khadinakbarlabs/expo-mobile-app-builder/code-signing

Code Signing

Indie default: EAS managed credentials. EAS handles cert + profile rotation. You never touch keychains.

Credential and external action gate

Signing certificates, profiles, and App Store Connect keys are private credentials. Do not run eas credentials, create EAS secrets, download a .p8, generate signing material, or revoke a profile without the owner's explicit confirmation of the Apple account, bundle identifier, affected apps, and intended action. Store credentials outside the repository and never display their values.

Initial setup

eas credentials

Choose iOS → Build credentials. EAS will:

1. Log into your Apple Developer account
2. Create Distribution Certificate
3. Create App ID (matching your bundle ID)
4. Create Provisioning Profile
5. Store everything in EAS-managed credentials

After that, eas build just works. Collaborators can build without ever touching ASC.

ASC API Key (.p8) — owner-managed setup

1. App Store Connect → Users and Access → Integrations → +
2. Use the least-privilege role that supports the intended workflow
3. Download .p8 file (Apple gives ONE chance — lose it, regenerate)
4. Note Key ID + Issuer ID

After the owner has approved key creation and selected protected secret storage, configure the values through the approved EAS or CI secret mechanism. The following placeholders are illustrative; never paste real values into a repository, prompt, or log.

eas secret:create --scope project --name ASC_KEY_ID --value "<key-id>"
eas secret:create --scope project --name ASC_ISSUER_ID --value "<issuer-id>"
eas secret:create --scope project --name ASC_KEY_BASE64 --type file --value "<path-outside-repository/AuthKey.p8>"

Manual signing (advanced)

Upload your own .p12 + .mobileprovision via eas credentials. Use when:

• Multiple apps share one cert
• You need a specific entitlement (App Groups, Push, custom)
• Org security policy forbids EAS holding Apple credentials

Recovery from broken signing

# Review the impact with the owner before removing any profile.
eas credentials  # → Build credentials → Remove provisioning profile
 
# Then, after separate build approval, trigger an interactive build to regenerate.
eas build --platform ios --profile production

Common errors

• "Provisioning Profile expired" in CI → EAS won't auto-regenerate non-interactively. Run eas credentials locally to remove + rebuild interactively, then re-trigger CI.
• "No profiles for X were found" with extension targets → set ios.bundleIdentifier per-target via config plugin, then eas credentials to generate per-target profiles.
• "Cached profile without App Groups" → eas build --clear-cache + remove cached profile via eas credentials.

Certificate rotation

Distribution certs last 1 year. Provisioning profiles last 1 year. EAS auto-regenerates interactively. For CI, run eas credentials proactively a month before expiry.

Reference

references/02-eas-pipeline.md