Apple Individual and Organization — complete setup

SiteCargo prepares your app and uploads it to your App Store Connect account. With Individual, the owner prepares signing files once. With Organization, SiteCargo receives permissions and sets up signing.

Uploading a binary, processing it in TestFlight, submitting to App Review and releasing it on the App Store are separate steps. Apple setup in the dashboard prepares the technical access; it does not mean the app has been published.

The simplest option: SiteCargo sets it up

The connection dialog defaults to “SiteCargo will set it up (recommended)”. Use “Who will set up the connection?” to choose manual setup with limited permissions.

1. Open your app in SiteCargo → Distribution → Apple App Store → connection instructions.
2. Keep “SiteCargo will set it up” and select Organization or Individual using Apple Developer → Membership details → Entity Type.
3. Use “Copy email” to copy the address shown. It is usually publish@sitecargo.com; use the exact address displayed.
4. Open App Store Connect → Users and Access → People → +. Enter the SiteCargo specialist's name and copied email, choose Admin, and click Invite. Admin has access to all apps in the account. For Organization, the role allows our team to use Certificates, Identifiers & Profiles; for Individual, the invitation provides App Store Connect access only.
5. If API access is not enabled, the account owner opens Users and Access → Integrations → App Store Connect API → Request Access, accepts the terms, and clicks Submit. Skip this if already approved. Apple reviews the request; discuss an alternative upload method with our team while approval is pending. Our Admin creates the API key after approval.
6. Return to SiteCargo, select “I sent the invitation with Admin permissions”, and click “Save and Check” at the bottom. You do not need to enter Team ID, the listing Apple ID, Key ID, Issuer ID, or Organization files.
7. Wait for the team to check access. “Invitation sent” records your request; it does not yet confirm acceptance or build readiness. Our specialist accepts the invitation, supplies technical details, and completes the required checks.

The dialog always shows “Close” and “Save and Check” at the bottom. Only the content between the header and buttons scrolls. In manual mode, saving validates uploaded files; the specialist confirms invitation acceptance and signing setup. Access to App Store Connect is checked before uploading the app.

What the Individual owner still needs to do

Apple does not let an invited Admin create the Distribution certificate, App IDs, provisioning profiles, or APNs key for an Individual membership. A higher App Store Connect role cannot remove this requirement. Send the invitation first: our team checks the identifiers and explains which files are still needed. Then click “Upload required Individual files” in the same dialog. It opens only the .p12 and its export password, two .mobileprovision files, and the APNs .p8 with its Key ID. Our specialist handles upload authorization details. Team ID is detected from the verified .p12; this section has no Team ID input. If the team has already set it, the file must match that value. Choose the files and click “Save and Check” at the bottom.

Sections 5–7 and 9 below explain how to prepare these files. If working files already exist, our team checks whether they can be reused; creating new ones is not automatically required. This upload section is hidden for Organization.

If you prefer fewer permissions

Choose “I will set it up with limited permissions”. Invite SiteCargo as App Manager and limit access to the relevant app where Apple allows it. For Organization, also enable Certificates, Identifiers & Profiles; the owner or an Admin creates the APNs key. In this form, you supply Team ID and upload authorization details, plus signing files for Individual. The detailed sections below cover this setup and the required Individual files. SiteCargo assigns and verifies the Bundle ID in both modes; customers cannot edit it in the form.

Changing the setup method preserves already verified files for the same owner, Team ID, and Bundle ID. It does not change Apple permissions: to move from Admin to limited access, change the user's role in Users and Access and tell our team. Agreements, membership renewal, tax information, and banking details remain the owner's responsibility.

1. Identify your account type

Sign in to Apple Developer and check Membership details → Entity Type. Select the matching type in SiteCargo: Distribution → Apple card → connection instructions → Apple Developer account type.

Membership	Invitation to SiteCargo	Signing setup
Individual	Admin; App Manager in manual mode	Owner supplies a .p12 and two .mobileprovision files
Organization	Admin; App Manager plus Certificates, Identifiers & Profiles in manual mode	SiteCargo prepares the certificate and profiles

Admin and App Manager are roles, not membership types. With Individual, an invited App Store Connect user does not gain Apple Developer team certificate access. Apple roles.

Both paths require your active paid Apple Developer Program membership. SiteCargo handles app preparation and upload after access and signing files are ready.

2. Invite SiteCargo

For the recommended option, follow the checklist above: Admin and one invitation. In manual mode, open App Store Connect → Users and Access → People → +, enter the email shown in SiteCargo, choose App Manager, and grant access to the app. For Organization, also enable Access to Certificates, Identifiers & Profiles. For Individual, certificate portal access is unavailable regardless of the invited user's role. Invitation details.

Do not share your Apple Account password or 2FA code. Admin does not replace Account Holder and cannot accept the owner's agreements or initial API access request.

3. Use the identifiers assigned by SiteCargo

You do not need to enter a Bundle ID in SiteCargo. The system assigns it to the app, and the team checks or changes it in the admin area. For an existing app, tell the team its previous Bundle ID before preparing files: updates must keep that ID.

With Individual selected, click “Upload required Individual files” in assisted mode, or open manual setup. The “Identifiers for Apple provisioning profiles” section shows two ready values. Click “Copy” beside the required value and paste it into Apple Developer when creating an App ID and profile. The main app and extension identifiers are shown separately; you do not need to add a suffix yourself. These are reference values, not fields to fill in. With Organization, SiteCargo prepares the identifiers and signing, so this section is hidden.

Details	Where to find them	Example
Apple Team ID	Detected from the verified .p12 in assisted mode; Membership details → Team ID for manual setup	A1B2C3D4E5
App Bundle ID	The ready value in “Identifiers for Apple provisioning profiles”	com.company.shop
Extension Bundle ID	The second ready value in the same section	com.company.shop.notification-service
App record Apple ID	App Store Connect → My Apps → app → App Information → Apple ID	1234567890

The app record Apple ID is a number. It is different from your Apple Account email, Bundle ID and Team ID. The extension adds images to push notifications and does not need a separate App Store Connect listing.

4. Organization: the shorter path

With “SiteCargo will set it up”, invite an Admin and save the invitation confirmation. SiteCargo enters Team ID and the listing Apple ID, creates upload authorization, prepares the certificate and both profiles, and creates or agrees to reuse an APNs key. The customer does not upload files. The owner requests initial API access and accepts agreements.

In manual mode, save Organization and Team ID, add the listing Apple ID, and choose an upload method from section 8. The owner or Admin prepares the APNs key in section 9. App Manager with Certificates, Identifiers & Profiles can prepare signing but cannot create an APNs key. SiteCargo handles the certificate and profiles using the granted access; these files do not need to be uploaded in the Organization form.

5. Individual: obtain a certificate with its private key

If you already have a certificate

On the Mac that created the certificate request, open Keychain Access → login → My Certificates. Find Apple Distribution: … and expand its arrow. A private key must appear underneath. Select the certificate with its nested key, right-click → Export, and choose Personal Information Exchange (.p12). Save the file and set an export password. The Mac may ask for your local keychain password to authorize export; that password is not entered in SiteCargo. Apple certificate export help.

If the private key is missing, downloading the .cer from the portal will not restore it. Find the original Mac, a previously exported .p12, or prepare a new certificate. Agree certificate capacity with SiteCargo before revoking or deleting credentials used by other apps.

If you need a new certificate

1. On a Mac, open Keychain Access → Certificate Assistant → Request a Certificate from a Certificate Authority.
2. Enter your email and a recognizable key name, leave the CA email blank, and save a .certSigningRequest to disk. Apple CSR instructions.
3. In Apple Developer, open Certificates, Identifiers & Profiles → Certificates → +. Choose Apple Distribution, upload the CSR, and download the .cer. Open it on the same Mac so it can pair with its private key. Apple certificate types.
4. In My Certificates, check that the private key appears underneath and export the .p12 as described above. Keep its export password.

In SiteCargo, select this file under Apple Distribution Certificate and enter its password under .p12 file password. This is the export password, not your main Apple Account password. Maximum .p12 size: 128 KB.

If you do not have a Mac, contact SiteCargo before starting. A trusted Mac or an agreed CSR prepared by the team can be used; the owner's Apple actions are still required. The customer does not need to compile the app.

6. Individual: register two identifiers

In Certificates, Identifiers & Profiles → Identifiers → + → App IDs → App, register an Explicit App ID: copy the App Bundle ID from the SiteCargo reference section and paste it into Apple's field. Enable Push Notifications and save. Repeat registration by copying the Notification extension Bundle ID from the same section. The extension does not need a separate push certificate; the main app profile must allow production push. Register an App ID.

If the main identifier already exists, open it and check the capability instead of creating a duplicate. Avoid a wildcard such as com.company.*. Agree any additional capabilities with SiteCargo.

7. Individual: download two App Store profiles

In Profiles → +, choose App Store Connect under Distribution (some interfaces call it App Store). Select the main App ID and the Distribution certificate exported in your .p12. Name the profile, for example Shop AppStore Main, then generate and download it. Apple provisioning profile help.

Repeat for the extension's App ID using the same certificate. For example, name it Shop AppStore Notification. You will have two .mobileprovision files, each up to 256 KB.

File	SiteCargo upload field
Profile for com.company.shop	“App Store profile for the main app”
Profile for com.company.shop.notification-service	“App Store profile for the notification extension”

Keep the files in their correct fields. Development and Ad Hoc profiles are unsuitable. If Push Notifications was enabled after generating a profile, recreate the main profile and upload the new version.

8. Authorize uploads to App Store Connect

SiteCargo handles this section in assisted mode. The customer requests initial API access if it is not already enabled. If a Team API Key is unavailable, our specialist can use an app-specific password for their own work Apple Account with app access; the customer does not need to create a password for their account. Follow the steps below for manual setup.

Create the app record

For a new app, open App Store Connect → My Apps → + → New App and enter iOS, name, primary language, the main Bundle ID and your SKU. Open App Information and copy the numeric Apple ID into SiteCargo. Reuse an existing record for updates. Apple app record instructions.

Preferred method: Team API Key

Open Users and Access → Integrations → App Store Connect API → Team Keys. If Request Access appears, the owner requests API access and waits for Apple's decision. Individual membership does not guarantee immediate access. Once enabled, an owner or Admin generates a Team Key with App Manager access. Save its .p8, Key ID and Issuer ID. API access conditions, API key creation.

In SiteCargo, select Team API Key, upload the file under App Store Connect Team API Key, and enter its Key ID and Issuer ID. Maximum size: 16 KB. This key authorizes uploads, not push. Team Key can apply to an Individual membership: Individual membership and a personal Individual API Key are different concepts. This SiteCargo workflow does not accept personal Individual API Keys without an Issuer ID.

A Team Key can access the team's apps within its role. SiteCargo still targets a specific app record and checks its Bundle ID before upload.

If a Team API Key is unavailable

Agree the alternative with SiteCargo. In account.apple.com, open Sign-In and Security → App-Specific Passwords and create a password with a label such as SiteCargo uploads. In the form, select App-specific password, enter the email of the Apple Account that created it, and enter the password in the format abcd-efgh-ijkl-mnop. Apple instructions.

This user must have access to the correct app. The password authorizes uploads; it does not create signing certificates or profiles. Keep your main Apple Account password and 2FA codes private. Changing the main Apple password can revoke app-specific passwords; save a replacement if uploads stop working.

9. Set up push with a separate APNs key

The owner or an Admin opens Apple Developer → Certificates, Identifiers & Profiles → Keys → +, gives the key a name such as SiteCargo Push, and enables Apple Push Notifications service (APNs). Complete registration, download its .p8 and record the Key ID. APNs authentication tokens, private key creation.

If Apple offers environment/topic settings, agree them with SiteCargo: production/TestFlight and the main Bundle ID must be allowed. Keep the previous working key active during setup.

Upload the file under APNs Authentication Key and enter its ID under APNs Key ID. Its Team ID must match the app's Team ID. Do not upload the App Store Connect Team API Key here, even though both files end in .p8.

SiteCargo validates the key format. A private .p8 alone cannot prove its service, Apple Team or actual delivery. The employee checks those details, configures push notifications and tests a notification on a device. Until setup is confirmed, the dashboard shows that a team check is needed.

10. Save and check the result

Click “Save and Check” at the bottom of the connection dialog. You can save in stages: missing files leave the setup incomplete; incorrect files show an error beside the field. A failed save does not replace the previous set. Files and passwords are stored encrypted and cannot be downloaded again from the customer form. SiteCargo uses the supplied files to sign your app and transfers them to its build service over a protected connection.

Status	What to do
Not added	Fill in the required details or upload the file
Details or a team check needed	Check the three stages at the top of the form, complete details and wait for the employee
Ready	Details are saved and signing/APNs are prepared; live API access is checked at upload time
Expired	Replace the expired certificate or profiles
Details do not match the app	Agree the Team ID, Bundle ID and owner, then save the correct set

Invitation status and signing readiness are separate. The invitation checkbox and Save and Check in assisted mode do not automatically confirm acceptance. The employee accepts the invitation and separately confirms signing and push notification setup for your app.

11. Updates and file replacement

While certificates/profiles remain valid, keys stay active, membership is current and capabilities do not change, SiteCargo can run repeated builds without the owner signing in to Apple. The customer requests an update and supplies release materials.

To update a profile only, upload its replacement in the matching field. To replace the certificate, upload the new .p12, its password and both profiles created with that certificate in one save. If old signing files have expired, replace all expired files in the same save. Blank file inputs preserve saved files. A blank password for a newly uploaded .p12 means the new file has no password.

Replacing an APNs key resets the push check: SiteCargo configures the new key and checks notifications again. Changing Team ID clears the previous signing files and keys. The SiteCargo team manages the Bundle ID and keeps it for updates to an existing app. If the team changes the ID before the first release, profiles for the new values are required: the previous files no longer match the app.

The owner continues accepting Apple agreements, renewing membership, completing account checks and helping renew Individual signing files. Revoked keys/certificates may stop working before their displayed expiration date; tell SiteCargo about changes.

If something goes wrong

Message	Solution
Cannot open .p12	Check the export password and file format
Private key missing	Export on the original Mac with the matching nested private key
Team mismatch	Check the selected Apple team and that the files belong to it
Bundle mismatch	Recreate the profile for the correct Explicit App ID
Different certificate	Use the same Distribution certificate for both profiles
Production push missing	Enable Push Notifications on the main App ID and recreate the profile
API cannot access the app	Check the numeric Apple ID, Team Key, Issuer ID and role; the employee checks the upload
Team Keys unavailable / access pending	Agree an app-specific password and continue signing setup

For support, provide the app, affected field, error text and time. Upload secret files through the Apple form; do not include them or password screenshots in support messages.