Support

The Mac App Store edition runs inside the macOS sandbox. A sandboxed app can only read folders you have explicitly chosen, and the folder where Xcode keeps provisioning profiles is outside the app, so it has to be allowed once.

Click the folder button in the Profiles tab. An open panel appears with that folder already selected — don't change anything, just press Allow. The permission is remembered across launches (macOS security-scoped bookmarks).

Folders the app reads:

• ~/Library/Developer/Xcode/UserData/Provisioning Profiles — Xcode 16 and later
• ~/Library/MobileDevice/Provisioning Profiles — older Xcode versions

~/Library is hidden in the Finder by default. In the open panel, press ⌘⇧G and paste the path to jump straight there. If you'd rather not allow the folder, you can still drag .mobileprovision files into the window or use "Add from file…".

• Artifact inspection: .ipa (iOS tab), .apk and .aab (Android tab)
• OTA distribution: .ipa (iOS), .apk (Android). AABs can't be installed directly on a device, so they are not accepted.
• Profiles: .mobileprovision
• API key: the .p8 file downloaded from App Store Connect

Drop a file onto the window or use "Choose file…" (⌘O).

Mac App Store apps must be sandboxed, and the sandbox cannot launch external programs such as xcodebuild or gradle. This edition therefore focuses on three things: inspection, profiles and OTA. Artifact inspection doesn't rely on external tools either — the app's own parser reads IPA, APK and AAB files directly.

1. Go to App Store Connect › Users and Access › Integrations › App Store Connect API.
2. Generate a Team key. Reading and creating profiles and devices usually requires the Admin role.
3. Enter the Issuer ID, Key ID and the downloaded .p8 file under "Download Profile" › "API Key" in the app. Picking an AuthKey_XXXXXXXX.p8 file fills in the Key ID automatically.

Apple lets you download the .p8 file only once, so keep it somewhere safe. The app never uses your Apple ID or two-factor codes.

The .p8 file stays wherever you keep it; the app only remembers a reference to it (a security-scoped bookmark). Request tokens are signed on your Mac, and the key itself is never sent anywhere — the app talks only to Apple's App Store Connect API (api.appstoreconnect.apple.com). Removing a key in the app does not delete the .p8 file.

A profile that expires within 30 days is "expiring soon" and shows the days left as an orange D-N badge. Anything past its date is "expired" (red). "New" means recently created; "Duplicates" flags two or more profiles with the same team, app ID and type.

The list of code-signing certificates in your keychain can't be read from inside the sandbox, so this card is empty in the Mac App Store edition. The certificates embedded in each profile are still shown in the detail and compare views, with SHA-1 and SHA-256 copy buttons.

An Apple Developer account can register up to 100 devices per type (iPhone, iPad, Mac, …) per membership year. Devices you disable still take up a slot until the membership renews. The Devices tab shows current usage per type (for example, iPhone 3 / 100).

No. The file is read only: the original is never modified, no result file is written next to it, and nothing is sent to any server. Results are shown in the app window only.

Item names with a dotted underline (permissions, device features, manifest settings, certificate fingerprints, entitlements and so on) open a popover with What it is · Details · Watch out. For the 16 KB card, click the ⓘ next to the title.

Starting with Android 15 some devices use 16 KB memory pages, and Google Play requires native libraries that support them. The app checks the ELF LOAD alignment of 64-bit (arm64-v8a, x86_64) .so files and, for uncompressed .so files stored in an APK, their 16 KB boundary inside the archive, and lists the libraries that don't comply.

Work through these in order:

• The IPA, manifest.plist and install.html must all be served over https. iOS refuses to install over http.
• Open the install link or QR code in Safari on the device. Messenger previews and in-app browsers often don't trigger the install.
• Ad Hoc: the device's UDID must be in the profile. If it isn't, add the device to the profile and rebuild the IPA.
• Enterprise: after installing, go to Settings › General › VPN & Device Management and trust the developer.
• An IPA signed with an App Store distribution profile can't be installed over the air. The app warns you when you pick such a file.
• Check that the IPA URL in the manifest matches the real file location, and that the file name has no spaces or special characters.

"Create Install File" (⌘↩) asks you for an output folder. It creates a <name>_OTA folder there and puts a copy of the IPA (or APK) in it together with <name>.manifest.plist, <name>.install.html and <name>.qr.png (Android: .install.html and .qr.png), overwriting files of the same name. The app never uploads anything, so upload these together with the IPA or APK yourself.

Upload the APK, install.html and QR image to the same https folder and open the install page in the device's browser (Chrome). Because the app comes from outside the Play Store, the device has to allow installs from unknown sources. The page shows the SHA-256 so testers can verify the download.

Open the globe menu in the toolbar, pick a language and confirm "Restart now". The app relaunches in that language; your work is kept. Supported: English, 한국어, 日本語, 简体中文, 繁體中文 and Español.

Choose Light, Dark or System in the toolbar. Text size goes from 85 % to 150 % via the View menu (Bigger ⌘+, Smaller ⌘-, Default ⌘0) or Settings (⌘,) › Display.

macOS 15 Sequoia or later, on Apple Silicon or Intel Macs. An App Store Connect API key is needed only for downloading and creating profiles and registering devices; everything else works offline.

Email beakbigkb@gmail.com with the following and it can be looked at quickly:

• macOS version (Apple menu › About This Mac)
• App version (ShouArchive menu › About ShouArchive)
• What you did, step by step, and what happened
• A screenshot or the exact error text, if possible

You don't need to attach IPA, APK or profile files. If one is needed it will be requested separately — and before sending anything, make sure it contains no key files (.p8) or sensitive data.