Entitlements file generator and checker
Pick the capabilities your app uses and get a valid .entitlements property list with Apple's exact keys, value types and allowed values. Or paste an .entitlements file, or what codesign says a built app was signed with, to find wrong types, values Apple does not accept, app groups in the wrong format, debug keys in a store build and a Mac app without App Sandbox. Nothing is uploaded.
Keys, value types, allowed values and platforms are taken from Apple's entitlement pages, checked on 2026-10-31. Summaries are Apple's own.
Start from
0 entitlements
Push notifications
APS Environment
aps-environment
The environment for push notifications.
Associated domains
Associated Domains
com.apple.developer.associated-domains
The associated domains for specific services, such as shared web credentials, universal links, and App Clips.
App groups, keychain and data protection
App Groups
com.apple.security.application-groups
A list of identifiers specifying the groups your app belongs to.
Data Protection
com.apple.developer.default-data-protection
The level of data protection for sensitive user data when an app accesses it on a device.
Keychain Access Groups
keychain-access-groups
The identifiers for the keychain groups that the app may share items with.
iCloud
iCloud Container Identifiers
com.apple.developer.icloud-container-identifiers
The container identifiers for the iCloud production environment.
com.apple.developer.icloud-container-development-container-identifiers
com.apple.developer.icloud-container-development-container-identifiers
The container identifiers for the iCloud development environment.
iCloud Services
com.apple.developer.icloud-services
The iCloud services used by the app.
iCloud Key-Value Store
com.apple.developer.ubiquity-kvstore-identifier
The container identifier to use for iCloud key-value storage.
com.apple.developer.icloud-container-environment
com.apple.developer.icloud-container-environment
The development or production environment to use for the iCloud containers.
Sign in with Apple, Apple Pay and Wallet
Sign in with Apple
com.apple.developer.applesignin
An entitlement that lets your app use Sign in with Apple.
Merchant IDs
com.apple.developer.in-app-payments
A list of merchant IDs your app uses for Apple Pay support.
Pass Type IDs
com.apple.developer.pass-type-identifiers
A list of identifiers that specify pass types that your app can access in Wallet.
Apple services
Game Center
com.apple.developer.game-center
A Boolean value that indicates whether users of the app may see and compare achievements on a leaderboard, invite friends, and start multiplayer games.
Siri
com.apple.developer.siri
A Boolean value that indicates whether the app handles Siri requests.
Family Controls
com.apple.developer.family-controls
A Boolean value that indicates whether the app can request or revoke authorization to provide parental controls.
WeatherKit
com.apple.developer.weatherkit
A Boolean value that indicates whether the app may use WeatherKit.
App Attest Environment
com.apple.developer.devicecheck.appattest-environment
The environment for an app that uses the App Attest service to validate itself.
Group Activities
com.apple.developer.group-session
A Boolean value that indicates whether the app may implement shared group experiences.
com.apple.developer.contacts.notes
com.apple.developer.contacts.notes
A Boolean value that indicates whether the app may access the notes in contact entries.
HealthKit and HomeKit
HealthKit
com.apple.developer.healthkit
A Boolean value that indicates whether the app may request user authorization to access health and activity data that appears in the Health app.
HealthKit Capabilities
com.apple.developer.healthkit.access
Health data types that require additional permission.
HealthKit Observer Query Background Delivery
com.apple.developer.healthkit.background-delivery
A Boolean value that indicates whether observer queries receive updates while running in the background.
HomeKit
com.apple.developer.homekit
A Boolean value that indicates whether users of the app may manage HomeKit-compatible accessories.
Networking and NFC
Access Wi-Fi Information
com.apple.developer.networking.wifi-info
A Boolean value indicating whether your app can access information about the connected Wi-Fi network.
Network Extensions
com.apple.developer.networking.networkextension
The APIs an app can use to customize networking features.
Personal VPN
com.apple.developer.networking.vpn.api
The API an app can use to create and control a custom system VPN configuration.
Near Field Communication Tag Reader Session Formats
com.apple.developer.nfc.readersession.formats
The Near Field Communication data formats an app can read.
Memory
Increased Memory Limit
com.apple.developer.kernel.increased-memory-limit
A Boolean value that indicates whether core features of your app may perform better with a higher memory limit on supported devices.
Extended Virtual Addressing
com.apple.developer.kernel.extended-virtual-addressing
A Boolean value that indicates whether the app may access an extended address space.
App Clips
com.apple.developer.associated-appclip-app-identifiers
com.apple.developer.associated-appclip-app-identifiers
A list of App Clip identifiers for an app with exactly one entry.
Parent Application Identifiers
com.apple.developer.parent-application-identifiers
A list of parent application identifiers for an App Clip with exactly one entry.
com.apple.developer.on-demand-install-capable
com.apple.developer.on-demand-install-capable
A Boolean value that indicates whether a bundle represents an App Clip.
Your .entitlements file
Pick at least one entitlement above.
How it works
- •The 57 entitlements are the ones indie apps use most: push, associated domains, app groups, keychain sharing, iCloud, Sign in with Apple, Apple Pay, Wallet, HealthKit, HomeKit, Game Center, Siri, WeatherKit, networking, NFC, App Clips, the Mac App Sandbox and hardened runtime exceptions. For each one, the key, the value type, whether it is a list, the allowed values and the platforms were read from Apple's own entitlement pages.
- •The file is written the way Xcode writes it: an XML property list with the keys in alphabetical order. It was checked with plutil, which accepts it and reads back the same values.
- •The checker reads a bare .entitlements file or the output of codesign -d --entitlements - --xml, header line included. It knows the keys code signing adds from the profile, such as application-identifier, and does not flag them.
- •Store checks: get-task-allow set to true, associated domains with a scheme, path or developer mode, app groups that are not group.<name> (or <team ID>.<name> on macOS), sandbox keys without App Sandbox, and a Mac App Store build without App Sandbox.
What it does not do
- •It cannot see your developer account. Each capability also has to be enabled for the App ID, and the provisioning profile has to include it; compare with the provisioning profile viewer.
- •It does not list every entitlement. Rarely used, Apple-approval-only and Apple-private keys are reported as not listed, not as errors.
- •Some capabilities also need Info.plist keys (purpose strings, background modes) or Apple's approval (Family Controls, CarPlay, critical alerts). Those are outside this file.
- •It does not read binary property lists. Convert them with plutil -convert xml1, or add --xml to the codesign command.
Questions
- What is an .entitlements file?
- A property list that Xcode signs into your app, listing the capabilities it may use, such as push notifications, iCloud or app groups. The signed entitlements have to match what the provisioning profile allows, or the app fails to install or is rejected on upload.
- How do I see the entitlements a built app was signed with?
- Run codesign -d --entitlements - --xml YourApp.app in Terminal, or on the .app inside an .xcarchive or unzipped .ipa. Paste the output into the checker here.
- Why does App Store Connect reject my build for get-task-allow?
- get-task-allow lets a debugger attach to the app. Development profiles add it; App Store distribution profiles do not allow it. If it is true in the signed app, the build was signed for development. Archive and export with an App Store distribution profile.
- What format do app group identifiers use?
- Apple documents group.<group name>, registered in your developer account. On macOS you can also use <team identifier>.<group name>, which does not need registering. iOS apps need the group. form.
- Should aps-environment be development or production?
- Apple says Xcode sets it from the provisioning profile: development for development profiles, production for distribution. Leaving development in the file is normal; check the exported app, where it should read production.
- Which entitlements does a Mac App Store app need?
- com.apple.security.app-sandbox set to true, plus only the sandbox entitlements the app uses, such as com.apple.security.network.client for outgoing connections or com.apple.security.files.user-selected.read-write for files the user opens and saves.