General: Forums topic: Code Signing Forums subtopics: Code Signing > General, Code Signing > Certificates, Identifiers & Profiles, Code Signing > Notarization, Code Signing > Entitlements Forums tags: Code Signing, Signing Certificates, Provisioning Profiles, Entitlements Developer Account Help — This document is good in general but, in particular, the Reference section is chock-full of useful information, including the names and purposes of all certificate types issued by Apple Developer web site, tables of which capabilities are supported by which distribution models on iOS and macOS, and information on how to use managed capabilities. Developer > Support > Certificates covers some important policy issues Bundle Resources > Entitlements documentation TN3125 Inside Code Signing: Provisioning Profiles — This includes links to the other technotes in the Inside Code Signing series. WWDC 2021 Session 10204 Distribute apps in Xcode with cloud signing Certificate Signing Requests Explained forums post --deep Considered Harmful forums post Don’t Run App Store Distribution-Signed Code forums post Resolving errSecInternalComponent errors during code signing forums post Finding a Capability’s Distribution Restrictions forums post Signing code with a hardware-based code-signing identity forums post New Capabilities Request Tab in Certificates, Identifiers & Profiles forums post Isolating Code Signing Problems from Build Problems forums post Investigating Third-Party IDE Code-Signing Problems forums post Determining if an entitlement is real forums post Code Signing Identifiers Explained forums post Mac code signing: Forums tag: Developer ID Creating distribution-signed code for macOS documentation Packaging Mac software for distribution documentation Placing Content in a Bundle documentation Embedding nonstandard code structures in a bundle documentation Embedding a command-line tool in a sandboxed app documentation Signing a daemon with a restricted entitlement documentation Defining launch environment and library constraints documentation WWDC 2023 Session 10266 Protect your Mac app with environment constraints TN2206 macOS Code Signing In Depth archived technote — This doc has mostly been replaced by the other resources linked to here but it still contains a few unique tidbits and it’s a great historical reference. Manual Code Signing Example forums post The Care and Feeding of Developer ID forums post TestFlight, Provisioning Profiles, and the Mac App Store forums post For problems with notarisation, see Notarisation Resources. For problems with the trusted execution system, including Gatekeeper, see Trusted Execution Resources. Share and Enjoy — Quinn “The Eskimo!” @ Developer Technical Support @ Apple let myEmail = "eskimo" + "1" + "@" + "apple.com"

You can now easily request access to managed capabilities for your App IDs directly from the new Capability Requests tab in Certificates, Identifiers & Profiles > Identifiers. With this update, view available capabilities in one convenient location, check the status of your requested capabilities, and see any notes from Apple related to your requests. Learn more about capability requests.

Hiya folks! I'm David and I work on rust-analyzer, which is a language server for Rust similar to sourcekit-lsp. I'm using the new Instruments profiling tooling functionality in Xcode 16.3 and Xcode 26 (Processor Trace and CPU Counters) to profile our trait solver/type checker. While I've been able to use the new CPU Counters instrument successfully (the CPU Bottleneck feature is incredible! Props to the team!), I've been unable to make use of the Processor Trace instrument. Instruments gives me the error message "Processor Trace cannot profile this process without proper permissions". The diagnostic suggests adding the com.apple.security-get-task-allow entitlement to the code I'm trying to profile, or ensure that the build setting CODE_SIGN_INJECT_BASE_ENTITLEMENTS = YES is enabled in Xcode. Unfortunately, I don't know how I can add that entitlement to a self-signed binary produced by Cargo and I'm not using Xcode for somewhat obvious reasons. Here's some information about my setup: Instruments Version 26.0 (17A5241e) I'm on an 14" MacBook Pro with M4 Pro. It's running macOS Version 26.0 Beta (25A5295e). I've enabled the "Processor Trace" feature in "Developer Tools" and even added the Instruments application to "Developer Tools". As a last-ditch effort before posting this, I disabled SIP on my Mac. Didn't help. To reproduce my issue: Get Rust via https://rustup.rs/. Clone rust-analyzer: git clone https://github.com/rust-lang/rust-analyzer.git. cd rust-analyzer Run cargo test --package hir-ty --lib --profile=dev-rel -- tests::incremental::add_struct_invalidates_trait_solve --exact --show-output. By default, this command will output a bunch of build progress with the output containing something like Running unittests src/lib.rs (target/dev-rel/deps/hir_ty-f1dbf1b1d36575fe). I take the absolute path of that hir_ty-$SOME-HASH string (in my case, it looks like /Users/dbarsky/Developer/rust-analyzer/target/dev-rel/deps/hir_ty-f1dbf1b1d36575fe) and add it to the "Launch" profile. To the arguments section, I add --exact tests::incremental::add_struct_invalidates_trait_solve. I then try to record/profile via Instruments, but then I get the error message I shared above. Below is output of codesign -dvvv: ❯ codesign -dvvv target/dev-rel/deps/hir_ty-f1dbf1b1d36575fe Executable=/Users/dbarsky/Developer/rust-analyzer/target/dev-rel/deps/hir_ty-f1dbf1b1d36575fe Identifier=hir_ty-f1dbf1b1d36575fe Format=Mach-O thin (arm64) CodeDirectory v=20400 size=140368 flags=0x20002(adhoc,linker-signed) hashes=4383+0 location=embedded Hash type=sha256 size=32 CandidateCDHash sha256=99e96c8622c7e20518617c66a7d4144dc0daef28 CandidateCDHashFull sha256=99e96c8622c7e20518617c66a7d4144dc0daef28f22fac013c28a784571ce1df Hash choices=sha256 CMSDigest=99e96c8622c7e20518617c66a7d4144dc0daef28f22fac013c28a784571ce1df CMSDigestType=2 CDHash=99e96c8622c7e20518617c66a7d4144dc0daef28 Signature=adhoc Info.plist=not bound TeamIdentifier=not set Sealed Resources=none Internal requirements=none Any tips would be welcome! Additionally—and perhaps somewhat naively—I think I'd expect the Processor Trace instrument to just work with an adhoc-signed binary, as lldb and friends largely do—I'm not sure that such a high barrier for CPU perf counters is warranted, especially on an adhoc-signed binary.

Hello! I recently submitted a request for the Family Controls (Distribution) for my app, and I’d be super happy if i could have some information about how long this process usually takes so i can plan accordingly. It would help immensly since we want to ship the app as soon as possible. I submitted the request around a week ago. Is there anything I can do on my end to help the process move more smoothly? Thanks in advance!

Hi, happy new year, I'm a Product Manager for a communications app that's currently in testflight. We requested the com.apple.developer.usernotifications.filtering entitlement on December 3rd, and have yet to receive a response from Apple. I understand that the holiday break may have gotten in the way, however it feels like we were lost in the queue as it's been 6 weeks with no response. Our app owner has checked-in inside appstoreconnect but has not received anything back. Is this common? Is there any process for getting a status update? Are we doing something wrong? Without this entitlement we cannot make the device ring in the background. The app is a voice and video messaging platform.

Hi all, I'm building an iOS app extension using ExtensionKit that works exclusively with its containing host app, presenting UI via EXHostViewController. I'd like the extension to have read-only access to the host's task for process introspection purposes. I'm aware this would almost certainly require a special entitlement. I know get-task-allow and the debugger entitlement exist, but those aren't shippable to the App Store. I'm looking for something that could realistically be distributed to end users. My questions: Does an entitlement exist (or is one planned) that would grant an extension limited, read-only access to its host's task—given the extension is already tightly coupled to the host? If not, is this something Apple would consider adding? The use case is an extension that needs to inspect host process state without the ability to modify it. Is there a path to request such an entitlement through the provisioning profile process, or is this fundamentally off the table for App Store distribution? It seems like a reasonable trust boundary given the extension already lives inside the host's app bundle, but I understand the security implications. Any insight appreciated. Thanks!

I can't upload my macOS app to app store connect. Each time i try to upload, i see this message: Provisioning profile failed qualification Profile doesn't support App Groups. An empty app without an app group uploads fine, but if i add an app group to it, it does not upload.

Hello, I would like to seek clarification regarding the availability of the NFC Secure Element (SE) / ISO7816 entitlement by region, specifically for Indonesia. I recently contacted Apple Developer Support regarding the use of NFC for reading ISO7816-compatible cards. I was informed that, at this time, the NFC & Secure Element entitlement is not available in Indonesia. For technical planning and compliance purposes, I would like to confirm the following: Is the NFC Secure Element / ISO7816 entitlement currently restricted by region, and is Indonesia officially unsupported at this time? For apps distributed on the App Store in Indonesia, is Core NFC limited to NDEF and non–Secure Element tag reading only? Are there any publicly supported alternatives or recommended architectural approaches for NFC-based workflows in regions where the Secure Element entitlement is unavailable? Is there any public documentation or guidance that outlines regional availability for NFC Secure Element features? I understand that entitlement approvals and availability may vary by region and are handled on a case-by-case basis. Any clarification from Apple engineers or developers with experience in this area would be greatly appreciated. Thank you for your time and assistance. Best regards.

I have applied for CarPlay support here Apply here to get your app approved for CarPlay use: https://developer.apple.com/contact/carplay/ but have not received any acceptance or answers. Does anyone know what to do?

Dear Apple Developer Support Team, We are seeking a solution that would allow us to include the CarPlay entitlement while distributing our app using an enterprise profile. Could you please provide guidance on how we might achieve this? Are there any alternative approaches or considerations that could help us navigate this limitation? Your expertise and advice would be greatly appreciated as we work to ensure our app meets the needs of our users while complying with Apple’s guidelines. Thank you for your time and support.

I am developing CarPlay addition on our app. Which is distributed with the Enterprise In distribution method, so we do not have a product in the App Store. I am wondering if CarPlay support can be provided in applications distributed with the Enterprise in distribution method? If this is not possible, I will inform management that this is not possible. I am waiting for your answers, thanks.

Hello, I'm experiencing a significant delay getting the Family Controls entitlement approved for my Shield Configuration Extension, and I'm hoping someone here can help or has experienced something similar. Background: I'm developing an app that uses the Screen Time API with Family Controls. My main app bundle (lukedev.Bloka) was approved for Family Controls (Distribution) and works perfectly. The Problem My Shield Configuration Extension (lukedev.Bloka.Shield) has been stuck waiting for approval for over 2 weeks: Request ID: 6C8LD22UVM Submitted: November 20, 2025 Status: Still "Submitted" Current State: Only shows "Family Controls (Development)" in capabilities What I've Tried ✅ Submitted entitlement request via the proper channels ✅ Contacted Apple Developer Support (case #102762028251) ✅ Verified the main app has full Family Controls approval ✅ Deleted and regenerated all provisioning profiles multiple times ✅ Confirmed the App ID configuration is correct in the Developer Portal The Issue Without Family Controls (Distribution) approval for the Shield extension, I cannot: Test the complete app functionality on physical devices Submit the app to App Store Connect Move forward with development The error I'm getting during provisioning: Provisioning profile failed qualification Profile doesn't include the com.apple.developer.family-controls entitlement Questions Has anyone experienced multi-week delays for Shield extension entitlements? Is this normal? Should Shield extensions automatically inherit entitlements from the main app, or do they really require separate approval? The documentation isn't clear on this. Are there any known workarounds to test Shield Configuration Extensions during development while waiting for distribution approval? How can I escalate this request? Developer Support initially told me I already had approval (for the main app) but didn't address the extension's separate bundle ID. Technical Details Xcode: 16.2 Target: iOS 18+ Main App: Family Controls (Distribution) ✅ Approved Shield Extension: Family Controls (Development only) ❌ Stuck Why This Matters The Shield Configuration Extension is a core component of Screen Time API apps - it's not optional. Without it, the app cannot properly display blocking interfaces. The fact that it requires a separate 2+ week approval process (after the main app was already approved) seems like a significant oversight in Apple's review process. Has anyone successfully navigated this situation or found a way to expedite the review? Any help or insights would be greatly appreciated! Thanks, Luca

General: Forums topic: Family Controls Forums tag: Family Controls Configuring Family Controls documentation Requesting the Family Controls entitlement documentation Screen Time Technology Frameworks documentation FamilyControls documentation What's new in Screen Time API video Meet the Screen Time API video

When setting new entitlements com.apple.developer.networking.carrier-constrained.appcategory and com.apple.developer.networking.carrier-constrained.app-optimized, I have a question about how URLSession should behave. I notice we have a way to specify whether a Network connection should allow ultra-constrained paths via NWParameters allowUltraConstrainedPaths: https://developer.apple.com/documentation/network/nwparameters/allowultraconstrainedpaths There does not appear to be a similar property on URLSessionConfiguration. In an ultra-constrained (eg. satellite) network, should we expect all requests made through an URLSession to fail? Does all network activity when ultra-constrained need to go through a NWConnection or NetworkConnection specifically configured with allowUltraConstrainedPaths, or can URLSession ever be configured to allow ultra-constrained paths?

Hello, I am working to integrate the new com.apple.developer.networking.carrier-constrained.app-optimized entitlement in my iOS 26 app so that my app can use a carrier-provided satellite network, and want to confirm my understanding of how to detect and optimize for satellite network conditions. (Ref: https://developer.apple.com/documentation/bundleresources/entitlements/com.apple.developer.networking.carrier-constrained.app-optimized ) My current approach: I plan to set the entitlement to true once my app is optimized for satellite networks. To detect if the device is connected to a satellite network, I intend to use the Network framework’s NWPath properties: isUltraConstrained — I understand this should be set to true when the device is connected to a satellite network. (Ref: https://developer.apple.com/documentation/network/nwpath/isultraconstrained ) linkQuality == .minimal — I believe this will also be set in satellite scenarios, though it may not be exclusive to satellite connections. (Ref: https://developer.apple.com/documentation/network/nwpath/linkquality-swift.enum/minimal ) Questions: Is it correct that isUltraConstrained will reliably indicate a satellite connection? Should I also check for linkQuality == .minimal, or is isUltraConstrained sufficient? Are there any additional APIs or best practices for detecting and optimizing for satellite connectivity that I should be aware of? Thank you for confirming whether my understanding and approach are correct, and for any additional guidance.

Hi all, I’m building an iOS app that uses CoreNFC to communicate with a YubiKey 5C NFC over ISO14443 / ISO7816 and send APDUs (e.g. select an applet by AID). Environment • Device: iPhone 13 Pro Max • iOS: 18.6.2 • Xcode: 26.1.1 (17B100) • API: NFCTagReaderSession(pollingOption: .iso14443) using NFCTag.iso7816 What I’m trying to do 1. Start NFCTagReaderSession(.iso14443) 2. Detect tag → connect 3. Send ISO7816 APDUs (SELECT AID, etc.) Issue A — Entitlements / signing If I add ISO7816-related NFC entitlements, Xcode fails signing with an error like: • “Provisioning profile … doesn’t match entitlements file value for com.apple.developer.nfc.readersession.formats” When I inspect the generated .mobileprovision, I only see something like: • com.apple.developer.nfc.readersession.formats = [NDEF, TAG, PACE] …and I do not see an ISO7816 / select-identifiers entitlement (and the Developer portal UI doesn’t appear to let me enable it). Questions: 1. Is ISO7816 access under com.apple.developer.nfc.readersession.formats restricted and requires Apple approval? If yes, what’s the correct request process? 2. Is com.apple.developer.nfc.readersession.iso7816.select-identifiers required for sending ISO7816 APDUs? If yes, how do developers obtain it / enable it for an App ID + provisioning profiles? 3. What is the Apple-supported way to configure entitlements/profiles for CoreNFC ISO7816 APDU communication with a token like a YubiKey? Issue B — Runtime NFC error Separately (even when I can run), I intermittently/consistently get: • NFCError Code=104 (“Tag is not connected”) This occurs after the tag is detected/connected when trying to establish a session or send APDUs. I’ve verified: • No phone case interference • Correct placement • Consistent detection “tick” from the phone for "Ready to Scan" prompt after tapping YubiKey 5C NFC device. If helpful, I can share: • A minimal sample project • The exact entitlements I tried • Console logs around the Code 104 failure Thanks!

I want to help contribute a feature in a virtual-machine app in macOS that supports PCIe device passthrough over thunderbolt. I have a question about the entitlements. Since I do not represent the GPU vendors, would I be allowed to get a driver signed that matches GPU vendor IDs? Is there such a thing as wildcard entitlement for PCIDriverKit? I don't want end-users to have to disable SIP to be able to use this. Any suggestions/leads? Thank you.

“Side Button Access” Capability cannot be found under capabilities and when trying to add the entitlement com.apple.developer.side-button-access.allow manually, I got the invalid entitlement error. Xcode: 26.2, MacOS: 26.2.

We are planning to migrate our application from an iOS In‑App Purchase (IAP) subscription flow to an external web purchase flow. The intended user journey is: The user taps a “Subscribe” button in the app. The user is redirected to a web-based checkout to complete the purchase. The user returns to the app, and subscription access is unlocked based on entitlement verification from our backend. Our app is currently listed in the Education category. Before we begin this refactor, we would like confirmation on the following: Entitlements / permissions Do we need to request any specific Apple entitlements or approvals to implement this external purchase flow (e.g., external link or alternative payment related permissions)? Compliance / review requirements Are there any specific App Review compliance checks, disclosures, or review process requirements we must satisfy when moving from IAP to an external purchase flow? If relevant, are there constraints based on app category (Education) or product type (subscription)?

I have an open NFC Value-Added Services entitlement case (17370116) with Apple Wallet Entitlements. My request was acknowledged, information provided, but the case appears to have been split into duplicates and stalled. Is there a way to have the case consolidated and routed back to the Wallet Entitlements team?

Environment: Device: iPhone 15 iOS Version: 26.2 Xcode Version: (add your version) Signing: Automatic with Apple Developer account Problem: When calling NFCTagReaderSession.begin(), the session immediately fails with error code 2: "Missing required entitlement". This happens even though: NFCTagReaderSession.readingAvailable returns true NFCNDEFReaderSession.readingAvailable returns true The session object is created successfully Configuration verified: BonoResidente.entitlements: Info.plist (relevant keys): NFCReaderUsageDescription This app needs NFC permission to read transport cards com.apple.developer.nfc.readersession.iso7816.select-identifiers D2760000850101 Apple Developer Portal: App ID com.acalvoelorri.BonoResidente has "NFC Tag Reading" capability enabled Provisioning profiles were regenerated after enabling the capability Xcode: "Near Field Communication Tag Reading" capability added via Signing & Capabilities CODE_SIGN_ENTITLEMENTS correctly points to the entitlements file Automatic signing enabled with valid Development Team Steps taken: Deleted app from device Clean Build Folder (Cmd+Shift+K) Deleted and re-added the NFC capability in Xcode Manually enabled NFC Tag Reading in Apple Developer Portal Rebuilt and reinstalled the app Code: import CoreNFC class NFCReaderService: NSObject, ObservableObject, NFCTagReaderSessionDelegate { @Published var lastReadData: String = "" @Published var isReading: Bool = false private var session: NFCTagReaderSession? func startReading() { guard NFCTagReaderSession.readingAvailable else { lastReadData = "NFC not available on this device" return } session = NFCTagReaderSession( pollingOption: [.iso14443, .iso15693, .iso18092], delegate: self ) session?.alertMessage = "Hold your transport card near the iPhone" session?.begin() isReading = true } func tagReaderSessionDidBecomeActive(_ session: NFCTagReaderSession) { print("NFC session active") } func tagReaderSession(_ session: NFCTagReaderSession, didInvalidateWithError error: Error) { // Error occurs here immediately after begin() print("Error: \(error)") } func tagReaderSession(_ session: NFCTagReaderSession, didDetect tags: [NFCTag]) { // Never reached } } Console logs: ========== NFC DEBUG INFO ========== iOS Version: 26.2 Device Model: iPhone Device Name: iPhone System Name: iOS NFCTagReaderSession.readingAvailable: true NFCNDEFReaderSession.readingAvailable: true Bundle ID: com.acalvoelorri.BonoResidente Creating NFCTagReaderSession with pollingOption: [.iso14443, .iso15693, .iso18092]... Session created: Optional(<NFCTagReaderSession: 0x110fa50e0>) Setting alertMessage... Calling session.begin()... session.begin() completed, isReading = true ========== NFC ERROR DEBUG ========== Full error: Error Domain=NFCError Code=2 "Missing required entitlement" UserInfo={NSLocalizedDescription=Missing required entitlement} Error type: NFCError Localized: Missing required entitlement NSError domain: NFCError NSError code: 2 NSError userInfo: ["NSLocalizedDescription": Missing required entitlement] Questions: Is there a known issue with NFCTagReaderSession entitlements on iOS 26.2? Are there additional entitlements required beyond com.apple.developer.nfc.readersession.formats with value TAG? How can I verify that the installed app's provisioning profile actually contains the NFC entitlement? Any help would be appreciated. Thank you.