Auto-renewal
Distribution certs and provisioning profiles reissue themselves 30 days before expiry. The new cert keeps your existing key; profiles rebuild against the renewed cert in the same run.
Auto-renewal timeline
Apple certificates that renew themselves.
Encrypted vault. Dashboard with a live graph of every certificate, profile, and device. CLI that hands signing assets to any CI.
iOS · macOS · tvOS · watchOS
Auto-renewal on Growth and up. The Free plan tracks and alerts.
Encrypted vault
Devices
Provisioning profiles
Certificates
Ships signing assets to any CI. Bring your own pipeline.
See it in action
HexSign in 60 seconds
A walkthrough of the dashboard, certificate relationships, and the provisioning profile wizard. Open the watch page →
The product
One source of truth for Apple code signing.
An encrypted vault for certificates, a dashboard for every profile and expiration, and a CLI that ships signing assets to any CI. Synced with App Store Connect.
Relationship graph
See how certificates, profiles, and bundle IDs connect. Understand the blast radius before revoking.
Expiration alerts
Email, Slack, Teams, Jira, PagerDuty, and incident.io, with configurable thresholds and test runs. Fire only when auto-renewal can't act.
Alert routing rules
Profile wizard
A guided flow that picks the right identifier, certificate, and devices and generates the profile through Apple's API.
Profile creation wizard
How it works
From Apple account to vault, dashboard, and CI.
Connect your Apple Developer account
Add your App Store Connect API key (Issuer ID, Key ID, and private key). HexSign authenticates securely using Apple's official API.
Auto-sync certificates & profiles
HexSign pulls all your certificates, provisioning profiles, bundle IDs, and devices. Changes are detected on each sync.
Explore the relationship graph
See how everything connects in an interactive visual graph. Color-coded by status so problems jump out instantly.
Set up alerts and stay ahead
Configure alerts to email, Slack, Microsoft Teams, or your incident tooling with custom thresholds. Get notified days before anything expires.
Is HexSign right for you?
HexSign is a great fit if you:
Store Apple certificates in git, fastlane match, or shared drives and want a managed vault instead
Run CI/CD that depends on code signing and want a CLI that works across GitHub Actions, GitLab, Bitrise, or any shell
Manage iOS or macOS apps in production
Work across multiple Apple Developer accounts
Need to track certificate expirations before they break a release
Want to understand cert-profile-app relationships at a glance
Audit log, RBAC, SSO, and KMS-encrypted signing keys.
The audit log records who changed what and when, RBAC sets who can issue or revoke a certificate, SSO (SAML or OIDC) hands sign-in back to your IdP, and certificate private keys are generated inside HexSign, encrypted with AWS KMS, and only decrypted in memory when you export a .p12.
Secure and compliant
Built to pass a security review, not just a glance.
Encrypted with AWS KMS
Private keys are generated inside the vault and encrypted by AWS KMS, bound to your organization. They're decrypted only in memory to build a .p12 you ask for, and the .p12 is never stored.
Runs on AWS
Hosted on infrastructure that holds SOC 2, ISO 27001, and PCI DSS certifications, in a private VPC with encryption at rest. Data residency in the US, EU, or AU on Enterprise.
GDPR and Australian Privacy Act
Personal data is processed under the GDPR and the Australian Privacy Principles, with phishing-resistant MFA, per-user auth logs, and audit logs on every plan.
SOC 2 Type II: not yet. It is on the roadmap and the report will be published here when it exists. Uptime is public at status.hexsign.io. Until then, a completed security questionnaire and an architecture walkthrough are available on request for Team and Enterprise evaluations, and the security page covers what a reviewer would ask.
Bring your own CI. Fetch signing assets from the vault.
The HexSign CLI pulls certificates and profiles straight from the encrypted vault into any pipeline: GitHub Actions, GitLab, Bitrise, Codemagic, fastlane, or your own shell. No certs in git, no fastlane match repo, no shared Apple ID.
Explore the CLISee how we compare
HexSign vs the alternatives
Open-source CLI
HexSign vs Fastlane Match
Read HexSign vs Fastlane MatchApple's first-party portal
HexSign vs Apple Developer Portal
Read HexSign vs Apple Developer PortalCI/CD with managed signing
HexSign vs Codemagic
Read HexSign vs CodemagicMobile DevOps platform
HexSign vs Bitrise
Read HexSign vs BitriseApple's managed CI/CD with automatic signing
HexSign vs Xcode Cloud
Read HexSign vs Xcode CloudEnterprise mobile CI/CD
HexSign vs Appcircle
Read HexSign vs AppcircleManaged credentials for Expo
HexSign vs Expo EAS
Read HexSign vs Expo EASLive updates and native builds for Capacitor
HexSign vs Capawesome Cloud
Read HexSign vs Capawesome CloudLearn the fundamentals
Key Apple code signing concepts
Code signing
The process of attaching a cryptographic signature to a binary so the operating system can verify who built it and that nothing has changed since. Required for every app shipped on Apple platforms.
Read definition
Provisioning profile
A signed plist Apple issues that links a specific App ID, signing certificate, list of devices (for development and Ad Hoc), and entitlements. Without a matching profile, iOS will refuse to launch your build.
Read definition
App Store Connect
Apple's web console for managing App Store and TestFlight submissions, App Store Connect API keys, in-app purchases, builds, testers, and team access. Distinct from the Apple Developer portal.
Read definition
Apple Developer Program
Apple's paid membership program ($99/year) that lets a company or individual sign apps, distribute through the App Store and TestFlight, and access betas of Apple's developer tools.
Read definition
Code signing certificate
Umbrella term for any Apple-issued certificate used to sign a binary, installer, or push token. Covers Apple Development, Apple Distribution, Developer ID, APNs, Pass Type ID, and Mac Installer certificates.
Read definition
fastlane match
A fastlane action that stores Apple signing material (certificates, private keys, provisioning profiles) in a shared, encrypted git repo so every developer and CI runner can pull the same identities.
Read definition