Works with
HexSign works with Xcode Cloud
Xcode Cloud handles its own signing, and it handles it well. Apple creates and manages the certificates and provisioning profiles its builds use, so for an App Store or TestFlight build that comes out of Xcode Cloud there is genuinely nothing for you to renew. What Apple does not document is a way to export that identity, which is why everything outside Xcode Cloud still needs certificates somebody owns: a fastlane lane, a GitHub Actions job, a Developer ID build of the Mac app, a teammate archiving from their laptop. HexSign is where those live, synced through the App Store Connect API, reissued 30 days before expiry, with an alert when a renewal needs a person.
TL;DR
- What Xcode Cloud will renew: the signing material for builds it runs itself. What it will not renew: the certificates your other pipelines, Developer ID builds, and local archives depend on.
- Apple does not document exporting an Xcode Cloud signing identity, so the same identity cannot be reused in another CI or on a developer's Mac.
- HexSign reads the same Apple team through the App Store Connect API. Both can run against one account; neither blocks the other.
- A daily job reissues certificates and rebuilds profiles 30 days before expiry, and alerts email, Slack, Microsoft Teams, Jira, PagerDuty, or incident.io when one needs attention.
- If every build you ship comes out of Xcode Cloud and nobody ever signs anything locally, you do not need HexSign yet. Most teams find out they are not in that position the week they add a second pipeline.
By Ash Dan, Founder, HexSign · Last reviewed
Where teams hit friction
Common pain points with Xcode Cloud
Why teams pick HexSign
What HexSign adds on top of Xcode Cloud
Live relationship graph
An interactive graph linking certificates, provisioning profiles, bundle IDs, and devices. Click any node to see its dependencies and the blast radius of revoking or rotating it.
Expiration alerts before things break
Alerts to email, Slack, Microsoft Teams, Jira, PagerDuty, Jira Service Management, or incident.io at thresholds you choose (7, 14, 30, 60, 90 days). Send a test alert before enabling delivery, so there are no surprise expirations during a release.
Health score & expiring items
A 0-100% health score across every Apple account you connect, plus an expiring-items panel that surfaces what to act on first. No CLI invocation required.
Guided provisioning profile wizard
A step-by-step wizard picks the right profile type, identifier, signing certificate, and devices, then generates the profile through Apple's API. No portal tab-switching.
Multi-account dashboard
Connect one or many Apple Developer team accounts. Each syncs independently with its own status and error reporting, all visible from a single dashboard.
Audit logs, RBAC & MFA
Owner / Admin / Member roles, per-user auth activity log, and MFA via SMS or TOTP authenticator apps. Every certificate, profile, device, and identifier change is logged.
Side-by-side
HexSign vs Xcode Cloud, feature by feature
HexSign | Xcode Cloud | |
|---|---|---|
| Approach | ||
| Primary purpose | Apple Developer asset dashboard | Managed CI/CD with automatic signing |
| Standalone of CI | Tied to Xcode Cloud builds | |
| Works with any CI | Xcode Cloud only | |
| Portable signing identity | Yes, fetch anywhere via CLI | |
| Setup | Add an ASC API key | Enable in Xcode + App Store Connect |
| Asset Management | ||
| Certificate generation | Automatic (cloud-managed by Apple) | |
| Certificate rotation before expiry | Yes, daily job at 30 days out | Cloud-managed certs reissued 90 days out, on a signing request |
| Certificate revocation | Yes, from the dashboard | Apple Developer Portal |
| Profile creation | Yes, via wizard | Automatic |
| Profile regeneration | Automatic | |
| Manual cert/profile upload | Synced via API; .p12 key upload for certs made elsewhere | |
| Bundle ID & capability management | Via Apple Developer Portal | |
| CSR generation with KMS-encrypted private key | ||
| Export / reuse signing identity elsewhere | Not documented | |
| Visibility & Monitoring | ||
| Relationship graph | ||
| Health score dashboard | ||
| Multi-account dashboard | Per-team App Store Connect | |
| Audit perspective | Asset lifecycle | Build-centric |
| Alerts | ||
| Cert/profile expiration alerts (email) | Yes, custom thresholds | Not documented |
| Slack alerts for expiry | Build notifications only | |
| Microsoft Teams alerts for expiry | Build notifications only | |
| Team & Security | ||
| Role-based access control | Owner / Admin / Member | App Store Connect roles |
| Multi-factor authentication | TOTP / SMS | Apple ID (account-level) |
| Audit logs | Build-centric | |
| Pricing | ||
| Free tier | 25 compute hours/month with the Developer Program | |
| Free trial | 14 days | |
| Pricing model | Flat per-team plan | Monthly subscription by compute hours |
FAQ
Questions about HexSign vs Xcode Cloud
Other comparisons
Beyond Xcode Cloud: more HexSign comparisons
Open-source CLI
HexSign vs Fastlane Match
Read HexSign vs Fastlane MatchApple's first-party portal
HexSign vs Apple Developer Portal
Read HexSign vs Apple Developer PortalCI/CD with managed signing
HexSign vs Codemagic
Read HexSign vs CodemagicMobile DevOps platform
HexSign vs Bitrise
Read HexSign vs BitriseEnterprise mobile CI/CD
HexSign vs Appcircle
Read HexSign vs AppcircleManaged credentials for Expo
HexSign vs Expo EAS
Read HexSign vs Expo EASLive updates and native builds for Capacitor
HexSign vs Capawesome Cloud
Read HexSign vs Capawesome CloudSee HexSign in your stack: code signing for iOS Native (Swift), code signing for Flutter, code signing for React Native, code signing for Electron, and code signing for vibe coding.