Product
Everything you need to manage Apple Developer assets.
An encrypted vault for your Apple certificates, a dashboard for every profile and expiration, and a CLI that ships signing assets to any CI. All synced with App Store Connect.
Product tour
Watch HexSign in action
A quick walkthrough of certificates, profiles, the wizard, and the relationship graph. Open the watch page →
Visualize
Interactive relationship graph
See how certificates, profiles, and bundle IDs connect. Click any node to highlight its dependency chain. Color-coded by health status.
Capabilities
What HexSign manages for your Apple Developer account
Auto-renewal
Distribution certificates and provisioning profiles reissue themselves 30 days before expiry. The new cert keeps the private key on file; profiles rebuild with the renewed cert IDs swapped in. Failures email your admins with Apple's exact reason.
Certificate management
Create, revoke, and download certificates directly from HexSign. Track iOS Development, Distribution, Developer ID, Mac Installer, Push, and more, with .p12 export when the private key is on file.
Profile management
Create, update, regenerate, and download provisioning profiles across App Store, Ad Hoc, Development, and Enterprise, all from the dashboard.
Provisioning profile wizard
A guided flow that walks you through intent, identifier, certificate, and device selection, then builds the profile for you. No more Apple portal tab-switching.
CSR generation & vault
Generate certificate signing requests with private keys encrypted at rest using AWS KMS, or upload your own. Reuse CSRs across certificates securely.
Bundle ID & capability management
Register identifiers and toggle capabilities (Push Notifications, App Groups, Associated Domains, HealthKit, HomeKit, CloudKit, Wallet, and more) from one screen.
Device registry & enrollment
Register iPhones, iPads, Macs, Apple Watches, and Apple TVs by UDID. Enable or disable devices and add them to profiles in a click.
Team management & RBAC
Invite teammates by email, assign Owner, Admin, or Member roles, and track auth activity. Deactivate users without losing audit history.
MFA & secure auth
Enforce multi-factor authentication with SMS or authenticator apps (TOTP). Cognito-backed sessions with device tracking and per-user auth logs.
Multi-account management
Connect multiple Apple Developer team accounts. Each syncs independently with its own status and error reporting. All visible from a single dashboard.
Health score and expiring items
Dashboard surfaces an overall health score (0-100%) based on certificate validity, profile status, and expiration timelines. Expiring items panel highlights what needs attention.
Audit logs and sync history
Every certificate, profile, device, identifier, CSR, and user action is logged. Detailed sync history with counts, changes detected, and duration.
CLI & headless automation
A single-binary CLI brings the dashboard to your terminal and CI. OAuth login locally, scoped client credentials in CI, JSON output for scripting xcodebuild and fastlane pipelines.
Auto-renew certificates and profiles before they expire
Proactive alerts to chat and incident tools
HexSign CLI for terminal and CI
Audit logs, sync history, and team controls
Ships signing assets to any CI. Bring your own pipeline.
Learn the fundamentals
The Apple signing assets HexSign manages
Provisioning profile
A signed plist Apple issues that links a specific App ID, signing certificate, list of devices (for development and Ad Hoc), and entitlements. Without a matching profile, iOS will refuse to launch your build.
.mobileprovision file
The file format Apple uses for provisioning profiles: a CMS-signed plist containing the profile's metadata, certificates, device list, and entitlements.
iOS Distribution certificate (legacy)
The pre-unified Apple distribution certificate type that signed builds specifically for iOS, iPadOS, tvOS, and watchOS. Replaced by the unified Apple Distribution certificate.
Developer ID Application certificate
An Apple-issued certificate that signs Mac apps distributed outside the Mac App Store, so Gatekeeper and notarization can verify them on first launch.
APNs auth key
A .p8 private key created in the Apple Developer portal that authenticates token-based push notification sending to APNs. One key serves every app on your team and does not expire.
Bundle ID
The reverse-DNS string in your app's Info.plist (`com.example.app`) that uniquely identifies it on the App Store and on every device it installs on.