General: Forums topic: Code Signing Forums subtopics: Code Signing > General, Code Signing > Certificates, Identifiers & Profiles, Code Signing > Notarization, Code Signing > Entitlements Forums tags: Code Signing, Signing Certificates, Provisioning Profiles, Entitlements Developer Account Help — This document is good in general but, in particular, the Reference section is chock-full of useful information, including the names and purposes of all certificate types issued by Apple Developer web site, tables of which capabilities are supported by which distribution models on iOS and macOS, and information on how to use managed capabilities. Developer > Support > Certificates covers some important policy issues Bundle Resources > Entitlements documentation TN3125 Inside Code Signing: Provisioning Profiles — This includes links to the other technotes in the Inside Code Signing series. WWDC 2021 Session 10204 Distribute apps in Xcode with cloud signing Certificate Signing Requests Explained forums post --deep Considered Harmful forums post Don’t Run App Store Distribution-Signed Code forums post Resolving errSecInternalComponent errors during code signing forums post Finding a Capability’s Distribution Restrictions forums post Signing code with a hardware-based code-signing identity forums post New Capabilities Request Tab in Certificates, Identifiers & Profiles forums post Isolating Code Signing Problems from Build Problems forums post Investigating Third-Party IDE Code-Signing Problems forums post Determining if an entitlement is real forums post Code Signing Identifiers Explained forums post Mac code signing: Forums tag: Developer ID Creating distribution-signed code for macOS documentation Packaging Mac software for distribution documentation Placing Content in a Bundle documentation Embedding nonstandard code structures in a bundle documentation Embedding a command-line tool in a sandboxed app documentation Signing a daemon with a restricted entitlement documentation Defining launch environment and library constraints documentation WWDC 2023 Session 10266 Protect your Mac app with environment constraints TN2206 macOS Code Signing In Depth archived technote — This doc has mostly been replaced by the other resources linked to here but it still contains a few unique tidbits and it’s a great historical reference. Manual Code Signing Example forums post The Care and Feeding of Developer ID forums post TestFlight, Provisioning Profiles, and the Mac App Store forums post For problems with notarisation, see Notarisation Resources. For problems with the trusted execution system, including Gatekeeper, see Trusted Execution Resources. Share and Enjoy — Quinn “The Eskimo!” @ Developer Technical Support @ Apple let myEmail = "eskimo" + "1" + "@" + "apple.com"

You can now easily request access to managed capabilities for your App IDs directly from the new Capability Requests tab in Certificates, Identifiers & Profiles > Identifiers. With this update, view available capabilities in one convenient location, check the status of your requested capabilities, and see any notes from Apple related to your requests. Learn more about capability requests.

Hello, This is a code-signing / entitlement-process question. The USB API details are included only to explain why the entitlement is required. We maintain a macOS VDI client distributed with Developer ID (outside the Mac App Store, notarized). USB redirection uses SPICE usbredir over libusb 1.0.30. To redirect USB mass-storage devices and printers, the macOS kernel drivers must be detached before the device can be claimed. libusb does this in darwin_detach_kernel_driver_locked(): it calls IOServiceAuthorize() and then USBDeviceReEnumerate() with kUSBReEnumerateCaptureDeviceBit. The public IOUSBLib.h header documents that this requires either: 1. the com.apple.vm.device-access entitlement plus a successful IOServiceAuthorize(), or 2. root privileges.Running the whole VDI client as root is not acceptable, so we need the entitlement on a Developer ID build. Without it, libusb returns LIBUSB_ERROR_ACCESS when detaching the kernel driver for these devices, which is the only blocker for the feature. In Certificates, Identifiers & Profiles -> Identifiers -> App ID -> Capabilities, the only USB-related entries we see are "Claim USB Accessory" (com.apple.developer.accessory-access.usb) and "DriverKit USB Transport (development)". com.apple.vm.device-access is not listed, and we could not find a request form for it. Could DTS or the entitlements team clarify: Is com.apple.vm.device-access still granted to Developer ID apps? What is the correct request channel (capability request, entitlement request form, TSI, or a Developer ID provisioning profile)? On macOS 27+, is Accessory Access + Claim USB Accessory the supported replacement for IOUSBFamily device capture? Does it expose raw USB transfers suitable for forwarding a device to a remote guest OS over a protocol such as usbredir, or is it limited to local Virtualization.framework VMs? If com.apple.vm.device-access is not available for this use case, is a DriverKit USB transport extension the recommended architecture for a libusb-based redirection client? Any guidance on the correct request process would be appreciated. We can provide the bundle ID, Team ID, target macOS versions, device classes, and user-consent/security design privately if needed. Thanks, liyucai

It's been 2+ months now since I've submitted an entitlement request for the Notification Service Filtering Entitlement (NSE). I have a mobile app that I transferred from a previous developer account due to business reorganization and the previous account had this entitlement. However, after transferring the app, I am unable to push any updates to the app on iOS because the new developer account does not have the same entitlement. Everything outside of the developer account that the app is associated to remains the same - same workflow, same audience, same app use cases, etc.. However, we still have not had any progress on receiving the entitlement even after multiple escalations and follow-ups with the Apple Developer Support team. I am curious to know if any others within the Developer Community have requested this specific entitlement before and what your experience has been with it? Any advice on how I can expedite the approval for the entitlement? Otherwise our app continues to go stale on the iOS app store.

Hi all, Our iOS app is an end-to-end encrypted collaboration app with live customers. It was transferred to our new developer team on October 14. Before the transfer, the app had the Notification Service Extension Filtering entitlement. The entitlement did not carry over to the receiving team, and we didn't realize that until after the transfer was complete. Our pushes are end-to-end encrypted, so we can't ship a build with important updates to our customers without it. What we've done so far: Submitted the entitlement request (Request ID: 3T2KH34RB3) Opened an Apple Developer Support case on October 26 (Case #103009182658) asking for the request to be expedited Followed up by email several times and through the support form, with no response so far Our questions: Is there a process for restoring a previously approved entitlement to the receiving team after an app transfer, rather than going through a new review? Can someone confirm our request is in the review queue and share an estimated timeline? Is there anything else we can provide to help move this forward?

I'm posting this here after reading Quinn's post here: https://developer.apple.com/forums/thread/799000 The above entitlement is mentioned in IOUSBHostControllerInterface.h. It isn't an entitlement one can add using the + button on the Capabilities panel in Xcode. If I try to add it by hand, Xcode complains that it isn't in my profile. Is this a managed entitlement? We'd like to create a local USB "device" to represent a real device reachable over a network.

I build a Chromium-based web browser for macOS. It's signed with Developer ID, notarized and distributed outside the Mac App Store. On 27 October I requested the managed capability Web Browser Public Key Credential Requests (com.apple.developer.web-browser.public-key-credential) for my App ID. On the App ID's Capability Requests tab it still shows "Submitted", with no email since. I need it for iCloud Keychain passkeys, and so that Apple's iCloud Passwords browser extension can start its helper. Users are reporting that the extension doesn't work. Request ID: H543AX456N Developer Support case: 30000006313896 (they're administrative and suggested I ask here) My questions: is there anything else I should send for this review, and is there somewhere to follow up on a pending capability request? And once it's approved, will the capability be included in a Developer ID provisioning profile, or only in Mac App Store profiles? Thanks!

I have not seen a clear answer about this: https://developer.apple.com/forums/thread/776657 https://developer.apple.com/forums/thread/743639?answerId=775701022#775701022 Thus, I would like to pose: Is there any way to install a DriverKit extension locally for development and testing using a free developer account, or is development of DriverKit extensions gated behind a paid developer account? Thank you!

We develop an iPhone app that performs user-started Bluetooth discovery for 1–5 minutes, with visible progress, cancellation and a Live Activity. We need to discover arbitrary BLE advertisers, including nonconnectable devices, and receive repeated RSSI samples during that bounded scan. The app declares bluetooth-central, creates its central manager before starting the Live Activity in the foreground, and scans with nil service filters and duplicates enabled. Discovery continues behind another app while the display is on, but saved observation timestamps stop advancing after the phone is locked with its display off. We understand the restriction described in https://developer.apple.com/forums/thread/815189. Is there an iPhone managed entitlement or supported program that permits this use case? If so, what are the eligibility criteria and application route? We also found com.apple.developer.bluetooth-central-screen-off-scanning mentioned in https://developer.apple.com/forums/thread/835684. That discussion concerns watchOS medical use; we are asking whether any corresponding iPhone capability exists. If no route exists, should we submit an enhancement request through Feedback Assistant?

I'm testing Apple's official "Capturing screen content on iOS" sample architecture using Xcode 27.2 and a physical iPhone running iOS 27.2. My application builds, signs and launches successfully using a Personal Team without the screen-recording entitlement. However, when I add the entitlement required by Apple's sample, automatic provisioning fails with: "Entitlement com.apple.developer.screen-recording not found and could not be included in profile. This likely is not a valid entitlement and should be removed from your entitlements file." The generated provisioning profile does not contain the entitlement. Could Apple clarify: Is this entitlement available to Personal Teams for development? Does it require Apple Developer Program membership or separate capability approval? What is the supported procedure for obtaining a provisioning profile that includes it? Is there a known issue with entitlement availability or the iOS 27 sample? Our intended use is explicitly authorised full-display capture using the system picker, with on-device processing and no attempt to bypass user consent. I would appreciate guidance on the correct supported provisioning procedure.

Our (sandboxed, distributed through the Mac App Store) app can optionally run as a CLI tool, to allow users to use it in scripts and other automation contexts. One of the usecases involves being a wrapper for the ssh command, but the ssh binary is not able to enable raw mode for stdin due to a sandbox violation (bug report). As a reduced example, I've created https://github.com/mihaip/sandboxed-cli-test, which has a minimal C program that uses tcsetattr to set attributes on stdin. That fails, and sandboxd logs to the console Sandbox: SandboxedCLI(30110) deny(1) file-ioctl /dev/ttys012. If I disable sandboxing on the binary then it works as expected. Looking through the sandbox profiles on /System/Library/Sandbox/Profiles, I'm not seeing cases where file-ioctl is enabled on /dev/tty. Are we out of luck, or is there a workaround?

Hello, I am Ahmed Hamade, founder of Pixel Ventures LLC, Apple Developer Program Team ID LM3P28DNVQ. I am asking Apple to grant the restricted entitlement com.apple.developer.vfs.snapshot to our team for a macOS backup application named PixelProtect. If this is not the right channel, please tell me where to send the request. PixelProtect backs up a whole Mac volume. It keeps one primary backup set on a local disk and a replica of that same set in cloud storage, protects both copies against deletion, and supports recovery. We built it for people whose AI coding agents can delete data. We need snapshots for three reasons. First, files change while a backup runs, so the backup must read from one point in time to copy a consistent state. Second, snapshots let us keep local restore points without copying the data again. Third, Time Machine takes local snapshots for the same purpose. The only alternative today is tmutil localsnapshot, whose snapshots the system manages and ages out, so we could not keep restore points of our own. We would use fs_snapshot_create, fs_snapshot_list, fs_snapshot_delete and fs_snapshot_mount. We do not use fs_snapshot_revert. Restores copy files out of a mounted snapshot. Only our privileged helper calls these functions. It runs as root, is registered with SMAppService, and is packaged as an app-like bundle (planned App ID ai.pixelventures.pixelprotect.daemon) so it can embed a provisioning profile. The main app (ai.pixelventures.pixelprotect) and our command line tool send requests to the helper and do not call these functions. We limit use as follows. Snapshots are created only on volumes the user chose to back up. The user controls how long snapshots are kept. The helper deletes only snapshots it created, which carry our own name prefix, and only under the user's retention rules or an action the user confirms. PixelProtect is signed with our Developer ID Application certificate, uses the hardened runtime, is notarized, and is distributed outside the Mac App Store to Pixel Ventures clients. It is not sandboxed, because a whole-volume backup reads the whole volume. It has no public marketing page yet, so a product description is attached. Please enable the entitlement for Team ID LM3P28DNVQ for development and for Developer ID distribution, or tell me what further information you need. I tried the code-level support request form and it requires a sample project, so I am asking here as the form suggested Thank you, Ahmed Hamade Founder, Pixel Ventures LLC Team ID LM3P28DNVQ I tried the code-level support request form and it requires a sample project, so I am asking here as the form suggested

For certain development tasks, I need to disable System Integrity Protection (SIP) (csrutil disable). After I am done doing my tests, I reenable SIP. Additionally, SIP has a number of unsupported configurations. For example, csrutil enable --without debug enables all system integrity protections except debugging. My question concerns the com.apple.rootless.install.heritable entitltement, which, from my understanding, allows any app to gain root access without authorization of the user. I would like to know whether any app give itself this entitlement without my authorization when (1) SIP is fully disabled (csrutil disable) and when (2) SIP is partially disabled in the aforementioned specific unsupported configuration (csrutil enable --without debug).

Could someone help expedite our pending DriverKit USB distribution review request? Our driver works under development signing, but approval is blocking a TestFlight pilot for our accessibility product. Request: 8AR5R3NKZD Submitted October 18, 2026 (still "Submitted") Team: 7U9T57JPF7 Capability: DriverKit USB Transport – VendorID USB: VID 6790 (0x1A86), PID 29987 (0x7523) Support case: 103013236358 Thank you!

Hello, I requested "Family Controls (Distribution)" for one of my apps. I received email that the entitlement is granted and I can use it: Hello XXXX The entitlement for Family Controls (Distribution) has been assigned to your account, and you can now configure this capability for eligible apps. If you’re enrolled as an organization, Admins on your team can also use this capability. However, on the identifiers page, the status still shows as "No Requests". Additionally, I see nowhere any other indicator. I opened a case with the ID 102999908799 but didnt receive any response. Anybody knows what to do? Thank you.

In August 2026 we requested the Local Push Connectivity entitlement. On September 12 we received two emails one minute apart: the automated "Network Extension (additional values) entitlement confirmation" from developer@email.apple.com, followed by a reply from Local Push Review ("Re: Requesting Network Extension App Push Entitlement") stating the request was "approved for development and testing purposes only. If and when you have a product ready for the store, please resubmit your request and include a description of your product." We built the NEAppPushProvider, tested it on the vessel's Wi-Fi, and resubmitted through the same request page on September 15. On October 20 we received only the same automated "Network Extension (additional values) entitlement confirmation" — identical wording to September 12 — and no reply from Local Push Review. Since the same automated confirmation accompanied the development-only approval, we can't tell what the October 20 assignment means. The App ID editor shows Network Extension (additional values) either way. Is our resubmission approved for App Store distribution, or is it still pending review? Our team ID is M4S46K7L33.

Heyo everyone! Since Xcode 27 (27.0, 27.1, and 27.2 RC), I have not been able to export builds to the App Store through Xcode Cloud that have app-usage on the com.apple.developer.user-fonts key in the entitlements file. For some inexplicable reason, it seems as though Xcode Cloud's automatic signing is trying to map to the Font Enumeration capability instead of the other Fonts capability? Since I don't have this, it fails. However, I can archive and export these builds to App Store just fine on my local device using 27.1. Here is what Xcode Cloud's logs are spitting back: error: exportArchive Automatic signing cannot update bundle identifier “XXX”. Automatic signing cannot update your registered bundle identifier to enable Font Enumeration. Update your bundle identifier on https://developer.apple.com/account and then try again. And ideas or am I alone on this island?

I have requested two entitlements for my driver: "DriverKit USB Transport - VendorID" and "DriverKit UserClient Access" I have submitted them in Sep 20, and got no response or ETA on it. It's the only thing blocking the release of my driver. Request ID: C9ULM24X2U Team: F34U2UUGXX Status: Submitted What can I do to expedite this?

Hello, we are ANeT, an EU-based manufacturer and developer of physical access control and attendance systems. We develop our own access control platform, including: our own NFC access readers (PASO), access controllers, backend and management software (Webguard), credential and user management. Our goal is to support employee/access credentials in Apple Wallet so that users can unlock doors using an iPhone or Apple Watch, ideally also using Express Mode. We would like to implement this directly into our own access control ecosystem, without using a third-party credential platform or third-party NFC reader hardware. From the Apple documentation, our understanding is that Access Keys use a credential stored in the Secure Element together with a pass in Apple Wallet, and that communication between Apple Wallet and the reader uses the Aliro protocol over NFC. We also understand that a physical access provider can act as a Credential Manager and that participation in the Apple Wallet Access Program is required. Our intended architecture is: Webguard / ANeT backend → Apple Wallet Access credential → iPhone / Apple Watch → our PASO NFC reader → ANeT access controller → door We would appreciate clarification on the following technical points: Is this architecture supported for a physical access control manufacturer using its own NFC reader hardware and firmware? What technical requirements must our NFC reader meet to communicate with Apple Wallet Access Keys using Aliro? Are there specific requirements or certification procedures for reader identification, ECP, certificates, keys, or the reader trust chain? Can our Webguard/backend platform act directly as the Credential Manager and provision, manage and revoke Access Keys through the Apple Access Platform? Can credential provisioning be initiated from a web interface using an “Add to Apple Wallet” flow, or is a native iOS application required? Which entitlements, certificates, APIs and technical documentation become available after joining the Apple Wallet Access Program? Is Apple Wallet Access for employee/physical access credentials available for access control providers operating in the European Union, including the Czech Republic? We contacted Apple Developer Support regarding this integration and were advised to ask the technical questions here on the Developer Forums. Developer Support case: 102991167219 Our objective is not to create a standard Wallet pass or QR credential. We want to integrate secure NFC-based physical access credentials directly with Apple Wallet, our own backend and our own reader hardware. Thank you for any guidance on the correct technical integration path.

I'm developing Androfest, a native Android app with a SwiftUI macOS companion. It provides user-authorized notification forwarding, automatic clipboard synchronization, file transfer, and phone-call controls, with experimental call-audio relay. I need a secure, direct connection between a nearby Android phone and a Mac without requiring both devices to join the same Wi-Fi network or using a cloud relay. Discovery, authenticated pairing, and a bidirectional IP data path are the requirements; application traffic uses certificate-pinned TLS. The Android side uses WifiAwareManager. My development devices are a Galaxy S24 FE running Android 16 / One UI 8 and an Apple silicon M4 Pro Mac running macOS 27.2. I read the DTS answer in “Do Mac computers support Wi-Fi Aware?” (https://developer.apple.com/forums/thread/827887), which explains that the presence of the framework for Mac Catalyst does not imply usable Wi-Fi Aware support on Mac. I am asking specifically about the provisioning information below and whether there is an approved path for this use case. In Certificates, Identifiers & Profiles → Register an App ID → Capabilities → Wi-Fi Aware, the information popover currently shows: Platform Support: iOS Provisioning Support: Development, Ad hoc, App Store Connect, Developer ID Entitlement Keys: com.apple.developer.wifi-aware This is confusing because Developer ID is listed while macOS is not listed under Platform Support. The native macOS SDK declarations I inspected mark the public Wi-Fi Aware APIs unavailable on macOS. Two previously generated Developer ID provisioning profiles for my test App ID had Platform = OSX, but neither contained com.apple.developer.wifi-aware. I also could not find a Wi-Fi Aware-specific approval request in the portal's Capability Requests list. Could Apple clarify the following? Does the Developer ID entry describe a usable configuration for native macOS or Mac Catalyst applications, or is it a portal metadata issue? Is there a supported API, managed entitlement, or approval process for Wi-Fi Aware discovery and IP data paths between a third-party macOS app and an Android device? If so, which target platform, capability, provisioning-profile type, and signing configuration are required? Can that configuration operate on a standard Mac with SIP enabled, default NVRAM/boot arguments, and normal code-signing enforcement? A distributable application needs to work under those conditions. If Wi-Fi Aware is not supported for this scenario, what supported transport would Apple recommend for router-independent Android–Mac communication? Where should I file an enhancement request, and should the portal's Developer ID entry be reported separately? I would appreciate guidance on the supported integration route and any missing provisioning or entitlement step. Thank you.

Hi everyone and Apple Team, please help me to solve the problem with transferring a macOS app built by Electron. I didn't change any options related to sandbox or app groups at all; I'm just using default settings. My app doesn't have any data with other apps. It seems like a huge challenge, and I still haven't solved it after three months. Thanks for your advice.

I’m developing an ARM64-native Wine + FEX compatibility runtime on Apple Silicon, without relying on Rosetta 2. According to the August 2026 Wine-devel discussion, the following entitlement is intended to be available to free developer accounts: com.apple.developer.cross-architecture-support-unmanaged However, I have encountered the following issues: My Xcode Personal Team does not offer a “Cross-architecture Compatibility Framework” capability. Certificates, Identifiers & Profiles is inaccessible to my free developer account. I cannot obtain a provisioning profile authorizing this entitlement. I contacted Apple Developer Support. They explained that entitlement requests generally require an Apple Developer Program Account Holder, but were unable to confirm whether this particular entitlement is currently requestable or where to request it. Could an Apple engineer clarify: Is the unmanaged entitlement currently available to free Personal Teams? What is the official App ID, provisioning profile, and code-signing procedure? Does this entitlement require additional approval from Apple? If it is unavailable, is there an officially supported alternative for development of an ARM64-native Wine loader? My goal is to use the native macOS cross-architecture features while keeping SIP and other security protections enabled. Relevant Wine-devel discussion: https://list\.winehq\.org/hyperkitty/list/wine\-devel%40list\.winehq\.org/thread/CKG5CEN2BE5VRXZ7O7NX4YUSBH3247WH/ Thank you.