How we distribute an iOS app outside the App Store: a practical AltStore PAL walkthrough

App Store review rejected our app under Guideline 1.2 — the core mechanic (users rate each other's photos) is banned as a category, and no metadata change fixes that. So we became one of the first apps distributed exclusively through an alternative marketplace under the EU's DMA. Documentation for this path is thin and sometimes contradictory, so here is a step-by-step of what actually had to be done.

Step 1. Alternative Terms Addendum

You sign an addendum to the developer agreement in App Store Connect. You don't need to be an EU resident. Distribution is free up to 1M first annual installs (companies under €10M revenue get the Core Technology Fee exemption).

Step 2. Registering with the marketplace

AltStore has a REST API to register your developer ID — important: it's the UUID from your ASC profile, not the Team ID (registering with the Team ID silently fails — we stepped on that). The token goes into ASC: Users and Access → Integrations → Marketplaces.

Step 3. Notarization instead of review

You build and upload with the usual xcodebuild + upload. Then, instead of "Submit for Review", you send it for notarization: an automated security/functionality check, without content guidelines. Ours passed on the first try in ~30 hours. A mechanic banned on the App Store passes here.

Step 4. Hosting the ADP yourself

After notarization you download the Alternative Distribution Package: manifest.json, a signature file (no extension!), and several .ipa variants. You host it as-is; hierarchy and hashes must not change. Two gotchas:

• the extensionless signature file — our SPA fallback on ASP.NET served index.html instead; fixed with ServeUnknownFileTypes on the static handler;
• the .ipa must be served as application/octet-stream.

Step 5. Source JSON and federation

Next to it you put a source.json: marketplaceID (= the app's Apple ID), the manifest downloadURL, size, icon, screenshots, versions. Users add the source via an altstore://source?url=… link. Enable federation (a fediUsername field) and the app becomes searchable right inside the marketplace, no manual source add.

Updates

Each new version is the same loop: build → notarize → new ADP on the server → new entry in versions[] of source.json. AltStore picks up auto-updates itself.

Limits and fallbacks

Marketplaces work in the EU, Japan and Brazil, iOS 17.4+. For the rest of the world we run a PWA (standalone manifest + a minimal service worker — Safari installs it to the home screen) and a sideload IPA via AltStore Classic with our own source. The biggest non-technical problem is conversion: you have to explain to users what a marketplace even is, so we funnel all traffic to a single install page.

Takeaways

Cost beyond the developer account: zero. Actual time spent: about a week, most of it on the undocumented details above. If the App Store is closed to your app (or you just don't want to hand over 15–30%), this path works today.

The app from this case study is Rate Me (rateme.lv/ios) — happy to answer questions in the comments.