Hi,
I'm having a really hard time figuring out why I cannot perform cloud signing via Developer ID with xcodebuild.
I have a macOS application, which I can perfectly cloud sign the following way:
Sign into Xcode with my Admin + Account Holder Apple ID.
Delete my Developer ID Application certificate from Keychain Access.
In Xcode, click Archive.
When archived, click "Distribute App" in Xcode Organizer.
The app is cloud signed. I prove this by extracting the certificate codesign --extract-certificates -- /path/to/app.app then locate the 1.2.840.113635.100.6.1.32 bit mentioned by Quinn in this post. I however do it by simply opening the certifiacte with Keychain Access, where I can investigate the content of the certificate, rather than use that tool he does.
Then, I do the following to attempt to cloud sign via xcodebuild:
Create an API Key for the whole team in Users and Access > Integrations > App Store Connect with the "Admin" role selected.
Download the private key .p8 file to ~/Downloads.
Sign out of my Apple ID in Xcode by removing the account in Settings > Accounts.
Create an archive:
xcodebuild archive -scheme "<redacted scheme name>" -archivePath ~/Downloads/archive.xcarchive -authenticationKeyIssuerID <redacted issuer id> -authenticationKeyID <redacted key id> -authenticationKeyPath ~/Downloads/AuthKey_<redacted key id>.p8 -allowProvisioningUpdates
The archive is successfully created, with a new "Apple Development: Created via API (TEAM ID)" naming.
Export the archive:
xcodebuild -exportArchive -archivePath ~/Downloads/archive.xcarchive -authenticationKeyIssuerID <redacted issuer id> -authenticationKeyID <redacted key id> -authenticationKeyPath ~/Downloads/AuthKey_<redacted key id>.p8 -allowProvisioningUpdates -exportOptionsPlist ~/Downloads/exportOptions.plist -exportPath ~/Downloads
which then fails:
2025-03-07 10:27:58.706 xcodebuild[2152:40704] [MT] IDEDistribution: -[IDEDistributionLogging _createLoggingBundleAtPath:]: Created bundle at path "/var/folders/tn/yy7ynz3d0yb4p3sd_5q_wl0h0000gn/T/<redacted app name> macOS_2025-03-07_10-27-58.706.xcdistributionlogs".
error: exportArchive Cloud signing permission error
error: exportArchive No signing certificate "Developer ID Application" found
** EXPORT FAILED **
Opening the distribution logs, I find this in the Provisioning Log:
2025-03-07 09:09:58 +0000 2025-03-07 09:09:58 +0000 IDEProvisioningRepair(<redacted app name>.app): 2025-03-07 09:09:58 +0000 IDEProvisioningRepair(<redacted app name>.app): Sending request 84E57539-BC1D-407A-8402-7BCE9F2FD100 to <https://appstoreconnect.apple.com/xcbuild/v1/certificates> for session DVTServicesTeamBasedSession <issuer: <redacted issuer id>; key identifier: <redacted key id>>.
Method: POST
Headers:
{
Accept = "application/vnd.api+json";
"Accept-Encoding" = "gzip, deflate";
Authorization = "Bearer <redacted bearer token>";
"Content-Length" = 116;
"Content-Type" = "application/vnd.api+json";
"User-Agent" = Xcode;
"X-HTTP-Method-Override" = GET;
"X-Xcode-Version" = "16.2 (16C5032a)";
}
Payload:
{"urlEncodedQueryParams":"teamId=<redacted team id>&filter%5BcertificateType%5D=DEVELOPER_ID_APPLICATION_MANAGED&limit=200"}
2025-03-07 09:09:59 +0000 2025-03-07 09:09:59 +0000 IDEProvisioningRepair(<redacted app name>.app): 2025-03-07 09:09:59 +0000 IDEProvisioningRepair(<redacted app name>.app): Received response for 84E57539-BC1D-407A-8402-7BCE9F2FD100 @ <https://appstoreconnect.apple.com/xcbuild/v1/certificates>. Code = 0
2025-03-07 09:09:59 +0000 2025-03-07 09:09:59 +0000 IDEProvisioningRepair(<redacted app name>.app): 2025-03-07 09:09:59 +0000 IDEProvisioningRepair(<redacted app name>.app): Response payload: {
"errors" : [ {
"id" : "3d09690a-e26f-497f-b576-25104064387e",
"status" : "403",
"code" : "FORBIDDEN_ERROR",
"title" : "This request is forbidden for security reasons",
"resultCode" : 7495,
"detail" : "You haven't been given access to cloud-managed distribution certificates. Please contact your team's Account Holder or an Admin to give you access. If you need further assistance, contact Apple Developer Program Support at https://developer.apple.com/contact/."
} ]
}
Which is really weird, since I am using an API key with Admin rights. If I create a new key, and use it only for this command, App Store Connect does show the "Last Used" date as today after running the command.
I thought some time might need to pass, but the issue has been persisting since yesterday.
What could be wrong here? I do have a managed Developer ID Application certificate showing in my account but I still can't retrieve it with an Admin right imbued API key.
