iOS Credentials & Provisioning

Certs, profiles, and EAS managed credentials - the cookbook for iOS signing on Expo SDK 57 without every engineer maintaining Xcode signing folders.

Recipe

Quick-reference recipe card - copy-paste ready.

# Interactive credential setup
eas credentials --platform ios
 
# First production build (prompts for Apple login)
eas build --profile production --platform ios
 
# Non-interactive CI build after credentials exist
eas build --profile production --platform ios --non-interactive

// app.config.ts - bundle ID is the signing anchor
import type { ExpoConfig } from "expo/config";
 
const config: ExpoConfig = {
  name: "ShopApp",
  slug: "shop-app",
  ios: {
    bundleIdentifier: "com.example.shopapp",
    buildNumber: "1",
  },
  extra: {
    eas: { projectId: "00000000-0000-0000-0000-000000000000" },
  },
};
 
export default config;

// eas.json - store vs internal distribution affects profile type
{
  "build": {
    "production": {
      "distribution": "store",
      "ios": { "simulator": false }
    },
    "preview": {
      "distribution": "internal",
      "ios": { "simulator": false }
    }
  }
}

When to reach for this:

• First eas build --platform ios asks about certificates and provisioning profiles.
• Xcode reports "No profiles for bundle identifier" on a teammate's machine.
• Rotating off an engineer who was the only Apple Developer portal admin.
• Adding push, Sign in with Apple, or associated domains before TestFlight QA.

Working Example

Step 1 - Register the bundle identifier

1. Apple Developer → Certificates, Identifiers & Profiles → Identifiers.
2. Create App ID matching ios.bundleIdentifier in app.config.ts.
3. Enable capabilities you need (Push, Associated Domains, etc.) - see Entitlements & Capabilities.

Step 2 - Let EAS manage signing credentials

eas credentials --platform ios

Choose for a greenfield app:

? What do you want to do? › Set up credentials for a new bundle identifier
? Generate a new Apple Distribution Certificate? › Yes
? Generate a new Apple Provisioning Profile? › Yes

EAS stores:

• Apple Distribution Certificate (.p12 equivalent, encrypted on Expo servers)
• Provisioning Profile (App Store or Ad Hoc depending on distribution)
• Optional Push Notification Key (.p8) for APNs

Step 3 - Register devices for internal builds

# Create a registration link for testers
eas device:create
 
# List registered devices
eas device:list

Internal ("distribution": "internal") profiles embed registered UDIDs. Testers must register before you rebuild.

Step 4 - Build and verify

eas build --profile production --platform ios
eas build --profile preview --platform ios   # ad hoc / internal testers

Download the IPA and install via TestFlight (eas submit) or ad hoc link - Internal Distribution.

Credential Types

Common Operations

Rotate a compromised distribution certificate

eas credentials --platform ios
# Choose: Remove distribution certificate → Generate new → Rebuild all profiles
eas build --profile production --platform ios --clear-cache

• Apple allows two active distribution certs - plan rotation before expiry
• All IPAs signed with the old cert remain valid until profiles expire
• Notify the team - CI --non-interactive builds pick up new credentials automatically

Upload existing credentials (brownfield migration)

eas credentials --platform ios
# Choose: Upload distribution certificate (.p12 + password)
# Choose: Upload provisioning profile (.mobileprovision)

• Match bundle ID, team ID, and capabilities exactly to your existing app
• Revoke duplicate certs in Apple portal after confirming EAS builds succeed
• Pair with Migrating Manual Native Projects to CNG when moving off hand-edited Xcode projects

Sync capabilities from app.config

EAS can enable portal capabilities that match your config plugins:

{
  "build": {
    "production": {
      "ios": {
        "autoIncrement": true
      }
    }
  }
}

// app.config.ts - associated domains require portal + entitlements alignment
ios: {
  associatedDomains: ["applinks:shop.example.com"],
},
plugins: [["expo-notifications", { icon: "./assets/notification-icon.png" }]],

• Capability mismatches surface as provisioning profile doesn't include entitlement errors
• Fix in app.config.ts / plugins first - then regenerate profiles via eas credentials

Troubleshooting

FAQs

Related

• EAS Build Basics - first cloud iOS build
• Internal Distribution - ad hoc and TestFlight paths
• EAS Submit - upload to App Store Connect
• ../ios-platform/entitlements-and-capabilities/entitlements-and-capabilities.md - push, associated domains, background modes
• ../ios-platform/testflight-distribution/testflight-distribution.md - internal/external tester groups
• ../ios-platform/ios-basics-for-rn-devs/ios-basics-for-rn-devs.md - Xcode signing vocabulary
• ../cng-prebuild/prebuild-basics/prebuild-basics.md - bundle ID flows into generated Xcode project
• ../expo-rules/release-and-ota-rules/release-and-ota-rules.md - store builds vs OTA eligibility

Stack versions: This page was written for React 19.2.3, React Native 0.86.0, and Expo SDK 57 (expo ~57.0.4).