Entitlements 权限文件生成与检查
勾选应用用到的能力，生成一份合法的 .entitlements 属性列表，键名、值类型和允许的值都与 Apple 一致。也可以粘贴 .entitlements 文件，或 codesign 读出的已构建应用的签名权限，找出类型错误、Apple 不接受的值、格式不对的 App 群组、商店构建里的调试键，以及没开 App Sandbox 的 Mac 应用。所有内容都不会上传。
键名、值类型、允许的值和平台取自 Apple 的 entitlement 文档页面，核对于 2026-10-31。说明文字是 Apple 的英文原文。
从这里开始
0 项权限
推送通知
APS Environment
aps-environment
The environment for push notifications.
关联域
Associated Domains
com.apple.developer.associated-domains
The associated domains for specific services, such as shared web credentials, universal links, and App Clips.
App 群组、钥匙串和数据保护
App Groups
com.apple.security.application-groups
A list of identifiers specifying the groups your app belongs to.
Data Protection
com.apple.developer.default-data-protection
The level of data protection for sensitive user data when an app accesses it on a device.
Keychain Access Groups
keychain-access-groups
The identifiers for the keychain groups that the app may share items with.
iCloud
iCloud Container Identifiers
com.apple.developer.icloud-container-identifiers
The container identifiers for the iCloud production environment.
com.apple.developer.icloud-container-development-container-identifiers
com.apple.developer.icloud-container-development-container-identifiers
The container identifiers for the iCloud development environment.
iCloud Services
com.apple.developer.icloud-services
The iCloud services used by the app.
iCloud Key-Value Store
com.apple.developer.ubiquity-kvstore-identifier
The container identifier to use for iCloud key-value storage.
com.apple.developer.icloud-container-environment
com.apple.developer.icloud-container-environment
The development or production environment to use for the iCloud containers.
通过 Apple 登录、Apple Pay 和钱包
Sign in with Apple
com.apple.developer.applesignin
An entitlement that lets your app use Sign in with Apple.
Merchant IDs
com.apple.developer.in-app-payments
A list of merchant IDs your app uses for Apple Pay support.
Pass Type IDs
com.apple.developer.pass-type-identifiers
A list of identifiers that specify pass types that your app can access in Wallet.
Apple 服务
Game Center
com.apple.developer.game-center
A Boolean value that indicates whether users of the app may see and compare achievements on a leaderboard, invite friends, and start multiplayer games.
Siri
com.apple.developer.siri
A Boolean value that indicates whether the app handles Siri requests.
Family Controls
com.apple.developer.family-controls
A Boolean value that indicates whether the app can request or revoke authorization to provide parental controls.
WeatherKit
com.apple.developer.weatherkit
A Boolean value that indicates whether the app may use WeatherKit.
App Attest Environment
com.apple.developer.devicecheck.appattest-environment
The environment for an app that uses the App Attest service to validate itself.
Group Activities
com.apple.developer.group-session
A Boolean value that indicates whether the app may implement shared group experiences.
com.apple.developer.contacts.notes
com.apple.developer.contacts.notes
A Boolean value that indicates whether the app may access the notes in contact entries.
HealthKit 和 HomeKit
HealthKit
com.apple.developer.healthkit
A Boolean value that indicates whether the app may request user authorization to access health and activity data that appears in the Health app.
HealthKit Capabilities
com.apple.developer.healthkit.access
Health data types that require additional permission.
HealthKit Observer Query Background Delivery
com.apple.developer.healthkit.background-delivery
A Boolean value that indicates whether observer queries receive updates while running in the background.
HomeKit
com.apple.developer.homekit
A Boolean value that indicates whether users of the app may manage HomeKit-compatible accessories.
网络和 NFC
Access Wi-Fi Information
com.apple.developer.networking.wifi-info
A Boolean value indicating whether your app can access information about the connected Wi-Fi network.
Network Extensions
com.apple.developer.networking.networkextension
The APIs an app can use to customize networking features.
Personal VPN
com.apple.developer.networking.vpn.api
The API an app can use to create and control a custom system VPN configuration.
Near Field Communication Tag Reader Session Formats
com.apple.developer.nfc.readersession.formats
The Near Field Communication data formats an app can read.
内存
Increased Memory Limit
com.apple.developer.kernel.increased-memory-limit
A Boolean value that indicates whether core features of your app may perform better with a higher memory limit on supported devices.
Extended Virtual Addressing
com.apple.developer.kernel.extended-virtual-addressing
A Boolean value that indicates whether the app may access an extended address space.
App Clip
com.apple.developer.associated-appclip-app-identifiers
com.apple.developer.associated-appclip-app-identifiers
A list of App Clip identifiers for an app with exactly one entry.
Parent Application Identifiers
com.apple.developer.parent-application-identifiers
A list of parent application identifiers for an App Clip with exactly one entry.
com.apple.developer.on-demand-install-capable
com.apple.developer.on-demand-install-capable
A Boolean value that indicates whether a bundle represents an App Clip.
你的 .entitlements 文件
请先在上面选择至少一项权限。
工作原理
- •收录了独立应用最常用的 57 项权限：推送、关联域、App 群组、钥匙串共享、iCloud、通过 Apple 登录、Apple Pay、钱包、HealthKit、HomeKit、Game Center、Siri、WeatherKit、网络、NFC、App Clip、Mac App 沙盒和强化运行时例外。每一项的键名、值类型、是否为列表、允许的值和平台，都取自 Apple 自己的 entitlement 页面。
- •生成方式与 Xcode 一致：XML 属性列表，键按字母顺序排列。已用 plutil 校验，能通过并读回相同的值。
- •检查器可读取单独的 .entitlements 文件，也可读取 codesign -d --entitlements - --xml 的输出（包括第一行的 Executable）。签名时从描述文件带入的键（如 application-identifier）不会被标为问题。
- •商店相关检查：get-task-allow 为 true；关联域里带了协议、路径或开发者模式；App 群组不是 group.<名称>（macOS 上也可以是 <团队 ID>.<名称>）；有沙盒键却没开 App Sandbox；Mac App Store 构建没开 App Sandbox。
它不做什么
- •它看不到你的开发者账号。每项能力还要在 App ID 上启用，描述文件也要包含它；可以用描述文件查看器对照。
- •它没有收录所有权限。少用的、需 Apple 批准的和 Apple 私有的键会显示为“未收录”，而不是错误。
- •有些能力还需要 Info.plist 键（用途说明、后台模式）或 Apple 批准（Family Controls、CarPlay、关键提醒），这些不在这个文件里。
- •它不读取二进制属性列表。请用 plutil -convert xml1 转换，或在 codesign 命令里加 --xml。
常见问题
- .entitlements 文件是什么？
- Xcode 签入应用的一份属性列表，列出应用可以使用的能力，比如推送、iCloud 或 App 群组。签名后的权限必须与描述文件允许的一致，否则应用装不上，或者上传时被拒。
- 怎么查看已构建应用实际签入的权限？
- 在终端运行 codesign -d --entitlements - --xml YourApp.app，也可以对 .xcarchive 里或解压后 .ipa 里的 .app 运行。把输出粘贴到这里的检查器。
- 为什么 App Store Connect 因为 get-task-allow 拒收构建？
- get-task-allow 允许调试器附加到应用。开发描述文件会带上它，App Store 发布描述文件不允许它。签名后的应用里它为 true，说明是按开发方式签的。请用 App Store 发布描述文件归档并导出。
- App 群组标识符是什么格式？
- Apple 文档写的是 group.<群组名>，需要在开发者账号里注册。macOS 上也可以用 <团队 ID>.<群组名>，这种不需要注册。iOS 应用必须用 group. 形式。
- aps-environment 应该是 development 还是 production？
- Apple 说 Xcode 会按描述文件设置：开发描述文件是 development，发布是 production。文件里留着 development 很正常，请检查导出后的应用，那里应为 production。
- Mac App Store 应用需要哪些权限？
- com.apple.security.app-sandbox 设为 true，再加上应用实际用到的沙盒权限，比如对外联网用 com.apple.security.network.client，读写用户打开和保存的文件用 com.apple.security.files.user-selected.read-write。