Works with
HexSign works with Codemagic
Codemagic signs at build time. Give it an App Store Connect API key and automatic code signing fetches or creates the certificate and profile the build needs, which works right up until the certificate turns a year old on a Friday. HexSign is the layer underneath: it syncs the same Apple team through the same API, reissues certificates and rebuilds profiles 30 days before they expire, and puts an alert in front of a human when a renewal cannot complete. On the Codemagic side it is two lines in a scripts block, hexsign certificates download and hexsign profiles download, run before xcodebuild.
TL;DR
- HexSign does not run builds. Codemagic keeps doing that; HexSign keeps the material it signs with valid.
- Add hexsign certificates download and hexsign profiles download to a scripts block in codemagic.yaml. No uploaded .p12, no signing secrets committed to the repo.
- Renewal is scheduled, not build-triggered. A daily job reissues distribution certificates and rebuilds profiles 30 days out, so a red build is not how you learn about expiry.
- Codemagic's docs send you to Apple's portal to revoke a certificate. HexSign revokes, rotates, and writes it to the audit log from the dashboard.
- The same vault feeds Codemagic, GitHub Actions, Bitrise, Jenkins, and a developer's Mac, so moving one pipeline never means setting signing up from scratch.
By Ash Dan, Founder, HexSign · Last reviewed
Where teams hit friction
Common pain points with Codemagic
Why teams pick HexSign
What HexSign adds on top of Codemagic
Live relationship graph
An interactive graph linking certificates, provisioning profiles, bundle IDs, and devices. Click any node to see its dependencies and the blast radius of revoking or rotating it.
Expiration alerts before things break
Alerts to email, Slack, Microsoft Teams, Jira, PagerDuty, Jira Service Management, or incident.io at thresholds you choose (7, 14, 30, 60, 90 days). Send a test alert before enabling delivery, so there are no surprise expirations during a release.
Health score & expiring items
A 0-100% health score across every Apple account you connect, plus an expiring-items panel that surfaces what to act on first. No CLI invocation required.
Guided provisioning profile wizard
A step-by-step wizard picks the right profile type, identifier, signing certificate, and devices, then generates the profile through Apple's API. No portal tab-switching.
Multi-account dashboard
Connect one or many Apple Developer team accounts. Each syncs independently with its own status and error reporting, all visible from a single dashboard.
Audit logs, RBAC & MFA
Owner / Admin / Member roles, per-user auth activity log, and MFA via SMS or TOTP authenticator apps. Every certificate, profile, device, and identifier change is logged.
Side-by-side
HexSign vs Codemagic, feature by feature
HexSign | Codemagic | |
|---|---|---|
| Approach | ||
| Primary purpose | Apple Developer asset dashboard | CI/CD platform with code signing |
| Standalone of CI | Tied to build pipelines | |
| Setup | Add an ASC API key | Configure project + ASC API key |
| Open-source CLI | codemagic-cli-tools (open source) | |
| Asset Management | ||
| Certificate generation | Yes (during build) | |
| Certificate revocation | Done in Apple Developer Portal | |
| Profile creation | Yes, via wizard | Yes, automatic |
| Profile regeneration | Manual re-upload | |
| Manual cert/profile upload | Synced via API; .p12 key upload for certs made elsewhere | Yes (.p12 + .mobileprovision) |
| Bundle ID & capability management | Via Apple Developer Portal | |
| CSR generation with KMS-encrypted private key | Private key generated and held by Codemagic | |
| Visibility & Monitoring | ||
| Relationship graph | ||
| Health score dashboard | ||
| Multi-account dashboard | Per-team Developer Portal integrations | |
| Audit perspective | Asset lifecycle | Build-centric |
| Alerts | ||
| Cert/profile expiration alerts (email) | Yes, custom thresholds | Not documented |
| Slack alerts for expiry | Build notifications only | |
| Microsoft Teams alerts for expiry | Build notifications only | |
| Team & Security | ||
| Role-based access control | Owner / Admin / Member | Team admin permissions |
| Multi-factor authentication | TOTP / SMS | Account-level |
| Audit logs | Build-centric | |
| Pricing | ||
| Free tier | ||
| Free trial | 14 days | |
| Enterprise plan | From $12,000/yr (SSO, SLAs) | |
FAQ
Questions about HexSign vs Codemagic
Other comparisons
Beyond Codemagic: more HexSign comparisons
Open-source CLI
HexSign vs Fastlane Match
Read HexSign vs Fastlane MatchApple's first-party portal
HexSign vs Apple Developer Portal
Read HexSign vs Apple Developer PortalMobile DevOps platform
HexSign vs Bitrise
Read HexSign vs BitriseApple's managed CI/CD with automatic signing
HexSign vs Xcode Cloud
Read HexSign vs Xcode CloudEnterprise mobile CI/CD
HexSign vs Appcircle
Read HexSign vs AppcircleManaged credentials for Expo
HexSign vs Expo EAS
Read HexSign vs Expo EASLive updates and native builds for Capacitor
HexSign vs Capawesome Cloud
Read HexSign vs Capawesome CloudSee HexSign in your stack: code signing for iOS Native (Swift), code signing for Flutter, code signing for React Native, code signing for Electron, and code signing for vibe coding.