iOS provisioning profiles explained
What a provisioning profile actually is
Signing an app proves two things to iOS: who built it, and that it is allowed to run on a given device with a given set of capabilities. A certificate proves the identity. The provisioning profile is what links that identity to a specific app and context. A profile contains:
- The App ID, which maps to your Bundle ID and the capabilities it is allowed to use.
- One or more signing certificates that are valid for this profile.
- For development and ad hoc, the list of device identifiers allowed to run the build.
- The entitlements, such as push notifications or App Groups, that the app is permitted to use.
If any of those do not line up, for example the Bundle ID does not match the App ID, or the device is not in the list, the build will not install. For the certificate side of the picture, see iOS code signing explained.
The four profile types
Each type is built for a different way of running or shipping the app:
- Development. Lets you build from Xcode and run on your own registered test devices. Pairs with an Apple Development certificate.
- Ad Hoc. Distributes a build to a fixed list of registered devices outside the store, up to 100 devices per device type per membership year. Pairs with an Apple Distribution certificate.
- App Store. Used to upload to App Store Connect for TestFlight and public release. Pairs with an Apple Distribution certificate. It does not embed a device list, because distribution is open.
- In-House. Distributes internally to employees, and is only available in the Apple Developer Enterprise Program, not the standard program.
The pairing matters: a Development certificate only works with a Development profile, and an Apple Distribution certificate works with the Ad Hoc and App Store profiles. Even though TestFlight is for testing, Apple treats TestFlight builds as App Store builds, so they need the Apple Distribution certificate and an App Store profile.
Automatic versus manual signing
Xcode offers two ways to manage all of this:
- Automatic signing. Xcode creates and updates the certificates and profiles for you based on your team and Bundle ID. This is the default and covers most apps.
- Manual signing. You create the App ID, certificates, and profiles yourself in the developer account and select them explicitly. This gives more control, which teams use for shared continuous integration, but it is more to maintain.
Profiles also expire. Development and Ad Hoc profiles have a limited lifetime, and if a certificate is revoked or expires, the profiles that depend on it stop working. That expiry is one of the most common reasons a build that worked last month suddenly fails to sign.
Where AppFlight fits
AppFlight handles code signing for distribution as part of building and shipping, which includes the Apple Distribution certificate and the App Store profile a TestFlight or App Store build needs. That means you do not register App IDs, generate certificates, or download profiles by hand, and you do not chase expired profiles before a release. You still need a paid Apple Developer account, since that account holds the signing identity that everything is built on.
FAQ
What is a provisioning profile?
It is a file that bundles your signing certificate, an App ID, a list of allowed devices, and the app entitlements. iOS checks it to decide whether to install and run your app. Without a matching profile, a build will not install or distribute.
Which provisioning profile do I need for the App Store?
An App Store provisioning profile, paired with an Apple Distribution certificate. TestFlight uses the same App Store profile, because Apple treats TestFlight builds as App Store builds. Development and Ad Hoc profiles cannot be used to submit to the store.
Does AppFlight manage provisioning profiles?
Yes. AppFlight handles code signing for distribution, including the certificate and App Store profile, so you do not create or manage profiles by hand. You still need a paid Apple Developer account, which is where the underlying signing identity lives.