"Valid signing identity not found."
This error has haunted iOS developers for 15 years. The system Apple uses to secure apps is powerful but notoriously complex. It relies on a file called a Provisioning Profile.
What is a Provisioning Profile?
Think of a Provisioning Profile (`.mobileprovision`) as a VIP pass for your app. It ties together three things:
- Who you are: Your Digital Certificate (p12).
- What the app is: Comparison App ID (Bundle ID).
- Where it can run: A list of device UDIDs (for Ad Hoc/Dev).
The Three Types of Profiles
1. Development Profile
Use case: Debugging on your own phone while plugged into Xcode.
Capabilities: Includes your specific devices. Enables debugging features.
Expiration: 1 year.
2. Ad Hoc Distribution Profile
Use case: Sending a beta to a tester (QA team, client) using a service like BetaDrop.
Capabilities: Does NOT allow debugging (more secure). Requires you to add every single tester's UDID to the profile beforehand.
Expiration: 1 year (or sooner if your certificate expires).
3. App Store Distribution Profile
Use case: Uploading to TestFlight or the App Store.
Capabilities: Contains NO device UDIDs. It authorizes the app to run on *any* device, but only if downloaded through Apple's servers (which wrap it in their own DRM).
How to Decode a Provisioning Profile
A .mobileprovision file is just a signed property list (plist), so you can read exactly what it grants instead of guessing. On a Mac, run this in Terminal to dump the raw XML:
security cms -D -i profile.mobileprovision
The keys worth checking:
- TeamIdentifier / AppIDName: which Apple Developer team and App ID (Bundle ID) the profile belongs to.
- Entitlements: the capabilities the app is allowed to use — push notifications, App Groups, associated domains, keychain sharing.
- ProvisionedDevices: the UDID allow-list. Present on Development and Ad Hoc profiles, absent on App Store profiles.
- ExpirationDate: the exact day the profile stops working.
If you would rather not touch Terminal, paste the file into our free provisioning profile decoder to read the same fields in a table, or use the IPA inspector to pull the embedded profile straight out of a built .ipa. To confirm a specific tester's device is actually on the allow-list, grab their identifier with the UDID checker and match it against the ProvisionedDevices list.
Device Limits You Will Hit
Ad Hoc distribution has a hard cap: an Apple Developer Program membership allows up to 100 devices per device type per membership year — 100 iPhones, 100 iPads, 100 Apple Watches, and so on. Every device UDID has to be registered in the account and added to the profile before you build, or that device gets a "could not be installed" error. Deleting a device from the list does not immediately free the slot; the count only resets when you renew your membership for the year.
The "Missing Profile" Fix
If you are building an app and Xcode says "Profile missing", the easiest fix is usually enabling "Automatically Manage Signing" in your project settings. This lets Xcode talk to Apple's servers and generate a Development profile for you.
However, for CI/CD builds (using Fastlane), you typically need to manage these files manually (Manual Signing) to ensure the build server uses the correct distribution certificate.
Distributing the Signed Build with BetaDrop
Once your Ad Hoc profile lists the right UDIDs and the build is signed, the last mile is getting that .ipa onto phones. Instead of standing up an HTTPS host and hand-writing an install manifest, upload the build to BetaDrop — a free way to distribute iOS beta builds over the air. You get an instant OTA install link and a QR code; testers open it in their phone browser and install directly, with no TestFlight, no App Store review wait, and no tester accounts. Builds up to 512 MB are supported. For the end-to-end workflow, see the guide to distributing iOS apps without TestFlight.
Frequently Asked Questions
Why did my app stop working after about a year?
Provisioning profiles expire. Development and Ad Hoc profiles are valid for one year from the day you create them, and an Ad Hoc profile also dies early if the distribution certificate it was built with expires first. Once the profile lapses, iOS refuses to launch the app. You have to regenerate the profile in your Apple Developer account, re-sign the build, and reinstall it on the device.
How do I decode a .mobileprovision file to see what is inside?
A .mobileprovision file is a signed property list. On a Mac you can run "security cms -D -i profile.mobileprovision" in Terminal to print the raw XML, which lists the team ID, App ID, entitlements, provisioned device UDIDs, and the expiry date. If you would rather not use the command line, drop the file or the whole .ipa into a browser-based provisioning profile decoder and read the same fields in a table.
What is the difference between Development, Ad Hoc, and App Store profiles?
A Development profile lists your own registered devices and enables debugging from Xcode. An Ad Hoc profile also pins the build to specific registered UDIDs but disables debugging, which makes it the profile you use to send betas to testers outside your office. An App Store profile contains no device UDIDs and only authorizes the app when it is delivered through Apple servers, such as TestFlight or the App Store.
How many devices can an Ad Hoc profile include?
An Apple Developer Program membership allows up to 100 devices per device type per membership year, so 100 iPhones, 100 iPads, and so on. Every UDID has to be registered in the account and added to the Ad Hoc profile before that device can install the build. Removing a device from the list does not free the slot until the annual membership reset.
How can I see which devices are already in a profile?
On a Mac, press Spacebar on a .mobileprovision file to open a QuickLook preview that lists every included UDID along with the expiry date. You can also decode the profile to read the ProvisionedDevices array directly. App Store distribution profiles contain no UDIDs at all, so an empty device list usually means you are looking at an App Store profile rather than an Ad Hoc one.
How do I get an Ad Hoc build onto a tester phone without TestFlight?
Host the signed .ipa behind HTTPS with a correctly formatted manifest so iOS can install it over the air. BetaDrop does that boilerplate for you: upload a build up to 512 MB and you get an instant OTA install link plus a QR code, and the tester installs straight from their phone browser with no App Store review wait and no tester accounts. The device UDID still has to be in the Ad Hoc profile first, so register it before you build.
