General: Forums topic: Code Signing Forums subtopics: Code Signing > General, Code Signing > Certificates, Identifiers & Profiles, Code Signing > Notarization, Code Signing > Entitlements Forums tags: Code Signing, Signing Certificates, Provisioning Profiles, Entitlements Developer Account Help — This document is good in general but, in particular, the Reference section is chock-full of useful information, including the names and purposes of all certificate types issued by Apple Developer web site, tables of which capabilities are supported by which distribution models on iOS and macOS, and information on how to use managed capabilities. Developer > Support > Certificates covers some important policy issues Bundle Resources > Entitlements documentation TN3125 Inside Code Signing: Provisioning Profiles — This includes links to the other technotes in the Inside Code Signing series. WWDC 2021 Session 10204 Distribute apps in Xcode with cloud signing Certificate Signing Requests Explained forums post --deep Considered Harmful forums post Don’t Run App Store Distribution-Signed Code forums post Resolving errSecInternalComponent errors during code signing forums post Finding a Capability’s Distribution Restrictions forums post Signing code with a hardware-based code-signing identity forums post New Capabilities Request Tab in Certificates, Identifiers & Profiles forums post Isolating Code Signing Problems from Build Problems forums post Investigating Third-Party IDE Code-Signing Problems forums post Determining if an entitlement is real forums post Code Signing Identifiers Explained forums post Mac code signing: Forums tag: Developer ID Creating distribution-signed code for macOS documentation Packaging Mac software for distribution documentation Placing Content in a Bundle documentation Embedding nonstandard code structures in a bundle documentation Embedding a command-line tool in a sandboxed app documentation Signing a daemon with a restricted entitlement documentation Defining launch environment and library constraints documentation WWDC 2023 Session 10266 Protect your Mac app with environment constraints TN2206 macOS Code Signing In Depth archived technote — This doc has mostly been replaced by the other resources linked to here but it still contains a few unique tidbits and it’s a great historical reference. Manual Code Signing Example forums post The Care and Feeding of Developer ID forums post TestFlight, Provisioning Profiles, and the Mac App Store forums post For problems with notarisation, see Notarisation Resources. For problems with the trusted execution system, including Gatekeeper, see Trusted Execution Resources. Share and Enjoy — Quinn “The Eskimo!” @ Developer Technical Support @ Apple let myEmail = "eskimo" + "1" + "@" + "apple.com"

Since upgrading my free Apple Developer account to the paid Apple Developer Program (Individual) on September 21, 2026, every app signed with my paid team fails to install on my devices. TestFlight builds work. Error (Xcode Run, devicectl, Ad Hoc export): MIInstallerErrorDomain Code 13 / 0xe8008018 "The identity used to sign the executable is no longer valid." +[MICodeSigningVerifier _validateSignatureAndCopyInfoForURL:withOptions:error:] LibMISErrorNumber = -402620392 What I've established: A brand-new Hello World app with no capabilities fails the same way, so it is not my project, entitlements or widget. The same Hello World signed by a free Personal Team installs on the same iPad (after trusting the developer in Settings). So the device, OS, Xcode and Mac are fine. Fails on iPad Pro 13" M4 (iPadOS 27.0.1 and 27.2), iPhone Air (iOS 27.0.1) and iPhone 15 Pro Max (iOS 26.0.1), with Xcode 27.0, 27.1 and 27.2. Fails with Apple Development signing (Xcode Run) and with an Ad Hoc export signed with an Apple Distribution certificate. codesign verifies the app, the embedded profile contains the signing certificate and the device UDIDs, and the chain (WWDR G3 to Apple Root CA) is valid and not expired. Regenerated the Development and Distribution certificates, cleaned expired WWDR certificates from the keychain, removed profiles on the device, re-paired and toggled Developer Mode. No change. Only apps re-signed by Apple (TestFlight) install. This looks like stale signing state for the team on Apple's side after the free-to-paid conversion. I have an open request with Apple Developer Support (Case-ID 22506476) and Feedback Assistant report FB24912726, but have had no reply in two weeks. Has anyone seen 0xe8008018 on a team that was recently upgraded or converted, and is there anything I can do on my side beyond asking Apple to reset the team's signing identity?

I am referring to this post. I am struggling with this now, too, and thought it may get more likely some attention if I start a new post about it instead of adding a comment there (does it actually make a difference, though?). I read through (most of) the posts, mainly by Quinn, and cannot find what I'm still doing wrong. Upload with Xcode 13.4.1 still works, but with Xcode 16.3 or later I get both these errors and the warning of this topic: ITMS-90288: Invalid Code Signing Entitlements - The entitlements in your app bundle signature do not match the ones that are contained in the provisioning profile. According to the provisioning profile, the bundle contains a key value that is not allowed: '25856V4B4X.org.tempel.findanyfile.helper' for the key 'com.apple.application-identifier' in 'Find Any File.app/Contents/Library/LaunchServices/org.tempel.findanyfile.helper' ITMS-90885: 'Cannot be used with TestFlight because the executable “${executable}” in bundle “${bundle}” is missing a provisioning profile but has an application identifier in its signature. Nested executables are expected to have provisioning profiles with application identifiers matching the identifier in the signature in order to be eligible for TestFlight.' I must admit that I only have an entitlement file for the main app, not for the embedded apps and frameworks. Until now, it appeared that they got automatically adopted. So, I don't understand what the entitlement for the embedded apps needs to contain. The main apps's entitlement file is now: codesign -d --ent - …/"Find Any File.app" Executable=…/FAFv2 MAS Release 31.10.26, 13.38.xcarchive/Products/Applications/Find Any File.app/Contents/MacOS/Find Any File [Dict] [Key] com.apple.application-identifier [Value] [String] 25856V4B4X.org.tempel.findanyfile [Key] com.apple.developer.team-identifier [Value] [String] 25856V4B4X [Key] com.apple.security.automation.apple-events [Value] [Bool] true [Key] com.apple.security.cs.allow-jit [Value] [Bool] true [Key] com.apple.security.personal-information.addressbook [Value] [Bool] true [Key] com.apple.security.personal-information.calendars [Value] [Bool] true(I just added the application-identifier and team-identifier to the entitlement file in hopes that would solve this but it made no difference.) I also checked with the other cmd on the app in the xcarchive, getting this: tempi@TTsMini24 ~ % security cms -D -i …/Find\ Any\ File.app/Contents/embedded.provisionprofile <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>AppIDName</key> <string>Find Any File</string> <key>ApplicationIdentifierPrefix</key> <array> <string>25856V4B4X</string> </array> <key>CreationDate</key> <date>2026-10-31T12:30:46Z</date> <key>Platform</key> <array> <string>OSX</string> </array> <key>IsXcodeManaged</key> <true/> <key>DeveloperCertificates</key> <array>…</array> <key>DER-Encoded-Profile</key> <data>…</data> <key>Entitlements</key> <dict> <key>com.apple.application-identifier</key> <string>25856V4B4X.org.tempel.findanyfile</string> <key>keychain-access-groups</key> <array> <string>25856V4B4X.*</string> </array> <key>com.apple.developer.team-identifier</key> <string>25856V4B4X</string> </dict> <key>ExpirationDate</key> <date>2027-10-31T12:30:46Z</date> <key>Name</key> <string>Mac Team Provisioning Profile: org.tempel.findanyfile</string> <key>ProvisionedDevices</key> <array> … </array> <key>TeamIdentifier</key> <array> <string>25856V4B4X</string> </array> <key>TeamName</key> <string>Thomas Tempelmann</string> <key>TimeToLive</key> <integer>365</integer> <key>UUID</key> <string>…</string> <key>Version</key> <integer>1</integer> </dict> </plist>Any help would be appreciated. Actually, I just realize that I may be confusing entitlements and profile - the latter is the one I claim from Apple's website, right? I haven't visited that for years (though I already struggled understanding it back in the early years when this all started). Gonna see if I can make sense of it on the Apple dev website now. Update - no, that can't be it. When i create a new profile, I need to choose an identifier that describes the entitlements for my app, right? So I checked my current identifier for my app, and that lists lots of options like "5G Network Slicing" and "Access Wi-Fi Information", but none of them look anything like the entitlements that I am using. So, my plain identifier that has none of these options checked should be fine, shouldn't it? Which also means that the current profile I have used for years should be fine as well. What am I missing here? These error msgs from the MAS upload are not helpful at all. They tell me things that seem right to me, and then there's that text with the unfilled ${executable} and ${bundle}, which isn't helping either. This could be so much better. And there's no way to reliably get help from DTS directly any more either - that option has apparently been dropped for having to ask here in the forum, where I can only hope that someone will take a look at this. If it weren't for Quinn, we'd all be doomed already, probably. Til then, I may just have to keep building and submitting with Xcode 13, and admitting to my MAS customers that I'm unable to make my app look modern while the indie build release works with the modern look as that's not locked out by Apple.

I'm struggling to get past the following error from Transporter. I've tried everything I can think of and I'm not sure what else to do. WARNING ITMS-90885: ""Cannot be used with TestFlight because the executable “${executable}” in bundle “${bundle}” is missing a provisioning profile but has an application identifier in its signature. Nested executables are expected to have provisioning profiles with application identifiers matching the identifier in the signature in order to be eligible for TestFlight."" Setup I'm using electron with a main.app and nested helper apps (e.g. Main.app/Contents/Frameworks/Main Helper (Renderer).app) I'm trying to upload to the Mac App Store I'm codesign-ing the contents with Apple Distribution: ... and signing the pkg installer with 3rd Party Mac Developer Installer: ... I'm using osx-sign to manage the code signing for me: basically it's doing a whole bunch of this: codesign --sign {40-char-hash} --force --timestamp --options runtime --entitlements "$CHILD_PLIST" "packages/mas-universal/{APP_NAME}.app/Contents/Frameworks/{APP_NAME} Helper (Renderer).app"

During a test run of my HomeKit application in Xcode, after some time the app did run smoothly, I've started for one characteristic to get a pretty weird error in the readValueWithCompletionHandler: callback block: Error Domain=HMErrorDomain Code=80 "Missing entitlement for API." UserInfo={NSLocalizedFailureReason=Handler does not support background access, NSLocalizedDescription=Missing entitlement for API.} The application was launched just a couple of hours ago and the profile is still OK (though it will expire very inconveniently soon): 1044 ocs /tmp> security cms -D -i /Users/ocs/Library/Developer/Xcode/DerivedData/HomeObserverNA-hkazqlfbeuucvybpdzdgosyhhxnx/Build/Products/Debug-maccatalyst/HomeObserverNA.app/Contents/embedded.provisionprofile -o /tmp/ppp.plist 1045 ocs /tmp> plutil -extract ExpirationDate raw -o - /tmp/ppp.plist 2026-10-15T14:04:02Z 1046 ocs /tmp> Note please that immediately after launch (and for some time after that) the value was read in through the same code without any problem. Strangely enough, when I've switched the device through the Home application, I've got the update planned through enableNotification:completionHandler: all right. and the error stopped occurring, readValueWithCompletionHandler: from that moment on again works as presumed. How can I fix the problem, what's wrong in my app? Thanks!

I’m developing an ARM64-native Wine + FEX compatibility runtime on Apple Silicon, without relying on Rosetta 2. According to the August 2026 Wine-devel discussion, the following entitlement is intended to be available to free developer accounts: com.apple.developer.cross-architecture-support-unmanaged However, I have encountered the following issues: My Xcode Personal Team does not offer a “Cross-architecture Compatibility Framework” capability. Certificates, Identifiers & Profiles is inaccessible to my free developer account. I cannot obtain a provisioning profile authorizing this entitlement. I contacted Apple Developer Support. They explained that entitlement requests generally require an Apple Developer Program Account Holder, but were unable to confirm whether this particular entitlement is currently requestable or where to request it. Could an Apple engineer clarify: Is the unmanaged entitlement currently available to free Personal Teams? What is the official App ID, provisioning profile, and code-signing procedure? Does this entitlement require additional approval from Apple? If it is unavailable, is there an officially supported alternative for development of an ARM64-native Wine loader? My goal is to use the native macOS cross-architecture features while keeping SIP and other security protections enabled. Relevant Wine-devel discussion: https://list\.winehq\.org/hyperkitty/list/wine\-devel%40list\.winehq\.org/thread/CKG5CEN2BE5VRXZ7O7NX4YUSBH3247WH/ Thank you.

I just purchased the Apple Developer Paid Account on the 3rd of October to start development on an App and hasn't been able to use it even once I’m having an iOS code-signing/provisioning issue where development/Ad Hoc builds complete successfully, but the app cannot be installed on my registered iPhone. The same issue occurs with builds produced through both Xcode and Expo EAS Build, so at this point I don’t think this is specific to EAS. When installing the app on the device, iOS shows: Unable to Install “Sencard” This app cannot be installed because its integrity could not be verified. The device logs give a much more specific error. Environment Apple Developer account type: Individual Team ID: 26K9NDX728 Main bundle identifier: com.sencard.mobile Widget extension bundle identifier: com.sencard.mobile.widgets App Group: group.com.sencard.mobile Physical iPhone registered in the Apple Developer portal Expo SDK: 57 EAS distribution: Internal / Ad Hoc The same device is included in both provisioning profiles The issue also occurs when building/installing through Xcode The application contains a WidgetKit extension, so there are two targets: Sencard com.sencard.mobile ExpoWidgetsTarget com.sencard.mobile.widgets Both targets use the same Apple Distribution certificate, with separate provisioning profiles as expected. Current signing configuration I completely reset the signing credentials and let EAS regenerate them. Both targets now use the same distribution certificate: Distribution Certificate Serial: 64FE74F9A8F0091A81671D9CDE9F7CDB The main application has its own active Ad Hoc provisioning profile: Bundle ID: com.sencard.mobile Provisioning Profile: 7D9CS7B97R Status: active Registered device: included The widget extension has a separate active Ad Hoc provisioning profile: Bundle ID: com.sencard.mobile.widgets Provisioning Profile: DY3D63UHPX Status: active Registered device: UDID: 00008130-************001C EAS reports: All credentials are ready to build @sencard/sencard (com.sencard.mobile, com.sencard.mobile.widgets) The build itself completes successfully. Device-side failure I captured the device system log while reproducing the installation failure. The important part appears to be Apple’s online provisioning authorization service rejecting the profile: online-auth-agent: The server returned: {"actions":["REJECT_PROFILE"],"authorized":false,...} online-auth-agent: Permanently rejected profile This is immediately followed by: installd(libmis.dylib): No online authorization (0x2) installd(libmis.dylib): validation failed because of failing online authorization (-402620392) Then MobileInstallation reports: The identity used to sign the executable is no longer valid. and: Failed to verify code signature of .../Payload/Sencard.app 0xe8008018 (The identity used to sign the executable is no longer valid.) Finally: Verification stage failed and the installation fails. What seems particularly significant is that the device contacts the online authorization service successfully, but the response is explicitly: "actions":["REJECT_PROFILE"] "authorized":false Things I have already tried I have done a fairly extensive clean reset of the signing configuration: Deleted the existing Ad Hoc provisioning profiles. Removed the existing distribution certificates from EAS. Revoked the corresponding distribution certificates in the Apple Developer portal. Created a completely new Apple Distribution certificate. Generated completely new Ad Hoc provisioning profiles. Verified that the provisioning profiles show as active in EAS. Verified that both profiles contain the physical iPhone being used for testing. Verified that both targets belong to Apple Team 26K9NDX728. Configured both the main app and widget extension to use the same distribution certificate. Created separate provisioning profiles for: com.sencard.mobile com.sencard.mobile.widgets Confirmed the App IDs still exist in the Developer portal. Confirmed the App Group exists and is assigned correctly. Confirmed the registered iPhone is present in the Developer portal. Rebuilt the app from scratch after regenerating all credentials. Confirmed that the EAS build succeeds. Reproduced the installation failure again on the physical device. Captured the iPhone system logs using idevicesyslog. Reproduced the problem with Xcode as well as EAS. Initially, before resetting the credentials, I also encountered a build-time error similar to: Provisioning profile ... doesn't include signing certificate "iPhone Distribution: ... (26K9NDX728)" I then deleted and regenerated the certificates/profiles and ensured both targets shared the same distribution certificate. That resolved the build failure — the application now builds successfully — but the resulting application is still rejected by iOS during installation with the REJECT_PROFILE / 0xe8008018 error above. What I’m trying to determine Is there some server-side state associated with my Apple Developer team/account that can cause a newly generated, apparently valid Ad Hoc provisioning profile to be returned as: REJECT_PROFILE by Apple’s online authorization service? Specifically: What causes online-auth-agent to return REJECT_PROFILE for a newly created provisioning profile? Can an Apple Developer team/account get into a state where newly generated Development/Ad Hoc profiles are rejected by device-side online authorization? Is there any additional server-side reset or validation Apple Developer Support can perform for Team ID 26K9NDX728? Is error -402620392 associated with a specific provisioning/profile authorization condition? Is there anything else I should inspect in the .mobileprovision file or code signature to determine exactly why Apple is rejecting it? Since I can reproduce this with both Xcode and EAS, is there any known issue affecting Ad Hoc/Development profile authorization rather than the build tooling itself? At this point I’m reluctant to keep generating new certificates and provisioning profiles because I’ve already done a complete signing reset and the newly generated profiles are still being rejected. Any guidance on what REJECT_PROFILE means internally, or what Apple Support should check on the Developer account/team, would be greatly appreciated.

My audiobook app was approved for the CarPlay audio entitlement, but every development provisioning profile I generate, whether automatic or manual through the API, includes only com.apple.developer.playable-content, never com.apple.developer.carplay-audio. Because of that, CPTemplateApplicationScene never connects, so I can't build with the template-based CarPlay APIs. I've regenerated profiles daily for a few weeks and always get the same result. It's filed as FB24899531. Has anyone else seen the newer carplay-audio key missing after approval? Did Apple have to re-apply the entitlement on their side, or is there a step I'm missing on the App ID? Thanks!

Team ID: 3HH6VYS8CR App ID: br.com.manipro.app (Apple ID 6806726054) Xcode 26.6, iOS SDK 26.5. Individual membership based in Brazil. The app is available on the Brazil storefront only. We want to offer an alternative payment option in Brazil, following "Payment options on the App Store in Brazil". What we have done: The Account Holder accepted the latest Apple Developer Program License Agreement (issued August 18, 2026, accepted August 30, 2026). The Paid Apps Agreement is active. The "StoreKit External Purchases or Offers" capability is enabled on the App ID. We also disabled and re-enabled it on the developer website as the Account Holder. The app's entitlements file contains com.apple.developer.storekit.custom-purchase-link.allowed-regions = ["br"]. What happens: The Xcode-managed development profile ("iOS Team Provisioning Profile: br.com.manipro.app") includes the entitlement with jp, br and the 27 EU country codes. The Xcode-managed App Store profile ("iOS Team Store Provisioning Profile: br.com.manipro.app") includes the entitlement with the 27 EU country codes only. "br" and "jp" are missing. We regenerated it three times on October 10, 2026, with the same result. xcodebuild -exportArchive (automatic signing, App Store Connect method) therefore fails with: Provisioning profile "iOS Team Store Provisioning Profile: br.com.manipro.app" doesn't match the entitlements file's value for the com.apple.developer.storekit.custom-purchase-link.allowed-regions entitlement. During export, Xcode also enables the "StoreKit External Purchases or Offers (EU)" capability on the App ID by itself. Expected: the App Store profile includes "br", as the development profile does, so the app can be distributed with the entitlement for Brazil. Question: what else does this account or App ID need so that App Store distribution profiles include "br" for this entitlement? Feedback Assistant: FB25141486

My two apps, com.qrafter.Qrafter and com.qrafter.QrafterPro, have been on the iOS App Store since 2011, and their App IDs still use my team's unique App ID prefix 99T3FA87E9 instead of the Team ID GH4CGS3B5H. I'm adding native Mac versions to the same App Store records (universal purchase), so the bundle IDs can't change. Every profile Apple generates for these App IDs pairs com.apple.application-identifier = 99T3FA87E9.com.qrafter.Qrafter with com.apple.developer.team-identifier = GH4CGS3B5H. iOS uploads are accepted, but Mac App Store validation (xcrun altool --validate-app -t macos) rejects even a minimal one-window app with exactly two errors: Invalid code signing entitlements. … the "99T3FA87E9.com.qrafter.Qrafter" value for the com.apple.application-identifier key … isn't supported. This value should be a string that starts with your Team ID, followed by a dot ("."), followed by the bundle ID. (90286) Invalid Provisioning Profile. … Invalid 'com.apple.application-identifier' entitlement value. (91130) Following "Code Signing Identifiers Explained" (thread 811970), I requested the prefix migration through Contact Us on 4 September (case 102953576372). On 20 September Developer Support asked me to confirm the one-time keychain data loss described in "App ID Prefix Change and Keychain Access" (thread 706128), and I confirmed. Since then the case has had no reply despite follow-ups on 24 and 29 September, and as of 6 October both App IDs still show 99T3FA87E9. Two questions: Is there anything else I need to do to get case 102953576372 completed, or a better route to escalate it? Is there any way to ship a Mac App Store build for these App IDs before the migration, or is the migration the only path? I have a minimal sample project and the full validation log if that helps.

How do I write a macOS (no need for i/Pad/OS at all) application which supports HomeKit for my own private use only? My original idea was simply to write it non-provisioned, which would solve all problems perfectly. Nevertheless, that, triple alas, seems not possible (https://developer.apple.com/forums/thread/849288). Provisioned one built locally has a lot of problems, among which there are e.g., big hurdles to run it at my other Macs (https://developer.apple.com/forums/thread/848903?answerId=907702022#907702022) an extremely limited expiration date A reasonable solution would be a creation of a provisioning profile which would include an expiration date in a far future and also IDs of my other computers; alas, far as I understand, this does not seem to be possible with a Personal Team, as detailed in https://developer.apple.com/forums/thread/848903?answerId=907568022#907568022. Whilst a sort of solution might be the nuclear one, it does not feel right the slightest — I need just to run my own app, nothing more, and whilst naturally I gladly accept all the possible dangers of code I wrote myself, I definitely would not want to get completely vulnerable where all the other apps (and other threats) in the world are concerned. I've checked also the Unlisted distribution; far as understand it properly, won't do either, e.g., since it will be declined ... if your app is in a beta or prerelease state — the application is fully intended to be used locally for months or even years in this state. Besides, even Unlisted apps must go through Review, and when I bump to a need to make any kind of change, I want simply do that locally and launch my new version immediately without any Review hassle. Also, in this case the otherwise important privacy issues like e.g., determining the proper computer name (https://developer.apple.com/forums/thread/813853?answerId=874075022#874075022) are of absolutely no importance. Are there other, more reasonable options? What's the proper solution, after all? Thanks!

How to write a macOS (no need for i/Pad/OS at all) application which supports HomeKit without provisioning? Might be a non-GUI plain tool or essentially anything runnable, if it makes the solution easier. All it ever needs is access to HomeKit (in future probably also Matter) APIs and the filesystem (to write logs). The application will be used locally and privately only. Thus, the provisioning is definitely not needed, and it brings ugly problems (compare please the thread https://developer.apple.com/forums/thread/848903). Thanks!

Hi everyone, I’m unable to select my developer team or upload my app to App Store Connect from Swift Playgrounds on my iPad. Both of these actions produce the same error: Open the app project → Team & Bundle Identifier → Team. Select Upload to App Store Connect. The error reads: “Failed to Fetch Teams Your session has expired. Please log in.” No team appears for me to select, so I cannot proceed with uploading the app. My account status: Apple Developer Program membership is active. Paid Apps Agreement is Active. Bank account is Active. I can sign in to App Store Connect through a browser. Activating the Paid Apps Agreement and banking information did not resolve the error. I reported this to Apple Developer Support on September 15 and provided a screen recording showing both failures. A Senior Advisor has now recommended asking in this forum. Has anyone encountered this exact error and resolved it? Is there a specific way to refresh the developer-account session used by Swift Playgrounds, or any diagnostic information I can collect to identify the cause? Thank you.

We have a complete iPadOS DriverKit USB extension for a Stripe Reader M2 (USB-C, M-series iPad). Development builds sign and run. We cannot ship Ad Hoc, App Store, or Enterprise builds because the distribution DriverKit entitlements are either not granted or not present in the provisioning profile Apple generates. Stripe’s iOS USB instructions say to request the entitlement at developer.apple.com/system-extensions: select HID and USB Transport, and enter USB vendor ID 11369. Platform is iPadOS. The extension also needs com.apple.developer.driverkit. The host app uses com.apple.developer.driverkit.communicates-with-drivers. We have two teams. The driver bundle ID is prefixed with the host app bundle ID and signed with the same team. Inc — Team ID HPL6Q4V5TF (Development, Ad Hoc, App Store) Host app Driver extension com.atxinnovation.union.development com.atxinnovation.union.development.usbDriver com.atxinnovation.union.qa com.atxinnovation.union.qa.usbDriver com.atxinnovation.union.production com.atxinnovation.union.production.usbDriver These are not granted. Latest submission is system-extensions request 39WL64S3LR (September 3, 2026). That form has no status page, and we have received no email. LLC — Team ID 3MAPQA4NZ6 (Enterprise in-house) Host app Driver extension com.atxinnovation.union.enterprise com.atxinnovation.union.enterprise.usbDriver Capability request ACL9VQ3BA4. The portal shows DriverKit and DriverKit USB Transport – VendorID granted and enabled on com.atxinnovation.union.enterprise.usbDriver. The Universal Distribution profile POS Prod USB Driver (platform iOS, active, expires 2027/01/22, UUID a3627c1e-451d-4d62-b871-1cb6fe21431e, created 2026-09-02 16:05:20 UTC) lists those capabilities as enabled on the Review Provisioning Profile page. The downloaded profile does not contain them. Decoding it yields only: application-identifier com.apple.developer.team-identifier get-task-allow keychain-access-groups The string driverkit does not appear in the profile. We regenerated it five times, including deleting and recreating the profile, with the same result. DriverKit development profiles for the corresponding development App ID do contain com.apple.developer.driverkit and com.apple.developer.driverkit.transport.usb. Xcode then fails the archive: Provisioning profile "POS Prod USB Driver" doesn't include the com.apple.developer.driverkit entitlement. We also do not know which idVendor values the VendorID grant assigned. The extension must match them exactly. We need 11369. What we already tried July 30: Account Holder submitted DriverKit and DriverKit USB Transport for both teams through the system-extension Contact Us form. No confirmation email. That form does not collect bundle IDs. Those July requests later showed up on the host App ID com.atxinnovation.union.enterprise, not on the usbDriver App IDs. August 12: Resubmitted on each usbDriver App ID under Certificates, Identifiers & Profiles → Capability Requests. Enterprise request ACL9VQ3BA4. August 27: Developer Support case 20000149322724. The reply pointed us back at the capability status page. September 2: Enterprise grant appeared. Enabling it on the App ID and regenerating the distribution profile still produced a profile with no DriverKit entitlements. Developer Support case 102951939894. No resolution. September 3: Resubmitted the Inc team via the system-extensions form (39WL64S3LR). The form would not accept another LLC submission because that App ID is already granted. No status since. What we are Requesting Grant DriverKit, HID, and USB Transport (vendor ID 11369) for iPadOS — Development, Ad Hoc, and App Store — on the three Inc driver App IDs above. Assistance debugging the issue of failing to embed the already-granted DriverKit entitlements in the LLC Enterprise distribution profile for com.atxinnovation.union.enterprise.usbDriver, and confirmation of the assigned idVendor values.

When attempting to build an Apple Vision Pro application written in Swift in Xcode, we get the following status errors: "Provisioning profile [Profile Name] doesn't include the Main Camera Access capability.” and "Provisioning profile [Profile Name] doesn't include the com.apple.developer.arkit.main-camera-access.allow entitlement.” The provisioning profile we are attempting to use DOES have the Main Camera Access capability enabled through the Apple Developer portal. We have tried deleting and remaking the profile multiple times, as well as creating new profiles with the same settings, but completely different names and bundle identifiers, but keep getting the same errors. We DO have the "com.apple.developer.arkit.main-camera-access.allow” added to the entitlements file of the Xcode project, and we DO have the “NSMainCameraUsageDescription” key added to the info.plist file, along with the needed string describing the camera usage. Our organization has a valid and active Enterprise account, through which we have requested and been granted access to the “Main Camera Access” capability. We have built this applications multiple times before in the past year with no issues, these errors began after one of our provisioning profiles expired and we re-made it. We have tried clearing the Provisioning Profile Cache on our machine, clearing the Derived Data in the Xcode settings, and clearing the Xcode build cache. We are experiencing these errors on multiple machines, with different versions of our app, and with completely different apps that use the Main Camera Access entitlement. We experience these errors when the profile is downloaded directly in Xcode, and when it is downloaded from a browser and imported into Xcode. When we use “Automatically manage signing” our app properly builds and deploys to the Vision Pro, but when we use the app and attempt to access the main camera, the app crashes with the exception: "Exception: This app failed to request an authorization.” We have searched online forums and found several instances of others that have experienced this problem, but have not found a solution that works. Software Versions: Xcode Version: 26.6 macOS Version: Tahoe 26.5.1 VisionOS Version: 26.5

Hi, I am trying to make my app build on GitHub Action CI pipeline. App builds fine on xcode on my mac. For CI I am using command line xcode. I am getting following error: No profiles for 'com.snslocation.electricians-now' were found: Xcode couldn't find any iOS App Development provisioning profiles matching 'com.snslocation.electricians-now'. Automatic signing is disabled and unable to generate a profile. To enable automatic signing, pass -allowProvisioningUpdates to xcodebuild. (in target 'myapp' from project 'myapp') You can see full log of the build here: https://github.com/nbulatovi/ElectriciansNow/actions/runs/12603115423/job/35127512689 The provisioning profile is present, and verified in the previous steps in the pipeline, however xcode refuses to find it. If I add -allowProvisioningUpdates error stays. I tried manually mapping app id to profile name. Is there a way to get any debug log from xcode profile search, to see why is it not picking up the correct profile? Or can you maybe help in some other way? xcode version is 15.4, iOS SDK 17.5

Hello, I am building an multiplatform app for iOS and macOS that uses CloudKit. I want give prerelease versions of my app to testers in my team. I want those builds to use the CloudKit development environment, as some of the schema is still experimental and subject to breaking changes. However, when I distribute my app via TestFlight, the iCloud container environment is automatically set to production, even though in my entitlements file I've set the iCloud container environment to development. I also tried the 'Release Testing' distribution method, but also with this option the container environment is overridden and set to production. Does anyone know how I can distribute a release build for internal testing that uses the CloudKit development environment?

Installing a development build on a physical iPhone fails with: 0xE8008018 - The identity used to sign the executable is no longer valid. On the same Mac, same iPhone, same codebase and same Xcode, switching to a free personal Apple ID team installs and runs with no error. Only builds signed with our paid organisation team fail. Nothing else changes between the two runs. We have already regenerated certificates and provisioning profiles, deleted the profiles folder, cleared DerivedData, removed old identities from the keychain, trusted the profile on device, and tried both automatic and manual signing. None of it changes the result. We have also gone through the existing threads on this error and none of the suggested fixes apply. The build validates locally but the device rejects the identity. Since the signing team is the only variable between success and failure, what should we be looking at? A support case is open with Developer Support but we have not had a technical response yet.

We are seeing a startup issue with in-house enterprise iOS apps on iOS 27 Developer Beta. We would like to understand whether this could be related to changes in iOS 27 Developer Beta startup validation, code signing validation, provisioning profile validation, certificate chain validation, entitlements, embedded frameworks, enterprise developer trust state, or device-specific launch behavior. This issue blocks our enterprise app compatibility validation on iOS 27 Developer Beta, especially on iPhone 11 and iPhone 12 devices. If this is a known beta issue, we would appreciate confirmation from Apple and any available fix plan or workaround. Symptoms: After installing the same enterprise app, some iPhone 11 / iPhone 12 devices running iOS 27 Developer Beta cannot launch it correctly. There are two visible behaviors: When launched from the Home Screen icon, the app stays on the Launch Screen. The normal app UI never appears. When launched from Spotlight/Search, the app crashes immediately. Additional observations: iPhone 13 and later devices do not show this issue. Other enterprise apps distributed with the same provisioning profile or provisioning setup show the same behavior. This makes the issue look less like a single app's business logic problem and more like an iOS 27 Developer Beta validation, trust, or launch-time behavior difference on specific device models. We added logs and breakpoints at the earliest possible app startup points, including main, AppDelegate, SceneDelegate, and before crash-reporting SDK initialization. On affected devices, none of these logs are printed. Based on this, it appears that our app code is never reached. The failure seems to happen before iOS transfers control to the app, possibly while launching the process or loading the app binary/frameworks. Our current suspicion is that the failure may happen during one of these system-level steps: Enterprise code signing validation embedded.mobileprovision validation Certificate chain validation Enterprise developer certificate trust validation Mach-O / embedded frameworks / dynamic libraries loading Entitlements validation Bundle ID / App ID / provisioning profile matching Reuse of stale local enterprise trust, provisioning, or signing validation state on the device Temporary workaround observed: We found a temporary workaround on affected devices: Completely uninstall the existing enterprise app from the device. Download and install the app again. Trust the enterprise developer certificate again in Settings. Launch the app again. After doing this, the app can start normally on the affected iPhone 11 / iPhone 12 devices running iOS 27 Developer Beta. The Launch Screen hang and Spotlight/Search crash no longer reproduce. This suggests that the IPA itself may not be permanently invalid, and the issue may not be caused by app business logic. It may instead be related to stale or invalid local enterprise trust, provisioning profile, certificate chain, or signing validation state after upgrading to iOS 27 Developer Beta. Questions: Does iOS 27 Developer Beta introduce any new restrictions or behavior changes for enterprise in-house app launch validation, code signing validation, enterprise developer trust state, embedded frameworks loading, entitlements, or provisioning profile validation? Are there any known differences in this area between iPhone 11 / iPhone 12 and iPhone 13 or later devices on iOS 27 Developer Beta? If multiple enterprise apps distributed with the same provisioning profile or provisioning setup fail before app code runs, does that point more strongly to a provisioning profile, certificate chain, enterprise trust state, or system validation issue? Given that completely uninstalling the old enterprise app, reinstalling it, and trusting the enterprise developer certificate again fixes the issue, could this be caused by stale trust, provisioning profile, certificate, or code-signing validation state cached on the device after upgrading to iOS 27 Developer Beta? For an enterprise app that stays on the Launch Screen before app code runs, or crashes immediately when launched from Spotlight/Search, what are the most common signing, certificate, provisioning profile, entitlement, or enterprise trust problems to check? Which system logs or crash log fields should we focus on for this kind of pre-main launch failure? For example: device console, crash log, Termination Reason, dyld message, Code Signature Invalid, profile validation, or trust evaluation messages. Are there recommended commands or checks to verify that the IPA's code signature, certificates, entitlements, embedded.mobileprovision, and embedded frameworks are all valid and consistent? If this is an iOS 27 Developer Beta regression, is there any known workaround until the issue is fixed? Environment: Distribution type: Apple Developer Enterprise Program / In-House distribution Affected OS: iOS 27 Developer Beta Affected devices: iPhone 11 / iPhone 12 Unaffected devices: iPhone 13 and later Same provisioning profile or provisioning setup: other enterprise apps show the same behavior Behavior 1: stuck on Launch Screen when launched from Home Screen Behavior 2: crashes immediately when launched from Spotlight/Search App code execution: not reached main/AppDelegate/SceneDelegate logs: not printed Crash SDK initialization: not reached Temporary workaround: completely uninstall the old enterprise app, reinstall it, and trust the enterprise developer certificate again. After that, the app launches normally. Impact: blocks enterprise app compatibility validation on iOS 27 Developer Beta for affected devices Suspected area: iOS 27 Developer Beta startup validation / code signing / provisioning profile / certificate / enterprise developer trust state / entitlements / embedded frameworks / device-specific validation behavior We are looking for guidance on how to confirm whether this is caused by an iOS 27 Developer Beta signing, provisioning profile, or enterprise developer trust validation change on iPhone 11 / iPhone 12, rather than an app-level crash. If this is a system issue in iOS 27 Developer Beta, we hope Apple can provide a fix or a practical temporary workaround as soon as possible.

Our iOS app fails to install via Ad Hoc or Development distribution with error: 0xe8008018 (The identity used to sign the executable is no longer valid). Environment: macOS 15.6.1, Xcode 16.0 Team ID: 8CJTVD465A Tested on iPhone 8 (iOS 16.7 + iOS 16.2) What works: TestFlight ✅, App Store ✅ What fails: Ad Hoc ❌, Development ❌ Key evidence: OCSP returns "good" for all certificates Brand new certificate (created today) → same error Install succeeds in Airplane mode but app shows "not available" at launch 4 different certificates, 3 profiles, 2 Xcode versions, 2 devices → all fail codesign --verify passes locally Full cert chain verified: Leaf → WWDR G3 → Apple Root CA This indicates Apple's online verification service is rejecting our team's signatures. Has anyone seen this or know how to resolve?

I'm trying to register the App ID ai.mycompany.app under our company Apple Developer account, but the portal says: "An App ID with Identifier 'ai.mycompany.app' is not available. Please enter a different string." We own the domain mycompany.ai, and no app is published with this identifier (an App Store lookup by bundle ID returns no results). I believe it was auto-registered earlier by Xcode's automatic signing under my personal Apple ID while testing a build, not under our company team. So it's now holding the identifier globally but isn't in use. I have access to both accounts — my free personal Apple ID and our paid company Developer account. The problem: under the free personal account, the Identifiers list (Certificates, IDs & Profiles) is restricted — free accounts can't access it on the portal, so I can't see or remove the Bundle ID there myself. And from the company account it doesn't appear, since it's owned by the personal team. What I want: release/remove this Bundle ID so I can register it under our company Developer account. Questions: If a Bundle ID was auto-created under a free personal team, how can it be removed when free accounts can't access the Identifiers list? Is contacting Developer Support the only way to release it in this case? Once released, does the identifier become available immediately, or is there a hold period before another team can register it? Any guidance appreciated.