Apple notarisation

Notarising sends your signed build to Apple, which scans it and returns a ticket. Gatekeeper checks for that ticket on anything downloaded from the internet. Without one, a signed build still warns; with one, it opens.

It applies to macOS and iOS builds, and uses one credential for both.

What you need

An App Store Connect API key. This is not the same thing as your signing certificate, and not the same as an app-specific password — that older method is being retired.

1. Go to Users and Access → Integrations → App Store Connect API.
2. You need the Admin or App Manager role to create one.
3. Create a key. Give it the Developer role — notarisation needs no more.
4. Download the .p8 file.

The .p8 downloads exactly once. Apple will not show it again. If you lose it, revoke the key and make another.

While you are on that page, note two values beside the key:

• the Key ID, ten characters
• the Issuer ID, a UUID at the top of the page, shared by all your keys

What to put in Forge

What to expect

Notarisation is a round trip to Apple and takes minutes, not seconds — occasionally much longer when Apple is busy. Forge submits after signing and waits for the answer, so a notarised build takes longer than an unnotarised one. That is Apple's queue, not ours.

If Apple rejects a build it says why, and the reason is usually a component that is not signed or is signed with the wrong kind of certificate.

Honest status

This is the one step in Forge's signing path that has not yet been run against a real Apple account. Everything else here — signing macOS, iOS, Windows and Android on Linux — has been verified end to end. Notarisation is implemented to Apple's documented API and will get the same treatment before it is offered as a finished feature.