Provisioning Profiles

Most Developer ID apps ship without a provisioning profile. Some entitlements, Apple calls them restricted, only work when a profile that authorizes them is embedded in the app. Associated Domains (applinks:, webcredentials:) is the common one; iCloud, Push Notifications and App Groups are others.

If your app carries one of these entitlements, a release fails with:

The app's entitlements require a provisioning profile.

On CI this usually surfaces at the export step: the archive builds fine, and xcodebuild only demands the profile when it re-signs the app for Developer ID distribution.

Create a Developer ID provisioning profile

You only need do this once.

  1. Open Certificates, Identifiers & Profiles → Identifiers and make sure your app's identifier has the capability enabled
  2. Switch to Profiles and click the add button (+).
  3. Under Distribution, select Developer ID and continue.
  4. Select your App ID, then select your Developer ID Application certificate. It must be the certificate you sign releases with (the one behind DEV_ID_CERT_P12 in GitHub Actions, or your codesign identity).
  5. Name the profile (e.g. YourApp Developer ID) and download the .provisionprofile file.

Use it in GitHub Actions

Base64-encode the profile and add it as a repository secret named AMORE_PROVISIONING_PROFILE:

base64 -i YourApp.provisionprofile | pbcopy

Then pass it to the release-action step:

provisioning-profile: ${{ secrets.AMORE_PROVISIONING_PROFILE }}

Use it with the CLI

Pass the file directly:

amore release --provisioning-profile YourApp.provisionprofile

Or provide it base64-encoded via the AMORE_PROVISIONING_PROFILE environment variable, which is what the GitHub Action does under the hood.

Either way, Amore derives the signing identity from the profile's own certificates, signs the archive and export manually, and embeds the profile in the app. The whole release runs offline, with no contact to Apple's provisioning service.

Why Amore cannot fetch the profile automatically

On your Mac, where Xcode has an Apple ID session, Amore lets xcodebuild fetch missing profiles automatically and no setup is needed.

On CI you would expect App Store Connect API credentials to do the same through xcodebuild's cloud signing, and Amore does try exactly that. But Apple's provisioning service currently rejects API-key authentication for Developer ID certificates, regardless of the key's role: even Admin keys fail with Cloud signing permission error. Apple has confirmed this limitation (FB16835802). Until it is fixed, a pre-created profile is the only fully headless path, and your ASC key can stay at the Developer role it needs for notarization.

When the profile stops working

A profile is invalidated when the certificate it references expires or is revoked, or when you change the entitlements it authorizes. In those cases, regenerate the profile with the same steps and update the secret. Nothing else changes.