DEV Community: iPhoneTechie

Upload IPA to App Store Without Xcode on Windows/Linux/Mac: upload Command Explained

iPhoneTechie — Thu, 24 Sep 2026 10:12:02 +0000

Got a built and signed IPA? One command hands it to Apple—no Mac and no Xcode required:

appuploader-cli upload -f Payload.ipa -u dev@example.com -p abcd-efgh-ijkl-mnop

appuploader-cli is the command-line tool bundled with AppUploader. The upload command submits a signed .ipa (iOS) or .pkg (macOS) to App Store Connect—the same thing as clicking "Submit to App Store" in the GUI, except it can be written into scripts.

Below, let's go through how to use this command: how to choose between the two login methods, how to upload non-iOS packages, how to tell whether it actually succeeded, and in what order to troubleshoot when uploads fail.

Find the Command

After installing AppUploader, the command-line tool is already installed with it:

OS	Location
Windows	`appuploader-cli.exe` in the same directory as the main program `AppUploader.exe`
macOS	`AppUploader.app/Contents/Resources/appuploader-cli`
Linux	`appuploader-cli` in the same directory as the main program `AppUploader`

Open a terminal in this directory and you can use it. To run it from any directory, add it to PATH: on Windows, go to Settings → System → About → Advanced system settings → Environment Variables → Path; after adding it, reopen the terminal for it to take effect. On macOS/Linux, add a line export PATH="$PATH:/your/install/directory" to ~/.zshrc or ~/.bashrc.

Also prepare a package that has already been signed—upload does not compile or sign; its input is the built .ipa or .pkg.

Login Method 1: App-Specific Password

The easiest credential for command-line uploads is an App-Specific Password. Apple designed it specifically for third-party tools, and it does not trigger two-factor authentication—you don't have to confirm on your phone every time you upload, which is essential for scripts and unattended build machines.

Go to https://account.apple.com/account/manage and sign in, find "App-Specific Passwords", create one, and you'll get a password like abcd-efgh-ijkl-mnop. It is shown only once, so save it immediately.

Then:

appuploader-cli upload -f Payload.ipa -u dev@example.com -p abcd-efgh-ijkl-mnop

-u is the Apple ID email, -p is the newly generated app-specific password; both must be provided together. Specify the package path with -f, or omit -f and put it directly at the end of the command:

appuploader-cli upload -u dev@example.com -p abcd-efgh-ijkl-mnop Payload.ipa

The most common mistake is putting your Apple ID login password in -p. An app-specific password is always 16 letters with three hyphens in the middle, completely different from a login password. Check it before entering it.

Login Method 2: App Store Connect API Key

If this command will run on a team build machine or pipeline, using someone's Apple ID is not ideal—when that person leaves or changes their password, the whole automation breaks. In this case, use an App Store Connect API key instead: it belongs to the team rather than an individual, can be revoked separately, and also does not involve two-factor authentication.

Go to https://appstoreconnect.apple.com/access/api to generate one (requires Account Holder or Admin permission). You need three things: the Key ID, the Issuer ID at the top of the page, and the .p8 private key file. The .p8 can only be downloaded once; Apple will not give it a second time. Store it immediately in a password manager or your CI's secret store.

appuploader-cli upload -f Payload.ipa \
  --api-key UK29KBAX9X \
  --api-issuer 69a6de78-4459-47e3-e053-5b8c7c11a4d1 \
  --private-key Auth.Key_UK29KBAX9X.p8

All three parameters are required. The two login methods are mutually exclusive; mixing -u -p with these three parameters will be rejected outright—when switching from password to key, remember to remove the original -u -p completely.

Before using the key method, confirm two things:

It can only upload .ipa. This method relies on the Bundle ID in the package to find the corresponding app on App Store Connect; it cannot be obtained from a .pkg. For macOS .pkg, use the app-specific password method above.
This Bundle ID must already have an app created in App Store Connect. If it hasn't been created, you'll get an error saying the corresponding app cannot be found. Create it first, then upload.

Which One to Choose

In one sentence: for manual releases by yourself, use an App-Specific Password; for multi-person collaboration or pipelines, use an API key.

The app-specific password wins on simplicity—two parameters and it runs; but it is tied to an individual Apple ID, so handing it to a pipeline means handing over personal credentials. The API key takes a few more configuration steps, but in exchange it is decoupled from a person, can be revoked separately, and if something goes wrong you only need to rotate that one key.

Uploading Non-iOS Packages

By default it is treated as iOS; for other platforms, add --type:

# macOS
appuploader-cli upload -u dev@example.com -p abcd-efgh-ijkl-mnop --type osx App.pkg

# tvOS
appuploader-cli upload -f App.ipa -u dev@example.com -p abcd-efgh-ijkl-mnop --type appletvos

There are four values in total: ios (default), osx, appletvos, xros (visionOS).

How to Tell Whether the Upload Actually Succeeded

After pressing Enter, progress will print line by line in real time; the larger the package, the longer it takes. Look at the last line:

> upload finished successfully

On failure:

> upload finished with error: <specific reason from Apple>

If you're writing a script, do not grep these logs—when the command fails, the exit code is non-zero; checking the exit code is enough, and it won't break when the log wording changes:

set -e
appuploader-cli upload -f build/App.ipa -u "$APPLE_ID" -p "$APP_PASSWORD"

In Windows PowerShell:

& appuploader-cli.exe upload -f .\build\App.ipa -u $env:APPLE_ID -p $env:APP_PASSWORD
if ($LASTEXITCODE -ne 0) { throw "Upload failed" }

One more thing that's easy to misunderstand: a successful command return only means Apple accepted the package and it passed initial validation. Apple still processes it for a few minutes to a few tens of minutes; only after processing does it appear in the "Builds" list in App Store Connect, and only then can you select it for review. Not seeing it immediately after upload is normal.

If Upload Fails, Troubleshoot in This Order

Category 1: The command exits before it even runs. These problems are local; you can verify immediately after fixing them.

file not found: the path is wrong. In CI, the most common cause is that the current working directory is not what you think it is; use absolute paths in scripts whenever possible.
Error saying the two login methods cannot be mixed: keep only one set of -u/-p or --api-key/--api-issuer/--private-key.
not a valid PEM file or expected PKCS8: --private-key does not point to the .p8 Apple gave you, or the file content is corrupted. In CI, the most common cause is losing line breaks when storing the .p8 in a Secret; copy the original file completely again and re-save it.
the ipa has no CFBundleIdentifier: you used the key method to upload a non-IPA package; switch back to the app-specific password method.

Category 2: The package uploaded, but Apple rejected it. These reasons are all written after upload finished with error:. Common ones:

Duplicate version/build number: the same CFBundleShortVersionString + CFBundleVersion combination has already been uploaded. Apple does not allow overwriting; change the build number and repackage.
Signing mismatch: the certificate or provisioning profile used by the package is not for App Store distribution. Check whether you selected an App Store type provisioning profile when packaging.
Missing Info.plist fields: common ones include missing icons, missing required usage descriptions (NSxxxUsageDescription for camera, photos, location, etc.), or missing certain device capability declarations. Add them according to the error and repackage.
Corresponding app not found: this Bundle ID has not had an app created in App Store Connect yet.

After this command is configured, you basically don't need to touch it again; just run it once when releasing or let CI run it. The same tool can also sign certificates, create Bundle IDs, and generate provisioning profiles on Windows; that's how I bypassed a Mac for the entire iOS release pipeline.

What Is an IDE? Integrated Development Environments Explained and an iOS Development Selection Guide

iPhoneTechie — Tue, 22 Sep 2026 10:13:24 +0000

Every developer has probably been asked this question: what is an IDE, and why don't you just write code in Notepad? It's actually not an easy question to answer—there's a lot behind those three letters. When I was starting out, it took me a while to figure out what an integrated development environment really "integrates," and why iOS development defaults to Xcode while some people choose something else. This article breaks down what makes up an IDE, then applies that to choosing one for iOS development.

What Does an IDE Actually Integrate?

IDE stands for Integrated Development Environment, and the key word is "integrated." It packs everything involved in writing code into a single program: the editor handles writing code, the compiler or build tools handle turning code into a runnable program, the debugger handles breakpoint-based troubleshooting, and project management handles organizing files, dependencies, and configuration. With all four integrated together, you don't need to switch back and forth between Notepad, the command line, and a debugger—writing, compiling, debugging, and running all happen in one window.

Integration and Assembly Are Two Different Approaches

The other approach is to take these tools apart and assemble them yourself: VS Code as the editor, command-line tools for compiling, the matching debugger for debugging, and plugins to string the workflow together. This approach is flexible and lightweight, and many experienced developers prefer it—but it's unfriendly to beginners: you have to install and configure every piece yourself, and when something breaks you don't know which link in the chain is at fault. The value of an IDE is that this chain comes pre-integrated—install it and it runs—leaving your attention for the code itself.

The Home-Field IDE for Each Platform

Each platform's ecosystem has its own home-field IDE: Visual Studio for C#, IntelliJ IDEA for Java, PyCharm for Python, and Xcode for iOS development. These IDEs are tightly bound to their languages and platforms, with compilers, debuggers, and release workflows all matched up, which makes them the smoothest to use. But tight binding also means less flexibility when the scenario changes: with Xcode, for example, you must be on a Mac and must keep up with its major version updates, and the experience is pretty poor when your disk space or network conditions are not ideal.

How to Choose an IDE for iOS Development

When it comes to choosing for iOS development, Xcode is the official default, offering compiling, the simulator, and App Store submission as one integrated chain, with its large footprint and frequent updates being the sticking points. If you don't want to be tied down by Xcode's environment requirements, KXApp is another option: it is likewise a complete integrated development environment—a built-in compilation toolchain lets you compile iOS apps without installing or updating Xcode, with support for Swift, Objective-C, and Flutter projects; a built-in real-device debugging engine builds and installs to a real device in one click after you connect an iPhone, with code changes synced instantly; and when development is done, one click generates an installation package, covering test distribution and App Store submission scenarios.

KXApp is built on the VS Code core, so the editing experience and plugin ecosystem are the same as VS Code—plugins like AI coding assistants work out of the box, and intelligent suggestions and a well-structured project layout come built in. For a new team, the more an IDE ships with, the lower the onboarding cost.

What Criteria to Use

Choosing an IDE comes down to three things: platform—what OS you develop on; ecosystem—whether there's a matching IDE for your team's tech stack; and workflow—whether the compile and release steps can form a closed loop inside the tool. An IDE's "integration" is essentially about saving you the effort of assembling a toolchain; picking one that closes the loop matters more than chasing a long feature list.

Back to the question we started with: an IDE is a development environment that integrates editing, compiling, debugging, and management, and the only differences lie in how deep the integration goes and how tightly it's bound to a platform. Once you understand what it integrates, you won't be led astray by questions like "which IDE is the best."

Private Protocol All Garbled in Packet Capture? TraceEagle Custom Protocol Decoding Tutorial

iPhoneTechie — Mon, 21 Sep 2026 09:53:47 +0000

Custom Protocol Decoding

Captured a private / in-house socket protocol, and none of the built-in formats recognize it—data view shows only a pile of bytes? This article teaches you to write a small script that tells the tool how to read it—split a contiguous byte stream into individual messages, strip protocol headers, decompress when needed, and let the tool automatically recognize the rest as structured data. Saving changes takes effect instantly; no need to recapture. The same connection is immediately re-decoded with the new rules.

1. When to Use It

First try switching views and using auto-detection as described in Data Viewing and Decoding. If a connection is still garbled and no built-in format fits, it is likely running a proprietary / private protocol—that's when a custom decoder comes in. Typical signs:

What you captured is a long-lived socket connection, not standard HTTP; both directions are binary bytes.
A common form is length prefix + protobuf / JSON / binary, or it is wrapped in a custom header and compressed once.
You know the format of these bytes (your own protocol, documented, or reverse-engineered), and just need to write the rules for the tool.

If only a standard format was not recognized, you do not need to write a script; first go back to Data Viewing and Decoding and try auto-detection.

2. Prerequisites

TraceEagle is installed and started, and you have captured the target traffic as in previous articles (this private connection is already in the request / connection list).
You know how this protocol frames messages: where a message starts, where the length is written, how many header bytes there are, and whether decompression is needed.
You know a little basic JavaScript syntax (being able to write if, read integers, and slice bytes is enough; you do not need to be an expert).
Decoding is performed on already captured data, and you can re-decode as many times as needed—no need to worry that a mistake requires recapturing.

3. Step-by-Step Operations

1. Open Custom Codecs

Open the Custom Codecs editor (the decoder management entry). Here you can create, name, and save a list of decoders, and add, modify, or delete them at any time.

2. Create a Decoder

Click New and give it a name (for example, 'In-house Push Protocol'). A decoder is just a function decode(buf, out)—if you do not want to start from a blank page, click Insert Template and choose the skeleton closest to your protocol; changing a few numbers is enough to run it.

3. Write the Parsing Script

The mental model of decode is simple: the tool feeds you the bytes of this connection and repeatedly asks, 'Starting here, can you cut out one complete message?'—you cut out one and tell it how many bytes were consumed, then it asks again with the remaining bytes until nothing is left.

function decode(buf, out) {
  //Buf: The current remaining byte stream to be parsed; Out: Output collector; Return: The number of bytes consumed this time
}

Remembering three conventions is enough:

buf is the remaining byte stream. Use buf.byteLength to see how much is left. It is the raw buffer, and you cannot directly use buf[0] to get a byte—use the helper functions below, or wrap it yourself with new DataView(buf) / new Uint8Array(buf).
out.push(...) pushes out one message; you can push multiple at a time. What you push is a byte segment or string returned by a helper function.
return the number of consumed bytes: > 0 means one message was cut out and that many bytes were consumed from the beginning; the tool calls you again with the rest. Returning 0 (or not writing return) means 'not enough for a complete message yet'; the tool stops and displays the remaining bytes as-is. If you pushed, you must pair it with a corresponding return, otherwise this push will be discarded.

You do not need to worry about direction: the tool runs your script once each for the send stream and receive stream, and automatically labels the direction of each message cut out. You only handle 'how to cut.'

Helpers directly available in the script (so you do not have to reinvent the wheel):

What you want to do	How to write it
Slice a subsegment	`sub(buf, off)` / `sub(buf, off, len)` → returns a byte segment
Read integers (big-endian / little-endian, unsigned)	`u8(buf, off)`、`u16be` / `u16le`、`u32be` / `u32le` `(buf, off)`
Convert to text	`hex(buf)` (hexadecimal), `ascii(buf)` (read as text)
Detect / decompress	`gzipMagic(buf)`; `gunzip` / `inflate` / `unzstd` / `lz4dtx` `(buf)` (returned as-is if it cannot be decompressed)
Debug print	`log(...)` / `console.log(...)` → prints to the 'Debug Output' panel

Standard JavaScript (ArrayBuffer, Uint8Array, DataView, JSON, Math, RegExp, etc.) is also available. To read bytes as text, use ascii(buf) (the sandbox does not have browser-only capabilities such as TextDecoder / fetch / setTimeout).

Here are a few of the most common patterns; just change the numbers:

① Length prefix [4-byte big-endian length][payload]—the most typical private protocol:

function decode(buf, out) {
  if (buf.byteLength < 4) return 0     
  const total = 4 + u32be(buf, 0)        
  if (buf.byteLength < total) return 0 
  out.push(sub(buf, 4, total - 4))      
  return total                           
}

② Frame by newline / delimiter:

function decode(buf, out) {
  const i = ascii(buf).indexOf('\\n')
  if (i < 0) return 0                 
  out.push(sub(buf, 0, i))              
  return i + 1                           
}

③ Process the whole thing at once (for example, decompress the entire packet):

function decode(buf, out) {
  out.push(gzipMagic(buf) ? gunzip(buf) : buf) 
  return buf.byteLength                          
}

④ Dispatch by type field (the header carries a type, and different types are handled differently):

function decode(buf, out) {
  if (buf.byteLength < 4) return 0
  const total = 4 + u32be(buf, 0)
  if (buf.byteLength < total) return 0
  const type = u8(buf, 4)                     
  const body = sub(buf, 5, total - 5)
  out.push(type === 2 ? gunzip(body) : body)   
  return total
}

If you need to remember state across multiple calls (counters, the previous message type, etc.), put the variables in the outer scope of decode—they are preserved across multiple calls for the same stream and automatically reset when the direction changes or decoding restarts.

4. Save; It Takes Effect Immediately

Click Save. The script takes effect immediately; no restart and no recapture are needed. Do not be afraid of breaking it: if the script throws an error or times out, it only means 'this time it did not decode, and you see the raw bytes'; it will not interrupt packet capture, let alone lose data. Feel free to modify it boldly.

5. Apply to Matching Traffic

Go back to the request / connection list, right-click the connection you cannot understand → 'Decode As' → choose the decoder you just wrote. The send and receive of the whole connection will immediately be split and displayed according to your rules.

4. Verification: Garbled Bytes Become Structure

After choosing 'Decode As', look at the result area:

The originally contiguous byte stream is now split into individual messages, each labeled as coming from send ↑ or receive ↓.
The payload you pushed after stripping headers / decompressing will be automatically recognized again by the tool—if it contains protobuf / JSON / plist, it will be further decoded into a structured view; use the multi-view comparison in Data Viewing and Decoding to inspect it.
Tail bytes that were not cut out (for example, the last incomplete half-message) will not be lost; they remain at the end as raw data.

If it is not split correctly the first time, modify the script, save, and click 'Decode As' again; the same connection is immediately re-decoded with the new rules—iterate until satisfied.

5. Troubleshooting / Tips

Symptom	Likely cause	What to do
After clicking 'Decode As', it is still raw bytes	`decode` returned `0` throughout (no message was cut out), or it threw an exception	Look at the 'Debug Output' panel above the result: errors and timeouts are shown there, marked with `↑` / `↓`; fix accordingly
A pushed message is not displayed	After push, it returned `0`, so this push was discarded	'Push one message' must be paired with 'return how many bytes it occupied' (`return > 0`)
`buf[0]` gives `undefined`	`buf` is a raw byte buffer; you cannot get a byte by index	Use helpers such as `u8(buf, 0)`, or wrap it with `new Uint8Array(buf)` / `new DataView(buf)`
Want to inspect variables while writing	——	In `decode`, print any value with `log(buf.byteLength)` or `log(hex(sub(buf, 0, 8)))`; output goes to the 'Debug Output' panel, much faster than guessing
Messages are split too much / too little	Length calculation is wrong (header length omitted, endianness read backwards)	Verify whether `total` includes the header length; use `u32be` for big-endian and `u32le` for little-endian; do not read them backwards
Still garbled after decompression	Wrong decompression algorithm	Use `gunzip` for gzip, `inflate` for zlib/deflate, `unzstd` for zstd, and `lz4dtx` for block LZ4; if it cannot be decompressed, it is returned as-is; use `gzipMagic` to detect first
Script changes have no effect	Not saved, or 'Decode As' was not run again	After saving, click 'Decode As' again; decoding reruns on captured data and can be repeated indefinitely

Next Steps

How to read and switch views after it is split into structures: see Data Viewing and Decoding
Have not captured this traffic yet: socket / private protocols often need to be taken from inside the program or at the NIC layer; see Application-Layer Packet Capture and NIC Packet Capture.
Want to compare two messages field by field: see Request Comparison.
Want to modify fields and resend after decoding the structure: see Request Construction and Replay.

Managing Multiple Apple Developer Accounts: A One-Click Switching Solution

iPhoneTechie — Sun, 20 Sep 2026 12:21:03 +0000

Have Several Apple Developer Accounts — How Do You Manage Them All in One Place?

AppUploader natively supports multi-account management: once you add all your Apple IDs, they are kept in the "Saved Accounts" list. From then on, just click "Enter" on an account to switch to it — no need to re-enter the password or go through the login flow again.

Who it's for

Indie developers who maintain multiple apps of their own, each under a different Apple ID.
Outsourcing teams or agencies that need to switch back and forth between several clients' Apple Developer accounts.
Scenarios where a single Apple ID belongs to multiple developer teams at once and you need to switch team context per project.

How to use it

Click "Add Account", choose a sign-in method for each Apple ID (password / API key), and save it after signing in once.
To switch accounts, use the "Switch Account" entry at the top, or simply click another account in the account list to enter it.
When the same Apple ID belongs to multiple teams, after signing in, click "Activate" in the "Teams" section of the "Account Overview" to switch the team you are currently operating in. Certificates, Bundle IDs, provisioning profiles, devices, and apps all reload based on the newly activated team.
When you no longer need an account, "Remove Account" also clears the credentials saved in the browser and the local session/key files. If deleting the local files fails, you can choose "Remove browser records only" to keep the local files.

Want to share one account across multiple computers with no password and no two-factor verification?

If the same App Store Connect account needs to be used on multiple computers or by multiple team members, signing in with an App Store Connect API key is recommended — generate the key file (.json) once and import it, and you can sign in on any device with no password and without triggering two-factor authentication.

Essential iOS Development Tools: Which IDEs, Debugging and Testing Software Can You Use to Boost Efficiency

iPhoneTechie — Wed, 16 Sep 2026 10:17:34 +0000

I've noticed a pattern: the same feature takes one team a day and another team two or three days to finish. The difference isn't capability — it's the toolchain setup. iOS development has many stages, and picking the right tool at each one saves a lot of time. Here's a list of essential tools for boosting iOS development efficiency, organized by development stage, with each stage explaining which tool to use and what efficiency pain point it solves.

IDE and Coding Environment

The coding environment determines your daily development speed. Xcode is the primary IDE, with unbeatable smart completion and debugger integration, but its installer is huge and startup is slow — a bit heavy when you're writing Flutter or small projects, and by the time it finishes loading you may have lost the mood to write code. Lightweight IDEs like KXApp ship with a built-in compilation toolchain, so you don't need Xcode installed; its VS Code-based UI starts fast, AI completion works out of the box, and creating a project generates the structure in one click. On-device debugging is also easy: connect an iPhone, hit build, and it installs to the phone without configuring certificates. Use a lightweight tool for day-to-day code edits and quick verification, and open Xcode for deep native development — pairing the two is more efficient.

Code Generation and Reuse

During integration you often need to turn captured requests into code and paste it into your project. With a capture tool's generate-code feature, a single request converts directly to cURL, Python, JavaScript, Go, or OkHttp, with header order and duplicates preserved exactly, so the result runs identically to the real request. This saves the time spent hand-copying URLs, parameters, and headers, and reduces transcription errors. When debugging signed APIs, dynamic values can compute timestamps and HMAC signatures on the fly, so you don't have to calculate them by hand and fill them in every time.

Debugging and Traffic Capture

API integration and troubleshooting are inseparable from traffic capture. Charles and Fiddler are the traditional choices, but configuring proxies and certificates takes time, and apps using certificate pinning (SSL Pinning) are tricky — even with the certificate installed you can't decrypt the traffic. A new generation of capture tools supports bypassing certificate pinning, extracting plaintext in-app, and automatic decryption; direct capture from the network interface also grabs traffic that doesn't go through a proxy, so even tough cases can be handled. Once captured, you can rewrite and replay requests and diff them line by line, which speeds up troubleshooting considerably.

Performance and Monitoring

Diagnosing performance problems by feel is slow. Instruments gives accurate deep analysis but takes time to configure each run; for day-to-day development you can use a tool like KeyMob to watch CPU, memory, and FPS curves in real time, and glance at whether anything fluctuates abnormally after a code change. Crash logs, live logs, and device information are handled in a single tool, so you don't have to switch between multiple windows. Once you spot a problem, you can jump straight to the code, saving a lot of back-and-forth.

Automation and Release

For releases, use fastlane with CI to package, sign, and upload in one step — a single command per release. Use Appuploader to upload screenshots and metadata in bulk: select multiple images at once and they're categorized automatically, eliminating repetitive one-by-one uploads. Certificates and provisioning profiles can also be generated directly on Windows, so you don't have to sit at a Mac. These automation tools hand repetitive work to scripts, letting the team spend time where humans are actually needed.

How to Combine Them

The core idea of this list is: pick one handy tool per stage and combine them into your own workflow. It's not about having many tools — the handiest one matters most. Get it working first, then optimize.

appuploader-cli CI/CD Auto IPA Upload Tutorial: the upload and info Commands

iPhoneTechie — Tue, 15 Sep 2026 09:52:58 +0000

If your build pipeline runs on machines without a Mac (for example, a Windows/Linux CI runner), or you simply want to turn the IPA upload step from "manually clicking a button" into "a single command", appuploader-cli was built for exactly this scenario: it is the command-line tool distributed alongside the main program of AppUploader, functionally equivalent to the "Submit to App Store" button on the web version's "Files & Submission" page, but it depends on neither Xcode nor macOS.

Prerequisites

The Apple ID used with the upload / info commands must first be authorized on appuploader.net (i.e., the AppUploader license). If it is not authorized or the license has expired, you will get a license failed / license expired message. You can view and activate the license status in "Account Overview".

Step 1: Locate the executable

appuploader-cli is packaged together with the main program and lives in the runtime/ directory under the installation directory:

macOS: runtime/darwin/appuploader-cli
Windows: runtime/windows/appuploader-cli.exe

Just enter that directory to run it directly, or add the directory to the CI runner's PATH environment variable so you can call it directly from scripts.

There is also an appuploader-adi in the same directory; it serves a different purpose (internal use). Do not confuse it with appuploader-cli.

Step 2: Upload the IPA/PKG

appuploader upload -f <path to IPA/PKG> -u <Apple ID> -p <app-specific password> [--type ios]

Parameter	Description
`-f, --file`	Path to the IPA / PKG file to upload (required)
`-u, --username`	Apple ID email (required)
`-p, --password`	App-specific password, in the format `xxxx-xxxx-xxxx-xxxx` (required, not the login password)
`--type`	Package type: `ios` / `osx` / `appletvos` / `xros`, defaults to `ios`

Example:

appuploader upload -f Payload.ipa -u dev@example.com -p abcd-efgh-ijkl-mnop

The upload process prints progress and result logs in real time. On failure, the log carries the specific reason (such as a duplicate package, a version number conflict, or a signature mismatch), making it easy to pinpoint the problem directly in the CI logs.

Step 3 (optional): Generate the App Store resource description file locally

If you only want to validate the package contents locally before uploading, or you need an AppStoreInfo.plist for another upload tool, use the info command. It only performs local analysis and does not actually upload:

appuploader info -u <Apple ID> <file path> [-o output file] [--format xml|binary]

The --deterministic parameter fixes fields that would otherwise change, such as the UUID, process ID, and timestamp, making it easy to compare output byte by byte in CI and well suited to writing automated tests.

How to integrate into a CI/CD pipeline

Whether you use Jenkins, GitHub Actions, or any other CI system, the integration is the same: after the build produces the IPA, add a step that runs the appuploader upload command, and inject the Apple ID and app-specific password through the pipeline's secret/environment-variable mechanism instead of hard-coding them in the script. Because appuploader-cli itself does not depend on macOS, your CI runner does not need to be a Mac either.

Quick troubleshooting

license failed / license expired: The Apple ID in use has not been authorized on appuploader.net, or the license has expired. Go to "Account Overview" to activate or renew it.
Wrong app-specific password: -p expects the xxxx-xxxx-xxxx-xxxx app-specific password generated by Apple, not the Apple ID login password.
Prefer a graphical interface: upload corresponds to the "Submit to App Store" button on the web version's "Files & Submission" page; the info command is currently available only from the command line.

Go to https://appuploader.net to get appuploader-cli and integrate IPA upload into your automation pipeline.

Top 5 iOS Development Tools: Xcode, KXApp, VS Code, and More

iPhoneTechie — Mon, 14 Sep 2026 10:33:52 +0000

A while back a friend asked me whether just installing Xcode was enough when first getting started with iOS development. My answer was that Xcode is indeed the foundation, but once you're working on real projects, keeping a few tools for different scenarios from this iOS development tool recommendation list on hand makes things go far more smoothly. Using the right tool at each stage is more efficient. Here I've listed 5 tools commonly used in iOS development, along with what each one does and which scenarios it suits.

Xcode

Apple's official IDE, covering the entire workflow of coding, debugging, performance analysis, and packaging for release. Its strength is a high degree of integration: Instruments for performance analysis, Organizer for crash logs, and Interface Builder for UI layout are all in the same toolset. It suits pure native Swift or OC development, and teams that need Instruments for deep debugging. The downside is that the installer is over a dozen GB, every major version update requires a fresh download, and it demands a relatively powerful machine—on cross-platform projects many features go unused while still taking up disk space.

KXApp

A lightweight iOS development IDE tool with a built-in compilation toolchain, so you don't need to install Xcode and Command Line Tools separately. When creating a project, choose Swift, OC, or Flutter, and a standardized structure is generated in one click. Based on a VS Code-style coding interface, it offers intelligent completion and an AI code assistant out of the box, making coding convenient. It also supports switching between multiple project types. On-device debugging saves a lot of steps—after connecting the iPhone to the computer, just click build and install, and the tool compiles, signs, and installs directly onto the phone, with no need to configure certificates and provisioning profiles. It suits beginners just starting out in iOS development, those working on cross-platform projects (Flutter/uni-app), or developers who don't want to be weighed down by Xcode's large package. It runs on both Windows and Mac.

VS Code + Extensions

VS Code itself is not an iOS-specific IDE, but with the Swift and Flutter extensions installed it can handle code editing and debugging for iOS projects. Its advantages are being lightweight, starting fast, and having a rich extension ecosystem. It suits writing Flutter/Dart code, or scenarios where you're already using VS Code for other languages and don't want to install another large IDE. The downside is that it can't independently handle iOS packaging and signing; it needs to work with Xcode or KXApp to build and run on a real device.

fastlane

An automated release tool that completes the entire process of packaging, signing, and uploading to the App Store or TestFlight with a single command. Once integrated into CI, it runs automatically on every code commit, eliminating repetitive manual work. It suits projects with frequent releases and team collaboration, especially when paired with Jenkins or GitHub Actions for automated pipelines. There is a certain learning curve: you need to configure Fastfile and Appfile, and since it depends on xcrun under the hood, the CI node must be a Mac environment.

TestFlight

Apple's official beta testing distribution platform, deeply integrated with App Store Connect. After uploading, it generates a test link, and external testers can number up to 10,000. Each new version automatically notifies testers to update. It suits small-scale validation before release and collecting feedback from real users. Internal testing invites up to 100 people, and external testers up to 10,000. However, it doesn't provide performance monitoring or crash analysis—that requires other tools to fill the gap.

The 5 tools in the above iOS development recommendation list each handle their own area: Xcode for primary development, KXApp for lightweight coding and on-device debugging, VS Code with extensions for cross-platform editing, fastlane for automation, and TestFlight for distribution. Just combine them according to your project type and workflow—you don't need a single solution to cover everything. Having a few extra options lets you switch between them for higher efficiency in different scenarios.

How to Configure iOS Push Notifications: APNs Push Certificates, Device Library, and Bulk Sending

iPhoneTechie — Fri, 11 Sep 2026 10:06:20 +0000

Push

Configure an APNs push certificate and create a push channel to get an App Key for your app to report device tokens. It supports device library management, per-channel bulk messaging, and reviewing the result and history of every push. This is a marketing push platform independent of App Store Connect, with four tabs: Push Channels, Device Library, Send, and History.

Push Channels

Open appuploader and bind an already-issued APNs push certificate to get an App Key for your app to report device tokens:

Click "New Channel".
Select a push certificate (if the list is empty, first issue an APNs push certificate on the "Certificates" page).
Enter the export password of the certificate's .p12 — if the certificate has a cloud backup, entering the password retrieves the private key; when only the local .p12 file is kept, the password is required as well.
Fill in the channel name (e.g. "Marketing Push") and select the environment (Production / Sandbox).
After submitting, the channel is created; under "Integration Code" you can view the integration instructions for developers.

Note when deleting a channel: the device library and send history under that channel are deleted together with it, and the App Key is invalidated immediately. This operation cannot be undone.

Device Library

Manage reported device tokens:

Search by note / token / tag.
You can "manually add" a device — fill in the device token (spaces or angle brackets are supported and cleaned up automatically), a note, and tags.
You can edit a device's tags (separate multiple tags with commas), or remove the device from the device library.
The list shows status (active/inactive) and the most recent report time.

Send

Open appuploader, select a channel, and you can compose a notification:

Fill in the title, body, sound (default alert / silent), and badge number; or switch to "Advanced Mode" to edit the raw JSON payload directly.
Choose the send target: all devices / by tag / specific devices.
The system tells you how many active devices the message will be sent to; click "Send Now" once you have confirmed it.
When sending finishes, the number of successful/failed devices is displayed.

History & Delivery Reports

The "History" tab records the time, content, target, and result (success/failure counts) of each send. Click "Details" to view the per-device delivery report (success/failure/delivered and the failure reason), and you can also "resend" a history entry.

Device Integration Instructions

"Device Integration Instructions" provides the reporting endpoint URL and iOS sample code: developers need to add Push Notifications in Xcode's Signing & Capabilities and put the sample method in the AppDelegate, so that after the app obtains the APNs token it calls the reporting endpoint and the device automatically enters the "Device Library". For testing, you can select the LAN address where the phone resides, making sure the phone and the local machine are on the same Wi-Fi.

TraceEagle Application-Layer Capture Tutorial: Plaintext Can Be Pulled Straight from Inside a Running Program

iPhoneTechie — Thu, 10 Sep 2026 10:04:57 +0000

Application-Layer Capture

This guide shows you how to use Application-Layer Capture to capture an already-running program — reading plaintext straight from its internals. It doesn't matter if it uses certificate pinning, refuses to acknowledge proxies at all, or relies on home-grown encryption: with no certificates installed, no proxy configured, and no NIC sniffing, none of those defenses work against it, and you still see exactly what it sends and receives. This is the most typical blind spot of ordinary capture tools.

1. When to Use This Capture Method

When neither a proxy nor a NIC capture can get anywhere with the target, take this route. It suits you if any of the following applies:

The target program is already running; restarting it is inconvenient and you don't want to change any of its settings — you just want to see what it's sending, right where it is.
The target uses certificate pinning, so the moment a proxy takes over, connections fail or throw errors.
The target ignores the system proxy entirely, so with a proxy configured you can't capture a single packet.
The target uses home-grown / non-standard encryption, so even a NIC capture yields only a pile of undecryptable ciphertext.
The target communicates directly through the OS's built-in crypto libraries (often the most maddening blind spot elsewhere).

If the target is just an ordinary program you can launch from the command line (browser / script / CLI), Launch-by-Program Capture is less hassle; if what stands in your way is a built-in macOS app, or a particularly stubborn, deeply hidden application that rejects any external interference, switch to System-Level Capture.

2. Prerequisites

TraceEagle is installed and running (on first launch, just accept the system permissions it asks for).
The target program is already running (you only need to recognize its name); or you have its executable path and let the tool launch it for you.
No certificates to install, no system proxy to change, no configuration of the target program to touch.

3. Start Capturing: Three Steps to Plaintext

Create a new session and select Local Application-Layer Capture.
Choose the target:
- Go straight at a running program — select a live process from the process list and read plaintext from its internals on the spot; no restart, no changes to any of its settings.
- Alternatively, enter the program path and let the tool launch it for you.
Click Start. The tool reads the plaintext the target program sends and receives from inside the program itself, listing each entry in real time, sorted by direction (Sent ↑ / Rec ↓).

Make the target program generate a network request (click something, refresh, send a message) and the plaintext will appear in the list in real time.

Two optional toggles — turn them on only when you hit a tough nut:

Restart Target (capture early startup): much of the authentication and handshaking happens the instant the program starts up. Enable this to have the target closed first and then relaunched by the tool, so you also capture that early-startup traffic and don't miss the crucial first request.
Socket Traffic (lower-level fallback): with programs that are trimmed down, with symbols removed, or written on a newer tech stack, where the normal approach can't find their encrypt/decrypt entry point, turn this toggle on and it takes a lower-level path to the data and still decrypts the plaintext. For plenty of programs that defeat every other approach, this one move gets the job done.

4. Verify: Confirm You've Got Plaintext

Click any entry in the list to see its details:

There are send/receive records: listed by direction (Sent ↑ / Rec ↓), with entries growing in real time.
It's plaintext, not ciphertext: the details show complete, readable content (such as JSON or HTTP request headers), not a pile of garbled bytes.

No crypto library is off limits, no tech stack is off limits — browsers, desktop clients, apps written on all kinds of cross-platform frameworks, native binaries: many targets that show "nothing but ciphertext" elsewhere come out as plaintext right here.

5. Can't Capture or Decrypt? Check Each Case

Symptom	Most Likely Cause	What to Do
You selected the program, but not a single send/receive appears	The target hasn't generated network traffic yet; or it sent all the key traffic the moment it started	Get it moving first (click, refresh, send a message); if the startup traffic is what you're missing, enable Restart Target and let the tool relaunch it and capture from the very beginning
There's traffic, but the normal approach can't locate its encrypt/decrypt entry point	The target is stripped, has its symbols removed, or is written on a newer tech stack	Turn on Socket Traffic for a lower-level fallback and decrypt the plaintext anyway
A multi-window / multi-process program, and you only capture part of it	By default only the single selected program is targeted; its child processes aren't expanded automatically	Select the other processes / windows one at a time and open a separate capture for each
You can't select it at all / can't get into it (usually a built-in macOS app)	The target is a built-in app, or a particularly stubborn, deeply hidden application that rejects any external interference	Switch to System-Level Capture (observing from the system level without entering the program)
You just want the easy route for an ordinary program	The target can already be launched from the command line and honors proxies	Launch-by-Program Capture or Proxy Capture is lighter-weight

6. How to Choose Among the Four Local Capture Methods

Your Situation	Which One to Use
Program already running / certificate pinning / ignores proxies / home-grown encryption / system crypto libraries	Application-Layer Capture (this guide)
Ordinary program you can launch from the command line (browser / script / CLI)	Launch-by-Program Capture (less hassle)
You want to see all traffic on the machine, including non-HTTP traffic	NIC Capture
Built-in macOS apps / stubborn applications	System-Level Capture

Next Steps

Plaintext obtained from the inside goes through the same processing pipeline as the other capture methods — how to read it, switch views, and decode it: see Viewing and Decoding Data.
Up against a proprietary / home-grown socket protocol and want to teach the tool how to read it: see Custom Protocol Decoding.
If the target is stuck on certificate pinning: you can also try Defeating Certificate Pinning first.
To modify a request before resending it, or intercept and edit it mid-flight: see Request Construction and Replay and Rule Rewriting and Breakpoint Interception.

iOS Packaging Methods: From Xcode Archive to Lightweight Toolchain for IPA Builds

iPhoneTechie — Tue, 08 Sep 2026 10:21:47 +0000

iOS applications go through compilation, signing, and packaging stages before becoming installable IPA files. Different development environments and project types require different packaging approaches.

Xcode Archive Packaging

The standard packaging flow in Xcode: select the target device as Any iOS Device → Product → Archive → Organizer automatically opens → Distribute App → choose signing method. The wizard prompts you to select a distribution certificate and provisioning profile, and finally outputs an IPA or directly uploads to App Store Connect.

The Archive approach features a complete workflow and strict validation. Xcode performs code signing verification, Bitcode compilation, and symbol file export steps. The downside is that the Archive process is time-consuming for large projects; each Clean Build recompiles all files, and it must be done on a Mac.

xcodebuild Command-Line Packaging

Automated environments typically use xcodebuild instead of the Xcode GUI. The command: xcodebuild archive -workspace App.xcworkspace -scheme App -configuration Release -archivePath build/App.xcarchive. Then use xcodebuild -exportArchive -archivePath build/App.xcarchive -exportPath build/ -exportOptionsPlist export.plist to export the IPA. In export.plist, specify the signing method (app-store/ad-hoc/development) and team ID.

The advantage of xcodebuild is that it's scriptable and parameters are precisely controllable. The downside is that command parameters are complex and initial configuration requires consulting documentation. The same project may have parameter differences across different CI environments.

Fastlane gym Packaging

Fastlane's gym encapsulates the complexity of xcodebuild. After configuring the Fastfile, a single gym(scheme: "App", output_name: "App.ipa") command produces an IPA. gym automatically handles both the Archive and Export steps, centralizing parameter management. Combined with match for certificate synchronization and sigh for provisioning profile management, the build and release process can be highly automated.

KXApp Packaging

KXApp includes a complete iOS compilation toolchain and can perform packaging without Xcode installed on the system. On Windows or Mac, open the project, click the build button, and the tool automatically completes compilation, signing, and packaging, directly outputting an IPA file.

When processing Flutter projects, KXApp does not require separate Xcode toolchain configuration; just open the Flutter project and select iOS build. For scenarios where development happens on Windows, KXApp can build iOS packages without connecting to a remote Mac, reducing environment setup steps.

KXApp packaging also supports command-line invocation, suitable for teams that have already integrated other CI/CD toolchains. Since KXApp includes Dart compilation capabilities, building iOS packages for Flutter projects skips the step of separately configuring an Xcode toolchain.

Signing and Export

Regardless of the packaging method, IPA signing is a required step. IPA packages signed with a development certificate can only be installed on test devices whose UDIDs are added, while packages signed with a distribution certificate can be submitted to the App Store. Before packaging, confirm that the certificate type and provisioning profile are correctly bound.

If you encounter signing issues during packaging, first check whether the Bundle ID matches the provisioning profile, then confirm whether the certificate has expired. Also verify that the UDID of the test device is included in the profile's device list.

Selection Recommendations

Xcode Archive is the most reliable choice for official releases. For CI/CD environments, Fastlane gym is recommended for process automation. For lightweight development and rapid validation, use KXApp to reduce dependency on a Mac environment without launching Xcode for every build. These three approaches cover scenarios from individual development to team collaboration; choose based on the project phase and team environment.

iOS Certificate Management: Creation, Limits, p12 Passwords & Cloud Backup

iPhoneTechie — Mon, 07 Sep 2026 12:30:26 +0000

Certificates

Requires a paid Apple Developer Program membership (some capabilities are available to free accounts; see limitations below).

Certificates are used to sign apps. There is generally a limit of 3 certificates for the same type, and one certificate can be used by multiple apps. Push certificates are deployed on the push server for push notifications; they are not used to compile apps. Accounts that have not joined the Apple Developer Program only receive certificates with a validity period of 7 days.

Creating a Certificate

Use Appuploader to create a certificate:

Click "Create Certificate" and choose the certificate type (e.g., development signing certificate, distribution signing certificate, push certificate, etc.).
Select the identifier to bind (App ID / Pass Type ID / Merchant ID, depending on the certificate type). If there are no options, you must first create an identifier in the corresponding function (such as Bundle ID), and then return to issue the certificate.
Fill in a certificate name (so you can recognize it later in the list) and an email address.
Set a .p12 protection password. This password is used to encrypt the .p12 file that contains the private key. The server does not store this password. You will need to enter it when downloading or importing the certificate. Keep it safe; if you forget it, the private key cannot be used.
Optionally, check "Use the Kaixin service to sync the certificate" (cloud backup). After syncing, you can download the certificate on any computer. If unchecked, the certificate can only be downloaded on the current machine; for other computers, you must manually send and manage the certificate file.
After submission, the certificate is signed/issued by Apple.

Managing Certificates

The list shows the name, type, status, and expiration time, and supports search by name/type/serial number.
Cloud backup: You can make a cloud backup of an existing certificate at any time, and it will be synced to the Kaixin cloud.
Download: When there is no local .p12 file, the system will try to download it from the cloud (provided a cloud backup was made previously).
Revocation: Revoking the certificate from Apple's portal is irreversible; after revocation, all provisioning profiles that depend on this certificate must be regenerated.

iOS Development Efficiency Tools: From Xcode Acceleration Configuration to Lightweight IDE

iPhoneTechie — Fri, 04 Sep 2026 10:53:17 +0000

In the daily work of iOS developers, actual code writing may only take up a portion of the time; much of the remaining time is spent waiting for builds, checking logs, configuring certificates, and waiting for Xcode indexing. Improving development efficiency doesn't always depend on changing coding habits; switching to a more convenient tool or optimizing the existing toolchain configuration can also free up a lot of time.

Areas Where Xcode Itself Can Be Optimized

Xcode's build speed is a common bottleneck. There are several things you can do: In Build Settings, set Build Active Architecture Only to Yes during debugging to compile only the current device's architecture. Set Debug Information Format to DWARF to avoid generating dSYM files, reducing time in the linking phase. Put DeriveData on a RAM disk or clean it regularly to prevent cache buildup from affecting performance.

Xcode's plugin ecosystem is not as rich as VS Code's, but tools like XcodeGen and Tuist can replace xcodeproj with YAML or Swift files, solving project configuration conflict issues.

KXApp's Positioning in Efficiency

KXApp's starting point is to reduce dependence on the complete Xcode environment. It is developed based on VS Code, inheriting VS Code's plugin ecosystem and lightweight editor experience. Its startup speed is much faster than Xcode, so daily code changes, browsing project structure, and performing simple debugging verification don't require waiting for Xcode indexing to finish.

The project creation process is greatly simplified. In Xcode, creating a new project requires selecting templates, configuring options, checking test frameworks, and many other steps. In KXApp, you choose Swift, Objective-C, or Flutter when creating a project, and it generates a standardized directory structure with one click.

The on-device debugging process is also streamlined. Connect an iPhone via USB, click Build and Install, and the tool automatically handles signing and deployment. After modifying code, it incrementally syncs to the device for verification, so you don't have to rebuild and reinstall the full package every time. Built-in support for compiling the iOS side of Flutter projects is also included, eliminating the need for additional Flutter and Xcode integration configuration.

Other Productivity Tools

SwiftLint automatically checks code style during the coding phase, reducing formatting discussions in code review. When combined with Git's pre-commit hook for automatic checks, non-compliant code commits are blocked.

Fastlane automates packaging, screenshots, and uploads. Once the Fastfile is configured with certificate management, build parameters, and release channels, one command can complete the entire release process.

Dependency management with CocoaPods and SPM can also affect efficiency. SPM is Apple's official solution, offering good integration, but some third-party libraries are not as well supported as in CocoaPods. Mixing both requires attention to dependency conflicts. Regularly cleaning up unused Pods and reducing unnecessary dependencies can also significantly reduce build time.

Approaches to Improving Efficiency

Productivity tools are not meant to replace Xcode but to reduce waiting and repetitive operations in the right scenarios. If compilation takes long, optimize build configurations or switch to a lightweight IDE for quick verification; if the packaging process is cumbersome, automate it. Saving a little time at every point in the toolchain can lead to remarkable cumulative results.