# `mix mob.provision`
[🔗](https://github.com/genericjam/mob_dev/blob/master/lib/mix/tasks/mob.provision.ex#L1)

Registers your app's bundle ID with Apple and downloads an iOS
provisioning profile.

Two modes:

    mix mob.provision                 # development profile (default)
    mix mob.provision --distribution  # App Store distribution profile

Run development provisioning once before your first `mix mob.deploy --native`.
Run distribution provisioning once before your first `mix mob.release`.

## What you need first

  1. **Apple ID** — free at https://appleid.apple.com
  2. **Xcode signed in** with that Apple ID:
     open Xcode → Settings → Accounts → [+] → Apple ID
  3. **Apple Developer Program** — optional for personal device development,
     required for App Store distribution ($99/year).
     Free accounts can deploy to their own devices; profiles expire every
     7 days. Paid accounts get 1-year profiles and App Store access.
     Enroll at https://developer.apple.com/programs/enroll/

Distribution mode requires a paid Developer Program membership.

## Headless / unattended provisioning (App Store Connect API key)

Step 2 (an interactive Xcode Apple ID account) is impossible for an unattended
user — a CI runner or a headless agent account with no GUI login. Instead,
authenticate `-allowProvisioningUpdates` with an **App Store Connect API key**
by setting three env vars; when they are present the task passes them to
`xcodebuild` and no signed-in Xcode account is needed:

  * `APP_STORE_CONNECT_KEY_ID` — the API key's Key ID
  * `APP_STORE_CONNECT_ISSUER_ID` — your team's Issuer ID
  * `APP_STORE_CONNECT_API_KEY_PATH` — path to the downloaded `AuthKey_<id>.p8`

Create the key at App Store Connect → Users and Access → Integrations → App
Store Connect API, with a role that can manage certificates/profiles/devices
(Admin or App Manager). The `.p8` downloads once — store it read-only. Set all
three or none (a partial set raises); with none set, the signed-in Xcode
account is used as before. Signing still needs the certificate + private key in
an unlocked keychain — the API key only authorizes the profile/device calls.

## What it does (development)

  1. Reads your signing team from the macOS keychain or existing profiles
  2. Generates `ios/Provision.xcodeproj` — a minimal Xcode project used
     only for provisioning (safe to commit)
  3. Generates `ios/MobProvision.swift` — a two-line SwiftUI stub
  4. Runs `xcodebuild -allowProvisioningUpdates build` which contacts
     Apple to:
     - Register your bundle ID in your developer account (if not registered)
     - Create a development provisioning profile
     - Download it to ~/Library/Developer/Xcode/.../Provisioning Profiles/
  5. Verifies the profile is present

## What it does (distribution)

Same as above, but runs `xcodebuild archive -allowProvisioningUpdates`
with `CODE_SIGN_STYLE=Automatic` against the Release configuration.
Apple creates an App Store provisioning profile (and an Apple
Distribution certificate, if missing) and downloads them to your
keychain + provisioning profile directory.

---

*Consult [api-reference.md](api-reference.md) for complete listing*