Bring your own CI
Apple signing from your terminal and CI.
Fetch Apple certificates and provisioning profiles from the HexSign vault into any CI: GitHub Actions, GitLab, Bitrise, Codemagic, fastlane, or your laptop. One binary, scoped credentials, no certificates committed to git.
Install
Pick a channel. Log in once.
Released binaries are zero-config: log in once and you're done. Pick whichever channel suits you best.
brew tap hexsign/tap brew install hexsign hexsign login
# macOS, Linux, Windows # https://github.com/hexsign/hexsign-cli/releases curl -L -o hexsign \ https://github.com/hexsign/hexsign-cli/releases/latest/download/hexsign-darwin-arm64 chmod +x hexsign && mv hexsign /usr/local/bin/
Need to verify checksums or pick a specific OS / arch? See the releases page.
Capabilities
Ship signing assets to any CI, without storing them in git.
The CLI pulls certificates and profiles straight from the encrypted HexSign vault into your shell, your Makefile, or your pipeline. Same data as the dashboard, scoped credentials for CI, no secrets in your repo.
Certificates
List, inspect, download, revoke, and surface expiring certificates across every connected Apple Developer account.
Provisioning profiles
List, get, download, regenerate, and delete profiles. Pull the right .mobileprovision into your build directory before xcodebuild.
Identifiers & capabilities
Create and manage bundle IDs from your shell. Scriptable for new app bootstrapping and bulk identifier hygiene.
Devices
Register iPhones, iPads, Macs, Apple Watches, and Apple TVs by UDID. Great for QA fleets and beta enrollment scripts.
CSRs & key vault
Generate certificate signing requests with KMS-encrypted private keys, or upload your own. Reuse CSRs without ever exporting a key.
Apple accounts
List connected Apple Developer accounts, trigger an on-demand sync, or remove an account, from CI or your laptop.
Health summary
One command (`hexsign summary`) prints health, expiring items, and account status. Drop it into a cron, Slack bot, or status page.
JSON or table output
Every command supports `-o table` (default) for humans and `-o json` for pipelines, jq, and dashboards.
Authentication
Two modes, picked automatically.
Local: OAuth + PKCE
Run hexsign login and your browser handles the rest. The refresh token is stashed in your OS keychain; the CLI silently refreshes after that.
hexsign login hexsign whoami
CI: client credentials
Generate a service credential under Settings → CLI Tokens in the dashboard. Drop the ID and secret into your pipeline, and the CLI swaps to machine mode automatically.
env:
HEXSIGN_CLIENT_ID: ${{ secrets.HEXSIGN_CLIENT_ID }}
HEXSIGN_CLIENT_SECRET: ${{ secrets.HEXSIGN_CLIENT_SECRET }}CI / CD
Fetch signing material before xcodebuild.
No more committing certificates to a private repo, no more fastlane match incantations. Pull the exact certificate and profile you need by ID, sign, ship.
- name: Fetch signing material
env:
HEXSIGN_CLIENT_ID: ${{ secrets.HEXSIGN_CLIENT_ID }}
HEXSIGN_CLIENT_SECRET: ${{ secrets.HEXSIGN_CLIENT_SECRET }}
PROFILE_ID: ${{ vars.HEXSIGN_PROFILE_ID }}
CERT_ID: ${{ vars.HEXSIGN_CERT_ID }}
run: |
hexsign certificates download "$CERT_ID" --output-dir build/sign --keychain "$RUNNER_TEMP/signing.keychain-db"
hexsign profiles download "$PROFILE_ID" --output-dir build/sign --install
# cert imported, profile installed, go straight to xcodebuildCheat sheet
A taste of the command surface.
hexsign login | logout | whoami hexsign apple-accounts (list | sync <id> | delete <id>) hexsign certificates list [--type <t>] [--status <s>] hexsign certificates download <id> [--output-dir DIR] [--keychain PATH] hexsign certificates revoke <id> hexsign certificates expiring hexsign profiles list [--type <t>] [--status <s>] hexsign profiles download <id> [--output-dir DIR] [--install] hexsign profiles regenerate <id> hexsign profiles expiring hexsign identifiers (list | get | create | delete) hexsign devices (list | get | create) hexsign csrs (list | generate | upload --file | delete) hexsign summary # every command supports -o table | json
Security
Built to live where your secrets live.
Refresh tokens in your OS keychain
Never written to disk in plain text. macOS Keychain, Linux Secret Service, Windows Credential Manager.
Short-lived access tokens
ID and access tokens cached locally with 0600 perms. Refreshed silently on every call.
Strict file modes for downloads
Downloaded .p12 and .password files are written with 0600. Safe to store inside your repo's build directory.
Scoped CI credentials
Machine tokens are bound to read / write scopes. Routes for users, billing, and CLI tokens are blocked. Revoke instantly from the dashboard.
Learn the fundamentals
Concepts behind the commands
Code signing
The process of attaching a cryptographic signature to a binary so the operating system can verify who built it and that nothing has changed since. Required for every app shipped on Apple platforms.
.mobileprovision file
The file format Apple uses for provisioning profiles: a CMS-signed plist containing the profile's metadata, certificates, device list, and entitlements.
fastlane match
A fastlane action that stores Apple signing material (certificates, private keys, provisioning profiles) in a shared, encrypted git repo so every developer and CI runner can pull the same identities.
CSR (Certificate Signing Request)
A file containing a public key and team identity, signed with the matching private key. You upload it to Apple to be issued a certificate. The private key never leaves your machine in the process.
App Store Connect API key
A three-part credential (Key ID, Issuer ID, and .p8 private key) Apple issues to authenticate non-interactive access to the App Store Connect API. The modern replacement for sharing Apple ID passwords.
TestFlight
Apple's built-in beta-testing service for distributing signed builds to up to 100 internal team members and 10,000 external testers, before submitting to the App Store.