID provisioning profiles for my test App ID had Platform = OSX, but neither contained com.apple.developer.wifi-aware. I also could not find a Wi-Fi Aware-specific approval request in the portal's Capability Requests list. Could Apple clarify the following? Does the Developer ID entry describe a usable configuration for native macOS or Mac Catalyst applications, or is it a portal metadata issue? Is there a supported API, managed entitlement, or approval process for Wi-Fi Aware discovery and IP data paths between a third-party macOS app and an Android device? If so, which target platform, capability, provisioning-profile type, and signing configuration are required? Can that configuration operate on a standard Mac with SIP enabled, default NVRAM/boot arguments, and normal code-signing enforcement? A distributable application needs to work under those conditions. If Wi-Fi Aware is not supported for this scenario, what supported transport would Apple recommend for router-independent Android–Mac communication? Where should I file an enhancement request, and should the portal's Developer ID entry be reported separately? I would appreciate guidance on the supported integration route and any missing provisioning or entitlement step. Thank you.

Hi everyone and Apple Team, please help me to solve the problem with transferring a macOS app built by Electron. I didn't change any options related to sandbox or app groups at all; I'm just using default settings. My app doesn't have any data with other apps. It seems like a huge challenge, and I still haven't solved it after three months. Thanks for your advice.

I’m developing an ARM64-native Wine + FEX compatibility runtime on Apple Silicon, without relying on Rosetta 2. According to the August 2026 Wine-devel discussion, the following entitlement is intended to be available to free developer accounts: com.apple.developer.cross-architecture-support-unmanaged However, I have encountered the following issues: My Xcode Personal Team does not offer a “Cross-architecture Compatibility Framework” capability. Certificates, Identifiers & Profiles is inaccessible to my free developer account. I cannot obtain a provisioning profile authorizing this entitlement. I contacted Apple Developer Support. They explained that entitlement requests generally require an Apple Developer Program Account Holder, but were unable to confirm whether this particular entitlement is currently requestable or where to request it. Could an Apple engineer clarify: Is the unmanaged entitlement currently available to free Personal Teams? What is the official App ID, provisioning profile, and code-signing procedure? Does this entitlement require additional approval from Apple? If it is unavailable, is there an officially supported alternative for development of an ARM64-native Wine loader? My goal is to use the native macOS cross-architecture features while keeping SIP and other security protections enabled. Relevant Wine-devel discussion: https://list\.winehq\.org/hyperkitty/list/wine\-devel%40list\.winehq\.org/thread/CKG5CEN2BE5VRXZ7O7NX4YUSBH3247WH/ Thank you.

Is the com.apple.developer.kernel.increased-memory-limit entitlement working as of iOS 15 Beta 3. As of right now if I try to add this entitlement on Beta 3 or below, the Automatic Signing fails. How much extra memory would be provided for an Application or its extension with this entitlement?

Dear Apple Developer Support Team, I am reaching out for assistance with two pending DriverKit entitlement requests. This is my first experience developing an application within Apple's ecosystem, and I recognize that my use case is somewhat unconventional. I may not have reached the appropriate support channel, so I would appreciate your guidance or assistance in directing this request to the correct team. We are currently evaluating the feasibility of adopting iPads for an internal enterprise application that communicates with our proprietary USB devices. These devices use the standard USB Communications Device Class (CDC), exposing a virtual serial port (UART). They work reliably on Windows, Linux, and macOS. To my surprise, I discovered that iPadOS does not provide general-purpose access to standard USB CDC serial devices. Based on my research, the recommended approach appears to be implementing a custom driver using DriverKit. We also use macOS as our primary development and debugging environment, so we would like to maintain a consistent DriverKit-based implementation across both platforms in macOS only for development. On September 30, 2026, I submitted the following entitlement requests: 1. Request GW966578ZB — DriverKit UserClient Access Requested entitlement: com.apple.developer.driverkit.userclient-access 2. Request 3HN2GMDFN5 — DriverKit / USB Transport Distribution Authorization Requested entitlements: com.apple.developer.driverkit com.apple.developer.driverkit.transport.usb Unfortunately, I have not received any response or status update on either request in the three weeks since submission. At this stage, our work is strictly a proof of concept (POC). We are not requesting public distribution or App Store publication. Our immediate objective is to validate the technical feasibility of communicating with our USB devices from iPadOS before committing to Apple's platform for our enterprise solution. The lack of progress on these requests has effectively blocked our evaluation for three weeks, making it difficult to assess whether iPadOS is a viable platform for our intended use case. Apple Developer Team ID: R4PSRJ28G7 We are genuinely interested in adopting Apple's technology for our enterprise operations, but we need to establish technical feasibility before proceeding. I would appreciate any guidance that could help us move forward. Best regards,Alon Bar-Lev

We make a messaging and calling app (Call.com). When a user reads a chat on another device (web or another phone), we want that chat's notifications removed from their iPhone's lock screen and Notification Center. Our plan is a Notification Service Extension that receives a "message read" push, removes the matching delivered notifications with removeDeliveredNotifications(withIdentifiers:), and then hides the read push itself by passing an empty UNNotificationContent to the content handler. The read push carries only a conversation ID and a message ID, with no message content. Hiding it needs com.apple.developer.usernotifications.filtering. The entitlement request form offers four use cases. The closest is end-to-end encrypted messaging, but it doesn't apply to us: our server can read notification content. So we don't think we should select it. We tried a background push (content-available: 1, sent through FCM) first. We tested on a physical iPhone with Background App Refresh on and the app running in the background (not force-quit). The device log showed the push being deferred: a com.apple.pushLaunch.<bundleId> activity was submitted with a 24-hour window. A second background push sent about 190 ms later cancelled that pending activity. The app never ran, and the notification stayed on the lock screen for the 8 minutes we watched. Questions: Can the filtering entitlement be granted for this use case, or only for the four listed ones? If not, what is the recommended way to remove delivered notifications after the user reads them on another device? Is a background push the only supported option? If a background push is the answer, what can we do to make it more reliable? For example, would sending one background push per read event instead of two help? Thanks!

Hi, I make Akari, a Chromium-based browser for macOS (Developer ID, notarized). On 2026-09-23 I requested the Web Browser Public Key Credential entitlement (com.apple.developer.web-browser.public-key-credential) so people can use the passkeys saved in iCloud Keychain. Request ID A9LNZMTCS4. On 2026-10-12, Developer Support (case 102988458082) emailed to say the entitlement had been issued. It still hasn't shown up: Certificates, Identifiers & Profiles > io.0arch.akari > Capability Requests still shows "Web Browser Public Key Credential Requests" as Submitted, with no way to enable it. The App Store Connect API lists only In-App Purchase as a capability for the App ID. Developer ID provisioning profiles generated on 10-12 and 10-15 don't include the entitlement. I replied on the case with screenshots on 10-12 and again on 10-15, and submitted a follow-up on 10-18, but I haven't heard back. Phone support currently says it's unavailable. Two questions: Is there anything else I need to do for an approved entitlement to be applied to the App ID? My membership is an individual account. Is an individual account eligible for this entitlement, or does it need an organization account? Team ID: G9KB4QTS57 Bundle ID: io.0arch.akari Thanks, Joseph

I'd like to get my calendar app on CarPlay, it seems reasonable because the default system calendar is on there too, which category can I use the best?

Hello, I have requested entitlements for my DriverKit-based driver, but the status has been "Submitted" since May 24, 2026. Below are the details of my request. Is there any way to expedite the process, as these entitlements are necessary for distributing the app? Also, what is the preferable way to follow up in such cases? Entitlements: DriverKit USB Transport - VendorID (0x0BDA), DriverKit UserClient Access Team: K89F9CL4ZU Request Id: 7W5RQ3D2X6 Requested At: May 24, 2026 Type: Team Status: Submitted Many thanks