General: Forums topic: Code Signing Forums subtopics: Code Signing > General, Code Signing > Certificates, Identifiers & Profiles, Code Signing > Notarization, Code Signing > Entitlements Forums tags: Code Signing, Signing Certificates, Provisioning Profiles, Entitlements Developer Account Help — This document is good in general but, in particular, the Reference section is chock-full of useful information, including the names and purposes of all certificate types issued by Apple Developer web site, tables of which capabilities are supported by which distribution models on iOS and macOS, and information on how to use managed capabilities. Developer > Support > Certificates covers some important policy issues Bundle Resources > Entitlements documentation TN3125 Inside Code Signing: Provisioning Profiles — This includes links to the other technotes in the Inside Code Signing series. WWDC 2021 Session 10204 Distribute apps in Xcode with cloud signing Certificate Signing Requests Explained forums post --deep Considered Harmful forums post Don’t Run App Store Distribution-Signed Code forums post Resolving errSecInternalComponent errors during code signing forums post Finding a Capability’s Distribution Restrictions forums post Signing code with a hardware-based code-signing identity forums post New Capabilities Request Tab in Certificates, Identifiers & Profiles forums post Isolating Code Signing Problems from Build Problems forums post Investigating Third-Party IDE Code-Signing Problems forums post Determining if an entitlement is real forums post Code Signing Identifiers Explained forums post Mac code signing: Forums tag: Developer ID Creating distribution-signed code for macOS documentation Packaging Mac software for distribution documentation Placing Content in a Bundle documentation Embedding nonstandard code structures in a bundle documentation Embedding a command-line tool in a sandboxed app documentation Signing a daemon with a restricted entitlement documentation Defining launch environment and library constraints documentation WWDC 2023 Session 10266 Protect your Mac app with environment constraints TN2206 macOS Code Signing In Depth archived technote — This doc has mostly been replaced by the other resources linked to here but it still contains a few unique tidbits and it’s a great historical reference. Manual Code Signing Example forums post The Care and Feeding of Developer ID forums post TestFlight, Provisioning Profiles, and the Mac App Store forums post For problems with notarisation, see Notarisation Resources. For problems with the trusted execution system, including Gatekeeper, see Trusted Execution Resources. Share and Enjoy — Quinn “The Eskimo!” @ Developer Technical Support @ Apple let myEmail = "eskimo" + "1" + "@" + "apple.com"

You can now easily request access to managed capabilities for your App IDs directly from the new Capability Requests tab in Certificates, Identifiers & Profiles > Identifiers. With this update, view available capabilities in one convenient location, check the status of your requested capabilities, and see any notes from Apple related to your requests. Learn more about capability requests.

I have requested an entitlement for my DriverKit based driver, but the status is still in "Submitted" phase. I have also tried contacting Apple Support by phone/mail but to no avail [Case ID: 20000143721904]. Below are the details of my request. Is there any way to know the turnaround time or to expedite the process as this entitlement is necessary for the distribution of our app? Also, what is the preferrable way to follow up in such cases? Entitlement: com.apple.developer.driverkit.transport.pci - DriverKit PCI (PrimaryMatch) Team: 8S33FS7Q5Q Request Id - NZYWRD96U3 Requested At - August 13, 2026 Type - Team Status - Submitted Thank you, Abishek.

We completed an App Store app transfer and the Notification Service Extension Filtering Entitlement (com.apple.developer.usernotifications.filtering) did not transfer with the app. App Apple ID: 6760007376 NSE Bundle ID: io.nolink.ios.nse New Team ID: M85WA8W78C Previous Team ID: V2E3A94DC9 The app, bundle IDs, and App Store presence all moved normally, but the entitlement is not available on the new team, so we cannot sign the NSE with the configuration the app previously shipped with. Our app is an encrypted messenger and this breaks incoming call handling for live users. Two questions: Is there an official process for re-associating a previously approved entitlement with the receiving team after a transfer, or does the new team always have to submit a fresh request? Could entitlements tied to a specific App ID move with the app during a transfer, the same way bundle IDs do? We have an open support case, but wanted to raise the general question here too.

We are developing UTipping, a digital tipping application, and are seeking technical guidance before implementation. Our intended experience is: The recipient opens the app and activates “Receive Tip”. The sender selects a tip amount and “Send Tip”. Both authenticated apps are unlocked, online, and in the foreground. The two iPhones are brought into very close physical proximity. The proximity interaction exchanges or resolves only a short-lived, opaque session identifier. No funds, card credentials, cryptograms, or payment-authorization data are exchanged through NFC. The sender confirms the resolved recipient and amount. Payment is processed separately through the backend and licensed payment infrastructure. Standard Core NFC appears to provide reader functionality for supported tags/protocols, but not a general application-controlled iPhone-to-iPhone peer/tag-emulation channel. We would appreciate guidance on: whether this interaction can be implemented using Core NFC; whether NFC & SE Platform or HCE / CardSession could provide the presenter role; whether one third-party iPhone can present a temporary application-controlled identifier to another third-party iPhone; whether both apps must remain foreground; and whether Nearby Interaction with BLE / Multipeer Connectivity is the recommended alternative for very-close-proximity recipient identification. The NFC/proximity interaction would only identify the intended recipient. The financial transaction is completely separate. Apple Developer Support previously referred us to engineering under case 102948761329. We have also submitted the detailed technical architecture through Feedback Assistant: FB24517831 Any guidance from Apple framework engineers regarding the supported architecture and entitlement path would be greatly appreciated.

Hello, Apple Developer Technical Support directed me to the Developer Forums for clarification on the following Family Controls use case. DTS reference: Case-ID 21723677 I am evaluating an iOS app called “Zone” before beginning full development. I would like to determine whether the proposed architecture is considered permitted individual device management for focus and productivity, or prohibited use “in organizational settings” under Section 3.3.3(P) of the Apple Developer Program License Agreement. Proposed architecture: Zone is offered to companies as a workplace focus and productivity service. The app is installed on an adult employee’s personally owned iPhone. Participation and each Focus Session are voluntary. The employee independently requests Family Controls authorization using individual authorization. Only the employee can select the apps and websites to restrict. Only the employee can start or stop a Focus Session. During the session, Zone applies restrictions locally on that employee’s iPhone using Family Controls and Managed Settings. The employer cannot authorize or revoke Family Controls access. The employer cannot select restricted apps or websites. The employer cannot remotely start, stop, or schedule a Focus Session. The employer cannot remotely manage or control the employee’s device. Zone would not provide the employer with: Screen Time or Device Activity data App or website tokens App usage history Website browsing history Information about attempts to open restricted apps Location, messages, photos, or other personal device information However, Zone would include a company web dashboard. The dashboard would show only an app-generated boolean status for each participating employee: Zone ON: the employee has voluntarily started a Focus Session Zone OFF: the employee has not started a Focus Session This status is generated by the Zone app itself. It is not derived from Screen Time usage data and does not indicate whether the employee actually attempted to use any restricted app or website. My questions are: Would this architecture be considered permitted individual device management for focus and productivity, even though the service is offered through an employer and the employer can see the Zone ON/OFF status? Or would the employer relationship and company dashboard make this prohibited use of Family Controls “in organizational settings”? If sharing the app-generated ON/OFF status with the employer is incompatible with the Family Controls terms, would the use be permitted if Family Controls operated entirely on-device and no Focus Session status or device information were sent to the employer? Is there another Apple-supported framework or architecture recommended for this use case? I understand that final entitlement approval and App Review decisions may depend on the submitted application. I am seeking architectural guidance before investing in implementation. Thank you.

Hello, I am building an multiplatform app for iOS and macOS that uses CloudKit. I want give prerelease versions of my app to testers in my team. I want those builds to use the CloudKit development environment, as some of the schema is still experimental and subject to breaking changes. However, when I distribute my app via TestFlight, the iCloud container environment is automatically set to production, even though in my entitlements file I've set the iCloud container environment to development. I also tried the 'Release Testing' distribution method, but also with this option the container environment is overridden and set to production. Does anyone know how I can distribute a release build for internal testing that uses the CloudKit development environment?

How can a local AI agent use MLX/Metal unattended while remaining confined to an authorized workspace? I am developing an AI-driven local media-processing workflow on an Apple-silicon Mac and am trying to understand the correct architecture for allowing it to run unattended without giving the AI agent unrestricted access to my primary personal computer. I am not a software engineer, so I may be missing an established macOS mechanism or using the wrong terminology. I would appreciate guidance from people familiar with MLX, Metal, sandboxing, and macOS security. What I am building I use OpenAI Codex as the local execution/software-development agent. The working system currently: ingests and verifies original video and still media while preserving immutable originals; performs visual semantic analysis and divides video into meaningful time-coded segments; separately analyzes spoken language rather than assuming audio and video are semantically equivalent; uses MLX Whisper locally on Apple silicon for time-coded speech transcription; stores visual and language semantics in a relational SQLite media catalog. These five stages are working. My current test corpus contains 148 original media files, 126 visual semantic segments, and 765 speech segments. The next stages are AI editorial construction from the semantic database and generation of instructions/scripts for a DaVinci Resolve rough cut. The security architecture I want Codex to operate autonomously within a deliberately bounded development environment. I do not want to solve this simply by granting an autonomous agent Full Disk Access to my primary personal Mac. The concern is ordinary fault containment. Codex generates and executes scripts, invokes applications and command-line tools, and manipulates files. A mistaken path or defective generated script should not have unrestricted consequences for the rest of my computer. I therefore separated AI execution from ordinary personal files. Codex is configured for Workspace Write access with explicitly authorized project roots. Canonical media resides on a separately authorized external SSD, and temporary AI working artifacts are kept separately. Ordinary Python and FFmpeg operations now run autonomously within these authorized areas. The problem The difficulty appears when the workflow invokes capabilities that cannot operate inside the ordinary Codex sandbox. The clearest example is MLX Whisper. I am using: MLX Whisper 0.4.3 mlx-community/whisper-small-mlx Apple silicon local transcription MLX Whisper works successfully and its transcription quality is sufficient for my semantic-retrieval application. However, MLX could not access Apple Metal/GPU execution from inside the ordinary Codex sandbox. Codex therefore requested permission to execute the transcription operation outside the sandbox. Once approved, MLX/Metal worked and the entire corpus was successfully transcribed. The processing therefore works, but the workflow cannot run genuinely unattended. A future operation should be able to run: new media → integrity verification → visual semantic analysis → MLX Whisper transcription → language semantic analysis → SQLite update → QA But if execution stops midway waiting for a human to click Allow, the pipeline is not operationally autonomous. What I have already tried I initially encountered permission problems even with ordinary file operations. I therefore: separated Codex work from ordinary personal documents; created dedicated project/work areas; explicitly authorized the required working roots; configured Workspace Write; separately authorized the external media repository; tested shell/Python and FFmpeg operations within those boundaries. Those changes worked. Routine Python and FFmpeg operations now run without approval prompts. The remaining issue occurs with MLX/Metal and some other application/runtime operations that require sandbox escalation. My question Is there a supported architecture for allowing a local AI agent to invoke MLX/Metal and other deliberately authorized development tools unattended, while still confining the agent to defined project/workspace boundaries rather than granting unrestricted access to the entire Mac? For example, should I be investigating: App Sandbox entitlements; a signed helper tool or XPC service; security-scoped resources; a dedicated executable with appropriate entitlements; a different method of launching MLX/Metal; or another macOS mechanism? In particular, can Metal/GPU access coexist with persistent bounded filesystem access without requiring interactive approval each time the AI invokes it? I am also unsure which security layer is actually responsible here: the Codex sandbox, macOS App Sandbox, TCC, executable/code-signing rules, Metal restrictions, or some interaction among them. If this kind of bounded unattended execution is intentionally not supported, that would also be useful to know. My alternative would be a dedicated Apple-silicon Mac containing only the AI-development environment and replaceable project data, where broader permissions would have a much smaller failure domain. I can provide the Codex configuration, exact successful and failing commands, directory/root configuration, macOS/hardware information, and sandbox diagnostics. I would particularly appreciate guidance on which security layer is causing the MLX/Metal escalation and what the supported architecture would be for this use case. Thank you.

I'm building a native macOS app (deployment target macOS 14.0) that uses HealthKit. The App ID (com.ryanegli.Vantage, team RWGMA3VG99) has HealthKit enabled and saved under Capabilities. However, no provisioning profile generated for this App ID — automatic (Xcode-managed) or manually created/regenerated via the Developer Portal — ever includes the com.apple.developer.healthkit entitlement. The profile's "Review Provisioning Profile" page on the portal consistently lists only "In-App Purchase" under Enabled Capabilities, never HealthKit, even immediately after editing and regenerating the profile. Environment: Xcode 26.6, macOS 26.5 SDK Deployment target: macOS 14.0 Account role: Account Holder (sole owner of team) Steps to reproduce: Create a macOS app target with com.apple.developer.healthkit and com.apple.developer.healthkit.access in its entitlements file, App Sandbox enabled. Enable HealthKit on the App ID via developer.apple.com → Certificates, Identifiers & Profiles → Identifiers → [App ID] → Capabilities → HealthKit → Save (confirmed saved: Save button greys out afterward). Build with Xcode automatic signing, or manually create/download a "macOS App Development" provisioning profile for this App ID via the portal. Inspect the resulting profile (security cms -D -i profile.provisionprofile, or the portal's "Review Provisioning Profile" page). Expected: Profile includes com.apple.developer.healthkit. Actual: Entitlement is absent from every profile generated, across multiple regeneration attempts over several hours. Additional notes: Xcode's "+ Capability" picker in Signing & Capabilities does not list HealthKit at all for macOS targets (only appears for iOS/watchOS/etc.), suggesting Xcode's own capability catalog may not yet be updated for HealthKit-on-macOS. The App ID's "App Services" and "Capability Requests" tabs show no separate HealthKit-related entry that might explain a gating requirement (only clinical-records-specific sub-capabilities like "HealthKit Access (Verifiable Health Records)" appear there, which we don't need). Any suggestions, help, or input would be welcome. Thanks!

Hi team, Earlier, Apple’s documentation clearly mentioned that we needed to submit a request to Apple to obtain the Location Push Service Extension (com.apple.developer.location.push) entitlement. However, when I checked the Apple Developer Portal now, I don’t see an option to request this entitlement for my App ID. Could you please confirm whether this entitlement is still required to be requested from Apple, or if the process has changed and the request is no longer required? Thanks

I’m trying to request an NFC PassKit Certificate through https://developer.apple.com/contact/passkit/. After clicking Send, the completed form is POSTed successfully and receives 200 OK, but the server returns the original form instead of a confirmation page. The page’s passkit.js then clears all fields, and Developer Support confirmed that my earlier submission was never received. Has anyone else encountered this behavior or found another way to submit the NFC PassKit Certificate request?

Game Center matchmaking fails for all non-default users on Apple TV — no IDS registration for secondary users (FB24156316) On a multi-user Apple TV (tvOS 26.5, Apple TV 4K 3rd gen), Game Center real-time matchmaking fails for every user except the default user, in every app I've tested — including Apple Arcade titles. Filed as FB24156316 with full logs and sysdiagnose; posting here for visibility and in case anyone has shipped multi-user GC multiplayer on tvOS successfully. My game adopts com.apple.developer.user-management (runs-as-current-user-with-user-independent-keychain). The entitlement itself works: on a secondary user's profile the app runs under that user's persona and GKLocalPlayer authenticates as them — the welcome banner shows the right account. But any GKMatchmakerViewController quickmatch hard-fails within ~9 seconds ("Failed to find players"), and accepting an invite fails with GKError 35 ("not signed in to iCloud") even though Settings shows that user's iCloud as signed in. Unified logs show the root cause. When matchmaking starts, gamed can't provision the player's pseudonym because the current user has no identity-services registration: gamed No URI found on any account -- returning nil gamed Failed to fetch pseudonym for local player. Error: GameDaemonCore.PseudonymManagerError.failedToProvision( internalError: Error Domain=com.apple.ids.IDSPseudonymErrorDomain Code=400 "Invalid URI") For the default user, the identical flow succeeds (identityservicesd … resultCode: 0). Across a full day of log capture — profile adds, a remove/re-add, multiple user switches — identityservicesd never once references the secondary users' accounts: registration for them is never attempted, not attempted-and-failed. Meanwhile gamed advertises the nearby-matchmaking Bonjour service with the default user's identity while the foreground app runs as the secondary user. Reproduction matrix: two apps (my shipping game Extreme Violence and Apple Arcade's Crossy Road Castle, which also runs under the correct persona), both sandbox and production Game Center, two unrelated secondary accounts (both healthy elsewhere). Persists across reboot and profile remove/re-add. Default user unaffected. The documentation says the entitlement is all that's needed ("each person who uses your app will have access to… their own Game Center… you don't have to make any code changes" — WWDC20 session 10645). As far as I can tell that promise is currently unfulfillable for online play: there is no API or Settings path that creates the missing IDS registration. Has anyone seen non-default-user matchmaking work on tvOS, on any version? Is there anything an app can do here, or is this purely an OS-side fix? (Related: thread 782163 — a different tvOS matchmaking failure that DTS confirmed as a bug.)

I submitted an Endpoint Security entitlement request today (request ID NWFPYC286F, Team type). The request shows up in my Request History with status "Submitted," but I never received an ACK email or follow-up number. I've checked spam/junk folders and the email associated with our team account. Nothing from Apple. Two questions: Is the request actually in the review queue if I have a request ID in the portal but no email confirmation? Is there any way to check status or get a timeline estimate? This entitlement is critical for our product development. We're building agent identity infrastructure that needs ES for process-level attestation on macOS. Appreciate any help, especially from anyone who's been through this recently.

Hi, I was trying to run a macOS VM under a launchd daemon as part of a requirement. The parent daemon spawns a macOS VM under root user. Sometimes this is fine, but sometimes I'm getting a security error from VZ library : Unable to access security information. The virtual machine encountered a security error. In system logs, I was able to see this : ctkd: unable to generate key: error e00002e2 for com.apple.Virtualization.VirtualMachine with SepKey ACL I think this indicates Virtualization.framework asked CryptoTokenKit/Secure Enclave to create a key, and the security subsystem rejected it in the current execution context. Is it possible to run VM this way ? If yes, what am I missing ?

Hi Apple DTS and community, My developer account's app has been granted the Default Mail App managed capability (com.apple.developer.mail-client). The capability works for Development and App Store Connect distribution, but it is not enabled for Ad Hoc distribution. This prevents us from using our Xcode Cloud “Archive & TestFlight” workflow: The archive succeeds. Development and App Store Connect exports succeed. Xcode Cloud then automatically attempts an Ad Hoc export. The Ad Hoc export fails, causing the entire archive action to fail and the TestFlight post-action to be skipped. The export log reports: Entitlement com.apple.developer.mail-client not found and could not be included in profile. This likely is not a valid entitlement and should be removed from your entitlements file. We have reproduced this in two consecutive Xcode Cloud runs. We also confirmed that: The App ID has the Default Mail App capability enabled. The entitlement is present and correctly spelled in the app’s entitlements file. The App ID’s provisioning support lists Development and App Store Connect, but not Ad Hoc. Our Xcode Cloud workflow does not expose an option to disable the automatically attempted Ad Hoc export. This appears to match these previous reports: https://developer.apple.com/forums/thread/774506 — a DTS engineer enabled Ad Hoc support for the entitlement, after which the developer confirmed the issue was resolved. https://developer.apple.com/forums/thread/800072 — DTS confirmed that the Ad Hoc distribution option must be enabled for the Default Mail App managed capability. We also opened an Apple Developer Support case (102945477410). Developer Support directed us to the forums and indicated that this issue would need to be handled by DTS engineers. I can provide our Team ID, Developer Support case number, Xcode Cloud run identifiers, and any other account details privately if needed. Thank you!

Product area macOS / Privacy & Security / ScreenCaptureKit / Core Graphics Environment macOS 27 Beta 4 (build: fill in your exact build number, e.g. 27A5xxx) Xcode 26.5 / SDK 260500 (adjust to match what you actually built with) App holds the com.apple.developer.persistent-content-capture entitlement (approved via Apple's request form), targeting macOS 14.4+ Summary Our app is a remote-support/remote-control tool (screen viewing + control), comparable to VNC-style products. On macOS 27, we've found that System Settings > Privacy & Security now shows a "Remote Desktop" entry that is distinct from "Screen & System Audio Recording" — granting one does not affect the other. We need a way to check, at any time, whether our app currently has "Remote Desktop" authorization, without causing the system to show a permission-request alert as a side effect. We have not found a documented, public API that does this. What we've tried CGPreflightScreenCaptureAccess() Confirmed via a controlled test on-device: granting only "Remote Desktop" leaves this API returning false; granting only "Screen & System Audio Recording" makes it return true. So this API appears to reflect kTCCServiceScreenCapture only, and does not reflect the "Remote Desktop" permission at all. ScreenCaptureKit (SCShareableContent, e.g. via a refreshAvailableContentWithCompletionHandler:-style call) This call does appear to interact with the "Remote Desktop" permission — but calling it triggers a real system consent alert every time we call it, even when we only intend to read the current status, not request it. This makes it unusable for passive/background status polling (e.g. to decide what to show in our own onboarding UI without surprising the user with an OS-level prompt). We are intentionally not reading /Library/Application Support/com.apple.TCC/TCC.db directly — we understand this is a private, undocumented database and want a supported API instead. Sample code illustrating both attempts // Attempt 1: CGPreflightScreenCaptureAccess — does not reflect Remote Desktop grant BOOL preflightResult = CGPreflightScreenCaptureAccess(); // preflightResult stays NO even after the user grants "Remote Desktop" in // System Settings > Privacy & Security > Remote Desktop. // It correctly flips to YES only when "Screen & System Audio Recording" is granted. // Attempt 2: ScreenCaptureKit-based check — reflects it, but prompts every time SCShareableContent... // (via our wrapper) refreshAvailableContentWithCompletionHandler: // This call appears to influence/query the Remote Desktop TCC entry, but the OS // shows a permission alert as a side effect of the call itself, even when we only // want to read the current authorization state. Question Is there a public, documented API equivalent to CGPreflightScreenCaptureAccess() — i.e., a read-only, non-prompting status check — for the new "Remote Desktop" privacy category introduced around macOS 26/27? Is com.apple.developer.persistent-content-capture actually the entitlement that governs this new "Remote Desktop" category, or is it unrelated? Apple's own documentation describes this entitlement purely in terms of "persistent access to screen capture" for VNC apps, with no mention of a distinct "Remote Desktop" permission surface — we'd like to confirm whether that description is still accurate on macOS 26/27, or whether the underlying TCC service (kTCCServiceRemoteDesktop, which we found via TCC.db schema inspection only, not public docs) has been intentionally split out. If no such API exists yet, is this planned, and is there a recommended interim approach for apps that need to know this state before deciding whether to show their own onboarding/permission UI?

I ship a macOS audio player on the Mac App Store. I want to re-enable a remote-control feature, but I got rejected for it once already and I want to avoid burning another review cycle. I'd appreciate guidance from anyone who has shipped this pattern. What the feature does The Mac app runs a small local HTTP server (BSD sockets + GCD) on port 7777 and advertises itself over Bonjour as _tmstudioplayer._tcp. A companion iOS app discovers it with NWBrowser and controls playback: transport, volume, EQ, and so on. Everything stays on the local network. There is no cloud service, no account, no login, and no user data leaves the device. The server only accepts connections while the Mac app is running and in the foreground. This requires com.apple.security.network.server, plus NSLocalNetworkUsageDescription in Info.plist. The rejection An earlier build was rejected because com.apple.security.network.server was declared but App Review could not observe any functionality that justified it. That was fair. At the time the iOS companion app did not exist publicly, so from the reviewer's side the entitlement genuinely looked unused. I removed the entitlement, and the app was approved and is on the store today with the remote feature disabled. The iOS app now exists and works end to end. So I would like to turn the feature back on. The actual problem The feature is, by definition, not demonstrable on a single machine. To see it work, a reviewer needs a Mac and an iPhone on the same local network, with a build of the iOS app installed. As far as I can tell, App Review does not link a macOS app record and an iOS app record so they get reviewed together — they are separate submissions in separate queues. So I cannot simply say "review these two together and you'll see it work." That leaves me guessing at the right approach, and each guess costs a review cycle. What I'm asking What is the correct submission order? Should the iOS companion be live on the App Store first, so I can point to it by name and App ID in the macOS Review Notes? Is a public TestFlight build enough? Does a reviewer even accept a TestFlight link as evidence? Is a demo video sufficient on its own? I can record the full flow — launching the Mac app, the iPhone discovering it over Bonjour, and control working — and attach it to App Review Information. Has that alone been accepted for a local-network feature, or does the reviewer still need to reproduce it? Is there a supported way to point one submission at another? Anything better than a plain-text description in the Review Notes — an App ID reference, a link, an attachment convention that reviewers actually follow? Does a reviewer have a second device available at all? If a two-device local-network setup is simply not something App Review will perform, I'd rather know now and plan around it than assume otherwise. Is there a fallback demo path I'm missing? For example, shipping a loopback/self-test mode in the Mac app that exercises the server on 127.0.0.1 and shows the result in the UI, so the entitlement is demonstrably used without a second device. Would that satisfy the "entitlement must be used" requirement on its own? What I'll do either way If the answer is that this cannot be demonstrated reliably, I'll keep the entitlement out and ship the remote feature only in a direct-distribution (notarized, non-sandboxed) build. I'd just rather not find that out through another rejection. Any first-hand experience with local-network / companion-device features on the Mac App Store would help a lot. Thanks.

This is my first driver and I have had the devil of a time trying to find any information to help me with this. I beg help with this, since I cannot find any tutorials that will get me over this problem. I am attempting to write a bridging driver for an older UPS that only communicates via RPC-over-USB rather than the HID Power Device class the OS requires. I have written the basic framework for the driver (details below) and am calling OSSystemExtensionRequest.submitRequest with a request object created by OSSystemExtensionRequest.activationRequest, but the didFailWithError callback is called with OSSystemExtensionErrorDomain of a value of 9, which appears to be a general failure to activate the driver. I can find no other information on how to address this issue, but I presume the issue is one of entitlements in either the entitlements file or Info.plist. I will have more code-based details below. For testing context, I am testing this on a 2021 iMac (M1) running Sequoia 15.7, and this iMac is on MDM, specifically Jamf. I have disabled SIP and set systemextensionsctl developer on, per the instructions here, and I have compiled and am attempting to debug the app using xcode 26.2. The driver itself targets DriverKit 25, as 26 does not appear to be available in xcode despite hints on google that it's out. For the software, I have a two-target structure in my xcode project, the main Manager app, which is a swift-ui app that both handles installation/activation of the driver and (if that finally manages to work) handles communication from the driver via its UserClient, and the driver which compiles as a dext. Both apps compile and use automated signing attached to our Apple Development team. I won't delve into the Manager app much, as it runs even though activation fails, except to include its entitlements file in case it proves relevant <dict> <key>com.apple.developer.driverkit.communicates-with-drivers</key> <true/> <key>com.apple.developer.system-extension.install</key> <true/> <key>com.apple.security.app-sandbox</key> <true/> <key>com.apple.security.files.user-selected.read-only</key> <true/> </dict> and the relevant activation code: func request(_ request: OSSystemExtensionRequest, didFailWithError error: any Error) { // handling the error, which is always code value 9 } func activateDriver() { let request = OSSystemExtensionRequest.activationRequest(forExtensionWithIdentifier: "com.mycompany.driver.bundle.identifier", queue: .main) request.delegate = self OSSystemExtensionManager.shared.submitRequest(request) //... } And finally the Manager app has the following capabilities requested for its matching identifier in our Apple Developer Account: DriverKit Communicates with Drivers System Extension On the Driver side, I have two major pieces, the main driver class MyDriver, and UserClient class, StatusUserClient. MyDriver derives from IDriverKit/IOService.iig but (in case this is somehow important) does not have the same name as the project/target name MyBatteryDriver. StatusUserClient derives from DriverKit/IOUserClient.iig. I have os_log(OS_LOG_DEFAULT, "trace messages") code in every method of both classes, including the initializers and Start implementations, and the log entries never seem to show up in Console, so I presume that means the OS never tried to load the driver. Unless I'm looking in the wrong place? Because I don't think the driver code is the current issue, I won't go into it unless it becomes necessary. As I mentioned above, I think this is a code signing / entitlements issue, but I don't know how to resolve it. In our Apple Developer account, the Driver's matching identifier has the following capabilities requested: DriverKit (development) DriverKit Allow Any UserClient (development) DriverKit Family HID Device (development) -- NOTE: this is planned for future use, but not yet implemented by my driver code. Could that be part of the problem? DriverKit Transport HID (development) DriverKit USB Transport (development) DriverKit USB Transport - VendorID -- submitted, no response from Apple yet HID Virtual Device -- submitted, no response from Apple. yet. This is vestigial from an early plan to build the bridge via shared memory funneling to a virtual HID device. I think I've found a way to do it with one Service, but... not sure yet. Still, that's a problem for tomorrow. Apparently I've gone over the 7000 character maximum so I will add my entitlements and info.plist contents in a reply.

The entitlement documentation page for com.apple.developer.driverkit.family.hid.virtual.device says "To request this entitlement, fill out the request form." I can't find any way to actually request it. In Certificates, Identifiers & Profiles there is no row for that key anywhere — not on an App ID's Capabilities tab, and not under Capability Requests. Capability Requests does list these, with the entitlement key shown in each info tooltip: DriverKit Transport HID — com.apple.developer.driverkit.transport.hid DriverKit Family HID Device — com.apple.developer.driverkit.family.hid.device DriverKit HID EventService — com.apple.developer.driverkit.family.hid.eventservice DriverKit UserClient Access — com.apple.developer.driverkit.userclient-access HID Virtual Device — com.apple.developer.hid.virtual.device So the only virtual-HID entry that exists in the portal is the CoreHID one. What I've built: a DriverKit dext that publishes a software-only HID game controller (no physical bus), so a macOS app can synthesise gamepad input for games that require a real controller. It builds against the DriverKit SDK and is signed. Its entitlements are com.apple.developer.driverkit, .transport.hid and .family.hid.virtual.device. The host-to-dext control channel is a vendor Feature report rather than a custom IOUserClient, so it needs no userclient-access. Questions: Is com.apple.developer.driverkit.family.hid.virtual.device still grantable? If a dext can no longer declare it for distribution, I would rather rebuild on CoreHID's HIDVirtualDevice now than keep building against a key I can't ship. If the DriverKit path is still supported for a virtual HID gamepad, what is the correct complete entitlement group? Karabiner-DriverKit-VirtualHIDDevice ships with com.apple.developer.driverkit + .transport.hid + .family.hid.device + .family.hid.eventservice + com.apple.developer.hid.virtual.device — i.e. a DriverKit dext holding the CoreHID virtual-device entitlement, and no .family.hid.virtual.device at all. Is that the supported shape? If .family.hid.virtual.device has been retired, should its documentation page be updated? Happy to file a Feedback if that's the right route. Not a status request: I do have a Virtual HID request queued and the portal shows it as Submitted, so I'm content to wait. I'd just rather find out now whether it's queued against the right key for what I've built.

It's been 2+ months now since I've submitted an entitlement request for the Notification Service Filtering Entitlement (NSE). I have a mobile app that I transferred from a previous developer account due to business reorganization and the previous account had this entitlement. However, after transferring the app, I am unable to push any updates to the app on iOS because the new developer account does not have the same entitlement. Everything outside of the developer account that the app is associated to remains the same - same workflow, same audience, same app use cases, etc.. However, we still have not had any progress on receiving the entitlement even after multiple escalations and follow-ups with the Apple Developer Support team. I am curious to know if any others within the Developer Community have requested this specific entitlement before and what your experience has been with it? Any advice on how I can expedite the approval for the entitlement? Otherwise our app continues to go stale on the iOS app store.

We went through Apple's CarPlay documentation and, based on what we found, CarPlay provides templates for both Navigation and Audio, and our app has entitlements for both. One thing we would like to confirm before proceeding with implementation is whether a single app can expose both Navigation and Audio experiences in CarPlay, using both entitlements. Specifically, can the same CarPlay app provide a navigation experience (e.g., using CPMapTemplate) while also exposing an Audio/"Now Playing" experience, or does Apple expect these experiences to be implemented as separate apps or otherwise treated as separate CarPlay experiences? We'd also like to confirm whether CarPlay now allows an app to display a split-screen interface with navigation/map content on one side and audio controls or "Now Playing" controls on the other side. If so, is this something a single app with both Navigation and Audio entitlements can implement? The documentation explains the available templates and entitlements, but we couldn't find explicit guidance on whether the same app can leverage both Navigation and Audio experiences or whether these can be presented together in a split-screen layout. We'd like to clarify this before implementing the "Now Playing" screen, to ensure our approach aligns with Apple's CarPlay requirements and guidelines.

Hello, We operate PasskeyGuard, an iOS passkey/FIDO2 authentication app, and are evaluating adding NFC support. We'd like to confirm eligibility before starting development or submitting a formal entitlement request. Intended flow: Our iPhone app acts as the host (Host Card Emulation). Another device reads the iPhone over NFC to perform a FIDO2/WebAuthn authentication (the phone acts as a security-key-style authenticator, transmitting authentication data over NFC to the reading device). Based on the HCE support article, the closest matching category appears to be "Device-to-Device transactions." Our questions: Is a FIDO2/passkey authentication use case eligible under the Device-to-Device HCE entitlement, or does it fall outside the currently supported use cases? If eligible: are we permitted to register a custom applet AID (specifically the FIDO2 NFC AID A0000006472F0001) via CardSession, or is the set of allowed AIDs restricted per use case? Are there requirements beyond an EEA-established Organization account and the general "legal right / regulatory permissions" attestation that apply specifically to an authentication use case? We want to avoid investing development effort against an entitlement that may not be granted for this use case. Any guidance on eligibility and next steps would be greatly appreciated. Thank you, Alexander Friedl