# Code Signing Services Examine and validate signed code running on the system. ## Overview Code signing is a macOS security technology that you use to certify that an app was created by you. Once an app is signed, the system can detect any change to the app—whether the change is introduced accidentally or by malicious code. You can control how your signed code loads signed plug-ins and other signed code without invalidating the signatures of the host code or of the guest (dynamically loaded) code. You work with code objects that represent uniquely identified elements of running code in the system. In addition to UNIX processes, these elements can include scripts, applets, widgets, and so forth. You also work with *static* code objects that represent code in the file system. Static code includes applications, tools, frameworks, plug-ins, scripts, and so on. Generally, a code object has a specific static code object from which it originates and that holds its static signing data. The reverse, however, is not true—given a static code object, it is not possible to find, enumerate, or control any code object that originated from it. ## Topics ### Code Objects Work with signed code loaded into memory. [`SecCode`](/documentation/Security/SecCode) A code object representing signed code running on the system. [`SecCodeCopySelf(_:_:)`](/documentation/Security/SecCodeCopySelf(_:_:)) Retrieves the code object for the code making the call. [`SecCSFlags`](/documentation/Security/SecCSFlags) Values that can be used in the `flags` parameter to most code signing functions. [`SecCodeGetTypeID()`](/documentation/Security/SecCodeGetTypeID()) Returns the unique identifier of the opaque type to which a code object belongs. ### Static Code Work with signed code on disk. [`SecStaticCode`](/documentation/Security/SecStaticCode) A static code object representing signed code on disk. [`SecStaticCodeCreateWithPath(_:_:_:)`](/documentation/Security/SecStaticCodeCreateWithPath(_:_:_:)) Creates a static code object representing the code at a specified file system path. [`SecStaticCodeCreateWithPathAndAttributes(_:_:_:_:)`](/documentation/Security/SecStaticCodeCreateWithPathAndAttributes(_:_:_:_:)) Creates a static code object representing the code at a specified file system path using an attributes dictionary. [Code Attributes](/documentation/Security/code-attributes) Specify these keys from the attribute dictionary when you create a static code instance. [`SecStaticCodeGetTypeID()`](/documentation/Security/SecStaticCodeGetTypeID()) Returns the unique identifier of the opaque type to which a static code object belongs. ### Working with Code Objects [`SecCodeCopyPath(_:_:_:)`](/documentation/Security/SecCodeCopyPath(_:_:_:)) Retrieves the location on disk of signed code, given a code or static code object. [`SecCodeCopyStaticCode(_:_:_:)`](/documentation/Security/SecCodeCopyStaticCode(_:_:_:)) Returns a static code object representing the on-disk version of the given running code. [Code Signing Architecture Flags](/documentation/Security/code-signing-architecture-flags) Use these supplemental flags to get static code. ### Code Signatures [`SecCodeCopySigningInformation(_:_:_:)`](/documentation/Security/SecCodeCopySigningInformation(_:_:_:)) Retrieves various pieces of information from a code signature. [Code Signing Information Flags](/documentation/Security/code-signing-information-flags) Use these supplemental flags to retrieve signing information. [Signing Information Dictionary Keys](/documentation/Security/signing-information-dictionary-keys) Use these keys from the information dictionary when you retrieve information from a code signature. [`SecCodeSignatureFlags`](/documentation/Security/SecCodeSignatureFlags) Specify option flags that can be embedded in a code signature during signing and that govern the use of the signature. [`SecCSDigestAlgorithm`](/documentation/Security/SecCSDigestAlgorithm) The list of digest algorithms available for code signatures. ### Code Requirements [Applying Code Requirements](/documentation/Security/applying-code-requirements) Manage the code requirements that apply to your signed code. [`SecCodeCopyDesignatedRequirement(_:_:_:)`](/documentation/Security/SecCodeCopyDesignatedRequirement(_:_:_:)) Retrieves the designated code requirement of signed code. [`SecRequirement`](/documentation/Security/SecRequirement) A code requirement object. [`SecRequirementGetTypeID()`](/documentation/Security/SecRequirementGetTypeID()) Returns the unique identifier of the opaque type to which a code requirement object belongs. [`SecRequirementType`](/documentation/Security/SecRequirementType) An enumeration indicating different types of internal requirements for code. ### Code Requirements as Data [`SecRequirementCopyData(_:_:_:)`](/documentation/Security/SecRequirementCopyData(_:_:_:)) Extracts a binary form of a code requirement from a code requirement object. [`SecRequirementCreateWithData(_:_:_:)`](/documentation/Security/SecRequirementCreateWithData(_:_:_:)) Creates a code requirement object from the binary form of a code requirement. ### Code Requirements as Text [`SecRequirementCopyString(_:_:_:)`](/documentation/Security/SecRequirementCopyString(_:_:_:)) Converts a code requirement object into text form. [`SecRequirementCreateWithString(_:_:_:)`](/documentation/Security/SecRequirementCreateWithString(_:_:_:)) Creates a code requirement object by compiling a valid text representation of a code requirement. [`SecRequirementCreateWithStringAndErrors(_:_:_:_:)`](/documentation/Security/SecRequirementCreateWithStringAndErrors(_:_:_:_:)) Creates a code requirement object by compiling a valid text representation of a code requirement and returns detailed error information in the case of failure. ### Guest Code [Hosting Guest Code](/documentation/Security/hosting-guest-code) Securely launch and manage plug-ins and other executable entities, known as guest code, from within your app acting as a host. [`SecHostCreateGuest`](/documentation/Security/SecHostCreateGuest) Creates a new guest and describes its initial properties. [`SecHostSetGuestStatus`](/documentation/Security/SecHostSetGuestStatus) Updates the status and attributes of a particular guest. [`SecCodeCopyGuestWithAttributes(_:_:_:_:)`](/documentation/Security/SecCodeCopyGuestWithAttributes(_:_:_:_:)) Asks a code host to identify one of its guests given the type and value of specific attributes of the guest code. [Null Guest Handle](/documentation/Security/null-guest-handle) Use this special value to stand in for a null guest object. [`SecCodeStatus`](/documentation/Security/SecCodeStatus) Operational flags attached by code signing services to running code. [Guest Creation Flags](/documentation/Security/guest-creation-flags) Use these supplemental flags to create a guest object. [Guest Attribute Dictionary Keys](/documentation/Security/guest-attribute-dictionary-keys) Specify attributes of guest code. [`SecGuestRef`](/documentation/Security/SecGuestRef) A reference to a guest object, which identifies a particular block of guest code in the context of its code signing host. ### Guest Management [`SecCodeCopyHost(_:_:_:)`](/documentation/Security/SecCodeCopyHost(_:_:_:)) Retrieves the code object for the host of specified guest code. [`SecHostRemoveGuest`](/documentation/Security/SecHostRemoveGuest) Removes a guest from a host. [`SecHostSelectGuest`](/documentation/Security/SecHostSelectGuest) Makes the calling thread the proxy for a specified guest. [`SecHostSelectedGuest`](/documentation/Security/SecHostSelectedGuest) Retrieves the handle for the guest currently selected for the calling thread. [`SecHostSetHostingPort`](/documentation/Security/SecHostSetHostingPort) Tells code signing services that the calling code will directly respond to hosting inquiries over the given port. [`SecCodeMapMemory(_:_:)`](/documentation/Security/SecCodeMapMemory(_:_:)) Asks the kernel to accept the signing information currently attached to a code object and uses it to validate memory page-ins. ### Tasks [`SecTaskCreateFromSelf(_:)`](/documentation/Security/SecTaskCreateFromSelf(_:)) Creates a task object for the current task. [`SecTaskCreateWithAuditToken(_:_:)`](/documentation/Security/SecTaskCreateWithAuditToken(_:_:)) Creates a task object for the task that sent the Mach message represented by the audit token. [`SecTask`](/documentation/Security/SecTask) The Core Foundation type representing a task. [`SecTaskGetTypeID()`](/documentation/Security/SecTaskGetTypeID()) Returns the unique identifier of the opaque type to which a task object belongs. [`SecTaskCopySigningIdentifier(_:_:)`](/documentation/Security/SecTaskCopySigningIdentifier(_:_:)) Returns the value of the code signing identifier. [`SecTaskCopyValueForEntitlement(_:_:_:)`](/documentation/Security/SecTaskCopyValueForEntitlement(_:_:_:)) Returns the value of a single entitlement for the represented task. [`SecTaskCopyValuesForEntitlements(_:_:_:)`](/documentation/Security/SecTaskCopyValuesForEntitlements(_:_:_:)) Returns the values of multiple entitlements for the represented task. ### Code Signature Validity [`SecCodeCheckValidity(_:_:_:)`](/documentation/Security/SecCodeCheckValidity(_:_:_:)) Performs dynamic validation of signed code. [`SecCodeCheckValidityWithErrors(_:_:_:_:)`](/documentation/Security/SecCodeCheckValidityWithErrors(_:_:_:_:)) Performs dynamic validation of signed code and returns detailed error information in the case of failure. [`SecStaticCodeCheckValidity(_:_:_:)`](/documentation/Security/SecStaticCodeCheckValidity(_:_:_:)) Validates a static code object. [`SecStaticCodeCheckValidityWithErrors(_:_:_:_:)`](/documentation/Security/SecStaticCodeCheckValidityWithErrors(_:_:_:_:)) Performs static validation of static signed code and returns detailed error information in the case of failure. [Static Code Validation Flags](/documentation/Security/static-code-validation-flags) Use these supplemental flags to test the validity of a static code signature. ### Result Codes [Code Signing Services Result Codes](/documentation/Security/code-signing-services-result-codes) Recognize result codes specific to the code signing services API. [User Info Dictionary Error Keys](/documentation/Security/user-info-dictionary-error-keys) Recognize the keys of the user info dictionary provided by functions that return error objects. ## See Also [Code Signing Guide](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html#//apple_ref/doc/uid/TP40005929) --- Copyright © 2026 Apple Inc. All rights reserved. | [Terms of Use](https://www.apple.com/legal/internet-services/terms/site.html) | [Privacy Policy](https://www.apple.com/privacy/privacy-policy)