Diagnose and resolve the most frequent iOS code-signing failures on Codemagic — missing certificates or profiles, bundle ID mismatches, and API key permission problems.
Code-signing failures on Codemagic surface during the archive or export phase of the build, after compilation succeeds. The build log typically shows an error such as 'No signing certificate found', 'No profiles for bundle identifier were found', 'Code signing is required for product type', or an authentication failure when Codemagic tries to reach App Store Connect. The frustrating part is that the same project usually signs fine locally, because Xcode's automatic signing on your Mac uses your logged-in Apple ID and cached credentials that simply do not exist on a fresh cloud machine. Recognizing that difference is the first step: the cloud build has no ambient developer identity, so everything signing needs must be provided explicitly through the API key or uploaded assets. Before diving into fixes, read the exact error text, because signing failures are specific — a missing certificate, a missing profile, a bundle identifier mismatch, and an API key permission problem each produce distinguishable messages and each has a different remedy. Retrying without understanding the message just burns build minutes and delays the fix. It also helps to scroll up in the log to the point where Codemagic first fetches or creates signing assets, since the root cause is usually announced there rather than at the final xcodebuild error line.
The most common root cause when using automatic signing is a problem with the App Store Connect API key. If the key is not configured in Codemagic, or the workflow does not reference it, Codemagic cannot authenticate to fetch or create signing assets, and you see authentication or 'unable to fetch' errors. If the key exists but lacks sufficient access — for example it was created with a read-only or limited role — Codemagic can authenticate but cannot create or download the certificate and profile it needs. Fix this by verifying all three parts of the key are correct in Codemagic: the Key ID, the Issuer ID, and the .p8 file contents. A common mistake is a truncated or re-formatted .p8, so re-upload the original file. Confirm the key's role in App Store Connect under Users and Access is adequate — App Manager is commonly sufficient for signing and build management. If the key was recently revoked or regenerated, the old credentials are dead; generate a fresh key, download the new .p8, and update Codemagic's stored integration. When you rotate a key, search your whole configuration for any workflow or environment group still pointing at the old integration name, because a single stale reference will keep failing while the others succeed.
A bundle identifier mismatch is the second most frequent cause and produces errors about no matching profile being found. The bundle identifier must be identical in three places: your Xcode target's build settings, the App ID registered in the Apple Developer portal, and the identifier referenced in your Codemagic signing configuration. Any discrepancy — a typo, a different reverse-domain prefix, a trailing environment suffix used in one place but not another — means the certificate and profile Codemagic looks for do not exist for the identifier it is signing. This is especially common when teams use different bundle identifiers per environment, such as com.example.app.dev versus com.example.app, and the CI configuration points at the wrong one. To fix it, open your Xcode project and note the exact Product Bundle Identifier for the target and configuration you build in CI, then confirm that exact string is registered as an App ID in the developer portal and referenced in your codemagic.yaml or Codemagic UI. When all three agree, automatic signing can locate or create a matching profile. Remember that app extensions each have their own identifier that must also match. Watch out for build settings that compose the identifier from variables like PRODUCT_BUNDLE_IDENTIFIER combined with a suffix per configuration, since the resolved value, not the literal in the field, is what Codemagic signs against.
Signing requires a valid distribution certificate. With automatic signing, Codemagic can create one via the API key, but Apple limits the number of distribution certificates a team may hold, and if that limit is already reached, creation fails and you see an error about being unable to create a certificate. In that case, review your certificates in the Apple Developer portal and revoke unused or expired ones to free a slot, or configure Codemagic to reuse an existing certificate you export as a .p12. With manual signing, the cause is usually an expired or missing uploaded certificate: distribution certificates have a validity period, and once expired every build that relies on them fails until you generate and upload a fresh one. Fix manual-signing certificate errors by exporting a current distribution certificate from Keychain Access as a .p12 with its private key and password, then uploading it to Codemagic to replace the stale asset. Whether automatic or manual, the underlying requirement is the same: a non-expired distribution certificate whose private key is available to the build machine at signing time. Before revoking anything, check with teammates, because revoking a distribution certificate that other pipelines or developers rely on will break their signing too until they obtain the replacement.
Even with a valid certificate and correct bundle identifier, signing fails if no suitable provisioning profile is available. Automatic signing asks Codemagic to fetch or generate a profile matching your bundle identifier and distribution type; this fails if the App ID does not exist in the portal, if a required capability on the App ID is misconfigured, or if the distribution type requested does not match the profile Apple can issue. For App Store and TestFlight builds you want an App Store distribution profile, so ensure your workflow's distribution type is app_store. With manual signing, a stale uploaded profile is the culprit — profiles become invalid when you add devices, change capabilities, or when the underlying certificate expires. Fix this by regenerating the profile in the developer portal so it reflects the current certificate and capabilities, then re-uploading it to Codemagic. If your app bundles extensions, each needs its own matching profile, and a missing extension profile will fail the whole archive even when the main app's profile is fine. Verify every embedded target has a corresponding, current profile. When mixing manual profiles with automatic signing across targets, be consistent — a half-manual, half-automatic configuration is a frequent source of confusing profile errors that are hard to diagnose from the log alone.
A subtler class of signing failure comes from entitlements that do not match the provisioning profile. If your app enables a capability like Push Notifications, App Groups, iCloud, Sign in with Apple, or associated domains in Xcode but that capability is not registered on the App ID in the developer portal, the generated profile will not contain the matching entitlement, and signing or the subsequent validation fails. This often works locally because Xcode's automatic signing quietly registers capabilities against your interactive session, but a clean cloud build has no such shortcut. To fix it, go to the Apple Developer portal, open the App ID for your bundle identifier, and enable every capability your app actually uses so they are part of the registered configuration. Then ensure your entitlements file and Xcode capability toggles match exactly. After aligning the portal, entitlements file, and Xcode settings, regenerate or let Codemagic recreate the profile so it includes the correct entitlements. Keeping these three sources in agreement is the durable fix; patching one without the others just moves the failure to a different build. A concrete example: an aps-environment entitlement in your file requires Push Notifications enabled on the App ID, and if you add the entitlement but forget the portal step, the cloud archive fails even though your local build was fine.
When a signing error appears, work through causes in order of likelihood rather than guessing. First, read the exact error message and identify which category it falls into — authentication, missing certificate, missing profile, bundle identifier, or entitlement. Second, verify the App Store Connect API key: all three components correct, the key not revoked, and its role sufficient. Third, confirm the bundle identifier matches across Xcode, the developer portal, and Codemagic, including every extension. Fourth, check that a valid, non-expired distribution certificate exists and, for automatic signing, that you have not hit Apple's certificate limit. Fifth, confirm a current provisioning profile of the correct distribution type is available for every target. Sixth, reconcile capabilities and entitlements across the portal, your entitlements file, and Xcode. Because cloud builds cannot be poked interactively, this disciplined sequence saves both time and build minutes compared to blind retries. Once you identify and fix the specific root cause, re-run the build and read the signing log lines to confirm the certificate and profile were installed and applied before assuming the problem is fully resolved. If you are still stuck after the checklist, some plans let you open a remote debugging session into the build machine, where you can inspect the temporary keychain and installed profiles directly and often spot the mismatch in seconds.
Your Mac has a logged-in Apple ID and cached credentials that Xcode's automatic signing uses. A fresh cloud machine has no ambient developer identity, so everything signing needs must be provided explicitly through the App Store Connect API key or uploaded certificates and profiles.
The key must have enough access to manage builds and, for automatic signing, work with certificates and profiles. App Manager is commonly sufficient. A read-only or overly limited role lets Codemagic authenticate but not create the assets it needs, causing failures.
Confirm the bundle identifier is identical in your Xcode target, the App ID in the Apple Developer portal, and your Codemagic configuration. Register the App ID if it is missing, and ensure the distribution type is app_store for TestFlight and App Store builds.
Apple limits the number of distribution certificates per team. In the Apple Developer portal, revoke unused or expired certificates to free a slot, or export an existing distribution certificate as a .p12 and configure Codemagic to reuse it rather than creating a new one.
If your app enables a capability in Xcode that is not registered on the App ID in the developer portal, the provisioning profile will lack the matching entitlement and signing or validation fails. Enable every used capability on the App ID and keep your entitlements file and Xcode toggles in agreement.