How to Manage iOS and Android Signing Credentials with Mach

Set up Apple certificates and profiles, Android keystores, and store automation keys without scattering sensitive files through projects or CI.

What you will finish with

A linked Mach project, a framework-specific mach.config.json, and an exact command sequence for your first release workflow.

Understand the credential scope first

Mach keeps signing material encrypted in the Dashboard and injects it only when the selected build needs it. Credentials are scoped to the platform, bundle identifier or package name, and distribution type, which avoids an internal profile being used for a store build by accident.

The profile fields are what matter. For iOS, distribution and iOS export method select signing; for Android, the matching keystore is resolved for the selected package and distribution. Do not rely on a profile name alone to convey signing intent.

1. Start the interactive credential manager

Run the credential flow from the linked project. Choose the platform, the bundle ID or package name, and the credential type that matches the build you intend to make: development, internal or ad-hoc, or store.

bash

mach credentials

The selected credential type is authoritative

The credential choice in the interactive flow is not silently replaced by the selected build profile. This is useful when a custom profile name does not clearly describe its signing mode.

2. Configure iOS signing

Mach signs in to the Apple Developer Portal, lists the teams connected to the Apple ID, and lets you choose the right team. It then synchronizes the certificate and provisioning profile for the selected bundle ID and distribution type.

After selecting a team, Mach can save the team ID to the Dashboard and optionally add the profile-specific Apple Team ID to mach.config.json. Production defaults to saving this local profile metadata; development and staging default to leaving the config untouched unless you opt in.

bash

mach credentials --platform ios --profile production mach credentials --bundle-id com.example.app.staging

Certificate reuse protects Apple limits

When Apple has reached its active Distribution certificate limit, Mach can offer compatible saved certificates from Mach projects you administer rather than automatically revoking or creating another certificate.

3. Configure Android signing

Use the same flow to create or upload an Android keystore for the exact package and distribution type. Mach stores the keystore and its passwords with the credential record, rather than asking CI to manage separate password variables.

bash

mach credentials --platform android --profile production

4. Add service credentials only when you submit to a store

Store automation keys are different from signing keys. An Android Google Play service account is required only for publishing to Google Play, while an iOS App Store Connect API key is used for TestFlight or App Store submission.

bash

mach credentials:service --platform android --package-name com.example.app --file ~/Downloads/play-service-account.json mach credentials:service --platform ios

5. Build with the resolved credentials

Run the normal build command after credentials are saved. Mach resolves the compatible record for the target identifiers and profile, injects it only into the build environment, and keeps the artifact and signing history attached to the Dashboard build.

bash

mach build --platform ios --profile production mach build --platform android --profile production

Keep going

Inspect the resolved config

mach config --profile production

Confirm the identifier, profile, and distribution settings before a release build.

Submit a build

mach submit --latest --platform ios --profile production

Submit the latest eligible signed iOS build after App Store Connect credentials are in place.

Build and release with less ceremony.

Guides for Flutter, React Native, and Expo teams that want a clear path from project setup to shipment.

All guides

Start free