A signing certificate proves that you built the app, and a provisioning profile ties that certificate to a bundle ID, devices and allowed capabilities. As of October 16, 2026, an Apple certificate typically lasts about a year and a profile no more than a year, and since Xcode 13 Xcode can manage App Store signing for you.
What certificates and profiles are
A certificate is your signature. It pairs a private key on your Mac with a public part issued by Apple. Development certificates (Apple Development) belong to an individual, and Apple appends the computer name to them. Distribution certificates (Apple Distribution) belong to the whole team (Developer Account Help).
A provisioning profile answers five questions. Who signed it, which app, which devices it runs on, until when, and with which entitlements (TN3125). A development profile lists devices. An App Store profile doesn't, because the App Store checks the signature on upload and then re-signs the app with its own credentials.
Where certificates and profiles live
They are not in App Store Connect. They live in your developer account under Certificates, Identifiers & Profiles, with Certificates, Identifiers, Devices and Profiles in the sidebar. To create a profile, go to Profiles › + and pick a type under Development or Distribution, which for an App Store app is App Store Connect.
In Xcode, signing is set on the app target's Signing & Capabilities tab, with the Automatically manage signing checkbox, the Team field and the Bundle Identifier. Your account goes in Xcode › Settings › Apple Accounts. Xcode 16 and later keep downloaded profiles in ~/Library/Developer/Xcode/UserData/Provisioning Profiles, as the Xcode 16 release notes say.
Apple's types and limits
| What | Apple's terms |
|---|---|
| Apple Development | running on your devices, one per developer |
| Apple Distribution | uploading to App Store Connect and test distribution, created by the Account Holder or Admin only |
| iOS Development and iOS Distribution | legacy types for Xcode 11 and earlier |
| Distribution certificates per team | one of each type, except Developer ID |
| Developer ID | up to 5 Application and up to 5 Installer, for Mac software outside the App Store |
| App Store Connect profile | exactly one distribution certificate inside |
| Certificate lifetime | typically a year from issue |
| Profile lifetime | typically no more than a year, Developer ID 18 years |
| Without membership | 3 devices, 10 App IDs, profiles last 7 days |
| Devices with membership | up to 100 per product family per year |
| WWDR intermediate certificate | issuing since January 28, 2021, expires February 20, 2030 |
Per Apple's help on certificate types and Developer ID, TN3161, TN3125, App Store profiles and the membership comparison, checked October 16, 2026.
Expiry and cloud signing
For App Store apps, certificate expiry is mostly harmless. With an active membership, an expired or revoked distribution certificate doesn't affect apps already on sale. You can't sign or upload new builds with it, and builds uploaded but not yet submitted for review may be marked Invalid Binary if their certificate was revoked (Apple's certificate support page).
Since Xcode 13, distribution certificates can live in Apple's cloud. If your Mac has no Apple Distribution certificate of its own when you export from the Organizer, Xcode signs the build with a cloud-managed one. A new cloud certificate is created automatically 90 days before the old one expires, and the Account Holder or an Admin can rotate it by hand once less than half its term is left, often 180 days (cloud-managed certificates).
The longest term belongs to Developer ID profiles for Mac software outside the App Store. Those created after February 22, 2017, last 18 years regardless of the certificate's expiry. And since January 28, 2021, every signing certificate has been issued from Apple's WWDR intermediate certificate, which expires on February 20, 2030.
How to set up signing, step by step
- Join the Apple Developer Program, or start with a free personal team, whose profiles last 7 days.
- Add your Apple Account under Xcode › Settings › Apple Accounts.
- On the app target's Signing & Capabilities tab, turn on Automatically manage signing and pick your team in the Team field.
- Enter a bundle ID that no other app uses. If Xcode shows a warning, the ID is taken.
- Connect your iPhone and choose it as the run destination. Xcode registers the device and creates the development profile, and if a Register button appears, click it.
- For the App Store, archive with Product › Archive and export from the Organizer. With automatic signing Xcode creates the distribution profile too.
Common mistakes
- Revoking the distribution certificate just in case. It won't break your live app, but uploaded builds that haven't been submitted may turn into Invalid Binary. Revoke only if the key leaked.
- Sharing certificates outside the team. Apple explicitly asks you not to share them outside your organization. Give a contractor a role on your team instead.
- A manual profile after adding a device. A new iPhone doesn't join an existing development profile on its own. The profile has to be updated and downloaded again, which automatic signing does for you.
- Relying on a free team profile. It lasts 7 days, fits 3 apps per device, and App Store Connect and TestFlight aren't available without a membership.
Appto fills in App Store Connect, from purchases and the privacy questionnaire to the build and the final checklist, and asks for a yes wherever it writes to App Store Connect. More on the App Store Connect page.
Questions
Where are certificates in App Store Connect?
They aren't there. Certificates, identifiers and profiles live in your developer account, under Certificates, Identifiers & Profiles.
How long is an Apple Distribution certificate valid?
Typically a year from issue (TN3161). Apps already on the App Store keep working after it expires, as long as your membership is active.
How long does a provisioning profile last?
Typically no more than a year. A free personal team profile lasts 7 days, and a Developer ID profile for the Mac lasts 18 years.
Where does Xcode 26 store provisioning profiles?
Since Xcode 16, in ~/Library/Developer/Xcode/UserData/Provisioning Profiles. Xcode still reads profiles from the old folder too.
How many certificates can I create?
One distribution certificate of each type per team, except Developer ID, where you get up to 5 Application and 5 Installer certificates. Each team member has their own development certificates.
Build your own app in Appto
Appto checks the niche on fresh App Store data, designs the screens, writes the code, builds the App Store page and submits to Apple from your account or shows you what to press in App Store Connect. Runs on your own Claude Code or Codex.
Download for Mac