You can now easily request access to managed capabilities for your App IDs directly from the new Capability Requests tab in Certificates, Identifiers & Profiles > Identifiers. With this update, view available capabilities in one convenient location, check the status of your requested capabilities, and see any notes from Apple related to your requests. Learn more about capability requests.

I’m seeing a reproducible code-signing failure on macOS 26.6.2 with Xcode 26.6 while building an iOS XCTest bundle for a physical device. A newly created Apple Development identity is valid and can successfully sign and verify a standalone test binary using /usr/bin/codesign. However, xcodebuild build-for-testing reaches the first XCTest re-sign operation and the macOS Keychain authorization dialog for the same development private key becomes unresponsive after entering the login Keychain password and clicking “Always Allow.” The failing command is effectively: /usr/bin/codesign --force --sign -o runtime --timestamp=none ... libXCTestSwiftSupport.dylib and returns: errSecInternalComponent The exact same development certificate successfully signs a standalone binary immediately beforehand. The build is running from an ordinary logged-in Terminal session, not SSH or CI. After aborting the build, inspection showed the XCTest artifacts retained Apple’s original Software Signing certificate rather than the Development certificate, confirming the re-sign did not complete. I have already recreated the login Keychain once and recreated the Apple Development identity. I do not want to make further Keychain ACL/partition changes without understanding the underlying cause. Question: What diagnostic should I collect to determine why SecurityAgent/codesign cannot complete private-key authorization for the XCTest re-sign operation when direct signing with the same identity succeeds?

App Store Connect rejects my iOS Flutter app with error 90035: “Code failed to satisfy specified code requirement(s).” The error affects the main app executable, App.framework, and Flutter.framework. Environment: macOS 26.5.2 Xcode 26.6 Flutter 3.44.8 Individual Apple Developer Program membership The Release archive and App Store IPA build successfully. The exported IPA is signed with an Apple Distribution certificate and contains the correct TeamIdentifier. However, verification reports: Runner.app: valid on disk Runner.app: does not satisfy its designated Requirement The certificate Common Name contains a non-ASCII character: “Ç”. The generated designated requirement appears to represent this character using a decomposed Unicode form. I suspect a Unicode-normalization mismatch between the certificate Common Name and the embedded designated requirement. I am also unable to create a local Apple Distribution certificate: Xcode Manage Certificates reports: “The data couldn’t be read because it isn’t in the correct format.” The Apple Developer certificate portal reports “An unexpected error occurred” after I upload a valid CSR. Has anyone encountered this issue when an Apple Distribution certificate Common Name contains a non-ASCII character? Is there a supported way to regenerate the cloud-managed certificate or have Apple repair the team’s certificate state? I can provide sanitized codesign output if an Apple engineer needs additional diagnostic information.

Hello, I am experiencing persistent ITMS-90034 when trying to upload the first iOS app from a newly enrolled Individual Apple Developer Program account. The exact error is: Validation failed (409) Missing or invalid signature. The bundle at "Payload/[App].app" is not signed using an Apple submission certificate. (ID: 90034) I have already performed extensive signing checks and troubleshooting: Apple Developer Program membership is active. A valid Apple Distribution certificate is installed in Keychain together with its private key. security find-identity -v -p codesigning reports both Apple Development and Apple Distribution as valid identities. The correct Team and Bundle ID are selected. Automatic signing is enabled in Xcode. Provisioning profile caches and DerivedData were deleted, profiles were downloaded again, and a completely fresh archive was created. Xcode's App Store Connect export review explicitly shows: Certificate: Apple Distribution App Store provisioning profile for the correct Bundle ID get-task-allow = false beta-reports-active = true I then exported the IPA locally using Xcode's App Store Connect distribution workflow and independently inspected the actual exported binary with codesign. The main application reports: Identifier=[Bundle ID] Authority=Apple Distribution: [Name] ([Team ID]) Authority=Apple Worldwide Developer Relations Certification Authority Authority=Apple Root CA TeamIdentifier=[Team ID] I also separately checked the embedded Capacitor.framework and Cordova.framework. Both are signed with the same Apple Distribution identity and Team ID and show the same WWDR -> Apple Root CA trust chain. I checked Keychain as suggested in similar forum discussions. The Apple Distribution certificate has its private key, the WWDR intermediate certificates are present and valid, and certificate verification reports: "...certificate verification successful." Despite all of the above, a fresh upload from Xcode Organizer still consistently fails with the same ITMS-90034. This appears very similar to other recent reports involving newly enrolled Individual Developer accounts where correctly signed binaries are rejected by App Store Connect. I also opened an Apple Developer Support case (case 20000149684934). So far I have received general signing/troubleshooting documentation, but the issue remains unresolved. At this point, is there any additional local signing verification I should perform, or could this indicate an account/team-level App Store Connect signing validation issue that needs to be investigated on Apple's side? I would especially appreciate guidance from Apple DTS on what diagnostic information would be useful to distinguish a local certificate-chain issue from an App Store Connect/account-side validation issue. Thank you.

Since my Apple Distribution signing certificate had expired I recently got a new one via https://developer.apple.com/account/resources/certificates/list and installed in on my login keychain. Since I had some issues with signing I suspected that codesign might still be trying to use an old expired certificate (as they have the same name "Apple Distribution: ()"). So to fix this I figured I could just delete the old expired certificate from Keychain Access so there was only the valid new certificate there with the same name. However, after doing this and trying to use it with codesign I get the following error error: The specified item is no longer valid. It may have been deleted from the keychain. In other words it seems it's not finding the new valid certificate and somehow still linking the name to the old certificate that it rightly guesses is removed. Following the tips from https://developer.apple.com/forums/thread/701514 I used security find-identity -p codesigning -v to check for installed codesigning certificates, and this listed the new certificate as expected. Using another tip in the same post I saw that you can also use the certificate hash as an identifier beside the name, and using this I can use it with codesign to sign. However, it's still not finding it via the name (or rather, it's still finding the old now removed one). What could be the reason for codesign not finding the correct new valid certificate based on the name and instead still finding the old one? Maybe there's some reference set somewhere to point the name towards specifically the old certificate?

I’m trying to distribute a macOS application outside the Mac App Store using Developer ID signing and notarization. The Sensitive Content Analysis capability is enabled for this App ID in Certificates, Identifiers & Profiles. My application requires the following entitlement: com.apple.developer.sensitivecontentanalysis.client However, when I create and download a new Developer ID provisioning profile for this App ID, the generated profile does not contain this entitlement. I have regenerated and downloaded the profile after confirming that Sensitive Content Analysis is enabled. I also decoded the newly generated .provisionprofile to inspect its entitlements. It contains the application identifier, team identifier, and keychain access groups, but does not contain com.apple.developer.sensitivecontentanalysis.client. As a result, Xcode will not export the Developer ID build because the application requests the Sensitive Content Analysis entitlement but the provisioning profile does not authorize it. Does anyone know the answers to these questions: Is com.apple.developer.sensitivecontentanalysis.client supported for macOS applications distributed outside the Mac App Store using Developer ID? If it is supported, why is the entitlement not being included in newly generated Developer ID provisioning profiles for this App ID? Is there an additional approval, agreement, or configuration required for this entitlement to be included in a Developer ID profile? Sensitive Content Analysis is a required feature of this application, so removing the entitlement is not an option for our distribution build.

I have a DriverKit system extension (dext) that uses PCIDriverKit. I would like to get the build environment straightened out to successfully distribute the dext and associated software to end users. There are three types of software involved: The Dext-hosting application - this is the application that must be installed to /Applications/, and will perform the registration of the dext. The dext is deployed "within" this application, and can be found in the /Contents/Library/SystemExtensions folder of the app bundle. The dext itself - this is the actual binary system extension, which will be registered by its owning application, and will operate in its own application space independent of the hosting application. Additional applications that communicate with the dext - these are applications which will connect to the dext through user clients, but these applications do not contain the dext themselves. There are multiple locations where settings need to be exactly correct for each type of software to be signed, provisioned, and notarized properly in order to be distributed to users: developer.apple.com - where "identifiers" and "provisioning profiles" are managed. Note that there are differences in access between "Team Agent", "Admin", and "Developer" at this site. Xcode project's Target "Signing & Capabilities" tab - this is where "automatically manage signing" can be selected, as well as team selection, provisioning profile selection, and capabilities can be modified. Xcode project's Target "Build Settings" tab - this is where code signing identity, code signing development team, code signing entitlements file selection, Info.plist options and file selection, and provisioning profile selection. Xcode's Organizer window, which is where you manage archives and select for distribution. In this case, I am interested in "Developer ID" Direct Distribution - I want the software signed with our company's credentials (Team Developer ID) so that users know they can trust the software. Choosing "automatically manage signing" does not work for deployment. The debug versions of software include DriverKit (development) capability (under App ID configuration at developer.apple.com), and this apparently must not be present in distributable provisioning. I believe this means that different provisioning needs to occur between debug and release builds? I have tried many iterations of selections at all the locations, for all three types of binaries, and rather than post everything that does not work, I am asking, "what is supposed to work?"

Hello, ppq.apple.com appears to be unavailable. The issue is reproducible from multiple networks/devices. Requests to https://ppq.apple.com fail, preventing iOS from verifying developer-signed applications. This results in the device displaying an error indicating that an Internet connection is required to verify the developer/app. The issue appears to be server-side rather than related to the developer certificate or provisioning profile. Affected: (tested on) ppq.apple.com HTTPS / TCP 443 iOS 9.3.4 iPhone 5S [07/09/2026/20:07 + Zurich] Example: curl -I https://ppq.apple.com Response: HTTP/2 404 server: Apple date: Mon, 07 Sep 2026 18:08:13 GMT content-type: text/plain; charset=UTF-8 content-length: 0 x-b3-spanid: bdf368a2edbdbef7 x-b3-traceid: bdf368a2edbdbef7 x-b3-sampled: 1 strict-transport-security: max-age=31536000; includeSubdomains x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block Please investigate the availability of the PPQ service.

I have been trying to use Apple Developer Support to help with issues I'm having preventing me from signing and notarizing my apps. Delayed and not helpful responses from support. This has been going on for several weeks. I find it hard to believe that a Multi-Trillion Dollar company can't help me with my issues. I have what I think is a good certificate and private key as well as my App-Sepcific Password. The problem is that when trying to sign my apps, I get a popup indicating that that it's trying to sign in to Keychain using my first Name (Steve). My login on my system is "Stephen" which works fine for login and anything that wants to access Keychain. I need some help trying to resolve this.

I have two Apple Developer accounts under different Apple IDs: a free "Personal Team" account and a separate paid Organization account. Before my organization's Program enrollment was approved, I built an app to a physical device using Xcode signed into my personal account, which auto-registered an App ID under that personal team. Now that my organization account is active, I can't register the same App ID under the organization — both the web portal and Xcode's automatic signing return "not available," since it's already reserved under my personal team. Since personal (free) accounts have no web portal access, I can't see or manage that registration anywhere to release it myself. I own both accounts. Is there any self-service way to release an App ID from a personal team, or is contacting Apple Developer Support the only option? If support is required, is there a faster route than the standard contact form (I submitted a request several days ago with no reply yet)?

When trying to develop an Apple Shortcut, the shortcut doesn't appear (after many open, quit, adding permissions, etc.). My only Apple Account is my name associated with an Apple ID of QZ99..... However, when I try to check one (of many reasons) why it does not show up with Terminal: codesign -dv --verbose=4 "/Applications/My App.app" etc, it shows something "rejected" Authority=Apple Worldwide Developer Relations Certification Authority Authority=Apple Root CA Signed Time=Aug 25, 2026 at 1:26:38 PM Info.plist entries=22 TeamIdentifier=QZ99... Runtime Version=26.5.0 Sealed Resources version=2 rules=13 files=4 Internal requirements count=1 size=204 /Applications/Write Create Date from Original.app: rejected origin=Apple Development: My Account (K533...) The K533... is different than my Team ID of QZ99... Could that be a reason my app is not registered with Shortcuts? Is that expected functionality? I guess I expected my Team ID to appear everywhere even after I deleted my account in Xcode, removed a current and expired certificate associated with K533 in Keychain, and then added my account back, and let Xcode regenerate a certificate.

We completed an App Store app transfer and the Notification Service Extension Filtering Entitlement (com.apple.developer.usernotifications.filtering) did not transfer with the app. App Apple ID: 6760007376 NSE Bundle ID: io.nolink.ios.nse New Team ID: M85WA8W78C Previous Team ID: V2E3A94DC9 The app, bundle IDs, and App Store presence all moved normally, but the entitlement is not available on the new team, so we cannot sign the NSE with the configuration the app previously shipped with. Our app is an encrypted messenger and this breaks incoming call handling for live users. Two questions: Is there an official process for re-associating a previously approved entitlement with the receiving team after a transfer, or does the new team always have to submit a fresh request? Could entitlements tied to a specific App ID move with the app during a transfer, the same way bundle IDs do? We have an open support case, but wanted to raise the general question here too.

I use a free Apple Personal Team with Xcode for on-device testing. My Apple Development certificate created on 15 August 2026 shows “Missing Private Key”, and Xcode is not allowing me to create a fresh replacement certificate. I have already contacted Apple Developer Program Support, and they directed me to the Apple Developer Forums for technical assistance. How can I revoke/reset the unusable certificate or clear the certificate state for my Personal Team so that Xcode can create a new Apple Development certificate?

Some UDIDs are getting added immediately but some takes up to 72 hours and status is "iPhone Processing". Is there a way to get this processing expedited and why some devices gets added immediately.

Updating an App for the first time since 2011. Build, Analyze, Archive all successful. Automatically Manage Signing checked. Validation fails with 90286 - Invalid code signing entitlements, and 91130 - Invalid Provisioning Profile dozens of times after tweaks, clean builds, trying manual signing (thought I was done with that), etc. For 90286 it seems my Developer ID , e.g. 346JXXXXX (not Team ID, QZ99XXXXX) is the prefix for the bundle ID, com.company.app-name and that generates the error? For 91130 it's invalid "com.apple.application-identifier" which I assume is the same issue with a Developer ID instead of a Team ID. The original version of the app was QZ99XXXXX.com.company.app-name. I even changed the bundle identifier in Xcode to that, and got this: App Record Creation failed due to request containing an attribute already in use. The app name you entered is already being used for another app in your account. If you would like to use the name for this app you will need to submit an update to your other app to change the name, or remove it from App Store Connect. Yes, the original app name is being used for an app in my account. I was trying to update the app, checked all the boxes, added update text, but of course there was no build to upload. Would appreciate any help.

I have a paid Apple Developer account (Team CK4269T4Q4, renewed until 2027/7/10), but Xcode always generates development certificates under my free personal Team (CKY689QC8W) instead of the paid one. What I've tried: Deleted all certificates from Keychain → Xcode regenerates under CKY689QC8W Revoked all certificates on developer.apple.com → same result Manually created CSR + uploaded certificate → still CKY689QC8W Signed out/in of Xcode account → no change Clean build, deleted derived data → no change The problem: iOS 18.7 requires online verification for free Team certificates. The verification always fails with "需要互联网连接以验证是否信任开发者". The "VPN & Device Management" section on iPhone never shows the developer profile. Apple Support case: 102939216200 — they confirmed the certificate was created correctly under CK4269T4Q4, but referred me to technical support here. Has anyone encountered this? How can I force Xcode to use my paid Team for code signing?

I came across your contact on the Apple Developer Forums. I'm encountering an unusual issue during the notarization process. The error message states: "Team is not yet configured for notarization. Please contact Developer Programs Support at developer.apple.com under the topic Development and Technical / Other Development or Technical Questions." Any guidance you could provide would be greatly appreciated. Here are the error details for reference: json { "logFormatVersion": 1, "jobId": "b6023a7c-dc85-4fa5-91dd-fba92c9ed831", "status": "Rejected", "statusSummary": "Team is not yet configured for notarization. Please contact Developer Programs Support at developer.apple.com under the topic Development and Technical / Other Development or Technical Questions.", "statusCode": 7000, "archiveFilename": "Bytemonk.dmg", "uploadDate": "2025-07-02T07:07:07.945Z", "sha256": "b9494170cc040a76045ed263de22e6b89a5455142af16ce502530e1c1ee72ddf", "ticketContents": null, "issues": null }

Our iOS app fails to install via Ad Hoc or Development distribution with error: 0xe8008018 (The identity used to sign the executable is no longer valid). Environment: macOS 15.6.1, Xcode 16.0 Team ID: 8CJTVD465A Tested on iPhone 8 (iOS 16.7 + iOS 16.2) What works: TestFlight ✅, App Store ✅ What fails: Ad Hoc ❌, Development ❌ Key evidence: OCSP returns "good" for all certificates Brand new certificate (created today) → same error Install succeeds in Airplane mode but app shows "not available" at launch 4 different certificates, 3 profiles, 2 Xcode versions, 2 devices → all fail codesign --verify passes locally Full cert chain verified: Leaf → WWDR G3 → Apple Root CA This indicates Apple's online verification service is rejecting our team's signatures. Has anyone seen this or know how to resolve?

I have a Flutter project that uploads files in background mode, implemented as a plugin for the iOS part. It works fine in debug mode when running from Xcode, but no files are uploaded in release mode (installed via .ipa). I implemented functions such as BGAppRefreshTask and BGProcessingTask, and configured BGTaskSchedulerErrorCodeNotPermitted properly in Info.plist. I registered background tasks (processing and fetch), and BGTaskScheduler also works well. The issue is that it works fine in debug mode but not in release mode. Do I need to modify some settings in the .entitlements file or configure something else? Environment: macOS: Sequoia 15.7.7 Xcode: 26.3 Flutter SDK: 3.19.5

Am on Mac Tahoe, and have the WWDR G4 cert in my login keychain, however, all the certificates am generating are coming out as not trusted. what else should I do? I have tried all the troubleshooting tips to delete all WWDRs if it exists. Any helpful suggestions will be appreciated.

I'm trying to register the App ID ai.mycompany.app under our company Apple Developer account, but the portal says: "An App ID with Identifier 'ai.mycompany.app' is not available. Please enter a different string." We own the domain mycompany.ai, and no app is published with this identifier (an App Store lookup by bundle ID returns no results). I believe it was auto-registered earlier by Xcode's automatic signing under my personal Apple ID while testing a build, not under our company team. So it's now holding the identifier globally but isn't in use. I have access to both accounts — my free personal Apple ID and our paid company Developer account. The problem: under the free personal account, the Identifiers list (Certificates, IDs & Profiles) is restricted — free accounts can't access it on the portal, so I can't see or remove the Bundle ID there myself. And from the company account it doesn't appear, since it's owned by the personal team. What I want: release/remove this Bundle ID so I can register it under our company Developer account. Questions: If a Bundle ID was auto-created under a free personal team, how can it be removed when free accounts can't access the Identifiers list? Is contacting Developer Support the only way to release it in this case? Once released, does the identifier become available immediately, or is there a hold period before another team can register it? Any guidance appreciated.