Websites · Glossary
What is a provisioning profile on iPhone?
A provisioning profile is a file Apple issues that ties together an app's identifier, the certificate it is signed with, the app services it may use and, for test builds, the devices allowed to run it. An iPhone checks the profile embedded in an app before launching it, which is how Apple controls where an app can be installed.
Android lets you install almost any signed app. iPhone does not: every app must carry a provisioning profile that says who signed it and where it may run.
Indunil Asanka · Co-founder
4 min read · Published
| Kind | Used for | Which devices can run it |
|---|---|---|
| Development | Running debug builds while building the app | Registered development devices |
| Ad hoc | Sharing a test build outside the App Store | Devices registered with the account and listed in the profile |
| App Store | Builds uploaded to App Store Connect, including TestFlight | Any device, once Apple distributes it |
| Enterprise (in house) | Large organisations distributing to their own staff | Any device in the organisation, under the enterprise programme |
What it is
Apple's code signing system has several pieces. A certificate proves who signed the app. An App ID, matching the app's bundle identifier, names the app and the capabilities it uses, such as push notifications or Sign in with Apple. Registered devices are listed by their unique identifier. A provisioning profile, created in the Certificates, Identifiers and Profiles part of the developer site, binds these together and is signed by Apple. It is embedded in the app when it is built, as a file named embedded.mobileprovision.
How it works
When an iPhone installs or launches an app, it checks that the app's signature matches a certificate named in the embedded profile, that the profile is signed by Apple, that it has not expired, that the app's identifier matches the App ID, and, for development and ad hoc profiles, that this device is on the list. If any check fails, the app will not install or opens and closes immediately. Store builds are re-signed by Apple for distribution, so customers never deal with profiles at all.
When it matters
Provisioning matters every time you build for iPhone outside the simulator. It matters most when sharing test builds: an ad hoc build runs only on devices registered before it was built, so adding a new tester means registering their device and building again. It matters when adding capabilities, because the profile must include them. Cloud build services such as EAS can create and renew profiles for you if they have access to your Apple account through an API key.
Common mistakes
Adding a tester's device after the build and wondering why it will not install. Letting a certificate expire, which invalidates every profile that uses it. Creating many certificates and profiles by hand until nobody knows which is current. Turning on a capability in the code but not in the App ID. Using an ad hoc build for a large group when TestFlight would avoid device limits. And revoking a distribution certificate without realising it is in use by a build service.
Where it shows up in OneCraft
OneCraft runs Expo builds for iPhone and Android on paid plans: a test build, opened from an Expo page on iPhone or installed by QR code on Android, or a store build, each for 5 credits. iPhone builds need the owner's Apple key, which lets Expo's build service manage the signing for that account. The owner submits to the App Store from their own Apple account with eas submit; OneCraft does not submit apps.
Questions people ask
Where do I find my provisioning profiles?
Sign in to the Apple Developer website and open Certificates, Identifiers and Profiles, then Profiles. Each profile shows its type, App ID and expiry date. Tools such as Xcode and EAS can also list and download profiles for an account they have access to.
How long does a provisioning profile last?
Development and ad hoc profiles expire, typically within a year, and stop working early if the certificate they reference expires or is revoked. When a profile expires, test builds that carry it stop launching. App Store builds are not affected once Apple has distributed them.
Do I need a provisioning profile for TestFlight?
Yes, an App Store distribution profile, because TestFlight builds are store builds uploaded to App Store Connect. Testers do not need their devices registered. That is why TestFlight is easier than ad hoc builds for testing with more than a handful of people.
What is the difference between a certificate and a provisioning profile?
A certificate identifies the developer or team that signed the app. A provisioning profile says which app, signed by which certificates, may run on which devices with which capabilities. An app needs both, and the profile refers to the certificate.
Can a build service manage profiles for me?
Yes. EAS Build can create, store and renew certificates and provisioning profiles for an Apple account, using the account owner's credentials or an App Store Connect API key. That spares small teams from managing signing files by hand, while the files stay tied to their own Apple account.
Make one with websites
The button opens the generator with this use case already described. Change the wording to match your own.
Create a website with OneCraftRelated questions
- What is an App Store Connect API key?What is an App Store Connect API key? A private .p8 key with an issuer ID and key ID that lets tools manage builds and submissions on an Apple account.
- Development build vs production build in ExpoDevelopment build vs production build in Expo: what each EAS build profile is for, who can install it, how it is signed and which one goes to the stores.
- What is a bundle ID?What is a bundle ID? The unique reverse domain identifier for an app, like com.yourbusiness.app, used by Apple and Google. Format, rules and why it stays.
- Deep link vs universal linkDeep link vs universal link: custom scheme links against verified https links that open an app on iPhone and Android, with what happens without the app.
Written and checked by the OneCraft team. Last checked .