Product
Everything you need to manage Apple Developer assets.
An encrypted vault for your Apple certificates, a dashboard for every profile and expiration, and a CLI that ships signing assets to any CI. All synced with App Store Connect.
Product tour
Watch HexSign in action
A quick walkthrough of certificates, profiles, the wizard, and the relationship graph. Open the watch page →
Visualize
Interactive relationship graph
See how certificates, profiles, and bundle IDs connect. Click any node to highlight its dependency chain. Color-coded by health status.
Capabilities
What HexSign manages for your Apple Developer account
Auto-renewal
Distribution certificates and provisioning profiles reissue themselves 30 days before expiry. The new cert keeps the private key on file; profiles rebuild with the renewed cert IDs swapped in. Failures email your admins with Apple's exact reason.
Health score and expiring items
One score across certificate validity, profile status, and expiration timelines, with a panel that surfaces whatever needs attention first.
Certificate management
Create, revoke, and download certificates directly from HexSign. Track iOS Development, Distribution, Developer ID, Mac Installer, and Push, with .p12 export when the private key is on file.
Profile management
Create, update, regenerate, and download provisioning profiles across App Store, Ad Hoc, Development, and Enterprise, all from the dashboard.
Provisioning profile wizard
A guided flow that walks you through intent, identifier, certificate, and device selection, then builds the profile for you. No more Apple portal tab-switching.
CLI and headless automation
A single-binary CLI brings the dashboard to your terminal and CI. OAuth login locally, scoped client credentials in CI, and JSON output for scripting xcodebuild and fastlane pipelines.
Bundle ID and capability management
Register identifiers and toggle capabilities from one screen, without round-tripping through the Apple portal.
Device registry and enrollment
Register iPhones, iPads, Macs, Apple Watches, and Apple TVs by UDID. Enable or disable devices and add them to profiles in a click.
Team management and RBAC
Invite teammates by email, assign roles, and track auth activity. Deactivate users without losing audit history.
Multi-account management
Connect multiple Apple Developer team accounts. Each syncs independently with its own status and error reporting.
Expiration alerts
Thresholds at 7, 14, 30, 60, or 90 days, routed wherever your team already works. Test an alert before you enable it.
CSR generation and vault
Generate certificate signing requests with private keys encrypted at rest using AWS KMS, or upload your own. Reuse CSRs across certificates securely.
MFA and secure auth
Enforce multi-factor authentication with passkeys or authenticator apps. Cognito-backed sessions with device tracking and per-user auth logs.
Audit logs and sync history
Every certificate, profile, device, identifier, CSR, and user action is logged, with sync history showing counts, changes detected, and duration.
Auto-renew certificates and profiles before they expire
Proactive alerts to chat and incident tools
HexSign CLI for terminal and CI
Audit logs, sync history, and team controls
Ships signing assets to any CI. Bring your own pipeline.
Learn the fundamentals
The Apple signing assets HexSign manages
Provisioning profile
A signed plist Apple issues that links a specific App ID, signing certificate, list of devices (for development and Ad Hoc), and entitlements. Without a matching profile, iOS will refuse to launch your build.
.mobileprovision file
The file format Apple uses for provisioning profiles: a CMS-signed plist containing the profile's metadata, certificates, device list, and entitlements.
iOS Distribution certificate (legacy)
The pre-unified Apple distribution certificate type that signed builds specifically for iOS, iPadOS, tvOS, and watchOS. Replaced by the unified Apple Distribution certificate.
Developer ID Application certificate
An Apple-issued certificate that signs Mac apps distributed outside the Mac App Store, so Gatekeeper and notarization can verify them on first launch.
APNs auth key
A .p8 private key created in the Apple Developer portal that authenticates token-based push notification sending to APNs. One key serves every app on your team and does not expire.
Bundle ID
The reverse-DNS string in your app's Info.plist (`com.example.app`) that uniquely identifies it on the App Store and on every device it installs on.