Credentials

Ubriot signs and submits your builds with credentials you upload once. Upload them from the CLI or in the dashboard under Credentials. Credentials are encrypted at rest (AES-256) and never written to logs.

Every upload command takes --app <appId> and a --name <name> label. ubriot credentials list --app <app> shows what an app has, and ubriot credentials delete <credId> removes one.

iOSCopy Anchor Link

For iOS you need a distribution certificate and a way to talk to App Store Connect. Both are account-level: upload them once and every app reuses them.

App Store Connect API keyCopy Anchor Link

Create the key in App Store Connect under Users and Access, Integrations, and download the .p8 file.

ubriot credentials upload-asc-key --app myapp --name "ASC Key" \
  --key-p8 AuthKey_XXXX.p8 --key-id XXXX --issuer-id YYYY

Distribution certificateCopy Anchor Link

Export the certificate as a .p12 from Keychain Access or the Apple Developer portal.

ubriot credentials upload-ios-cert --app myapp --name "Distribution Cert" \
  --p12 dist.p12 --p12-password <password> --team-id ZZZZ

Provisioning profilesCopy Anchor Link

You normally do not upload profiles. At ship time Ubriot registers the bundle ID with Apple and creates the App Store provisioning profile from your stored credentials. Pass --reprovision-ios to ubriot ship ios to create it again, or --ios-capability <type> to add an Apple capability such as HEALTHKIT. Capabilities in your local Expo config are detected automatically.

To use a profile you manage yourself:

ubriot credentials upload-ios-profile --app myapp --name "My App Store Profile" \
  --profile profile.mobileprovision --bundle-id com.you.myapp

The name must match the profile name in the Apple Developer portal exactly.

Apple ID instead of an API keyCopy Anchor Link

TestFlight submission also works with your Apple ID and an app-specific password from appleid.apple.com. ubriot credentials setup-testflight --app myapp walks you through it, or upload directly:

ubriot credentials upload-apple-id --app myapp --name "Apple ID" \
  --apple-id you@example.com --app-specific-password xxxx-xxxx-xxxx-xxxx

AndroidCopy Anchor Link

Upload keystoreCopy Anchor Link

ubriot credentials upload-android --app myapp --name "Upload keystore" \
  --keystore release.jks --keystore-password <password> \
  --key-alias upload --key-password <password>

Google Play service accountCopy Anchor Link

Needed to submit to Google Play. Create a service account with access to your app in the Play Console and download its JSON key.

ubriot credentials upload-google-service-account --app myapp --name "Play" --json play-service-account.json

Push notificationsCopy Anchor Link

Notify needs an APNs auth key for iOS and a Firebase service account for Android. ubriot push setup --app myapp finds them in your project and uploads them, or upload each one:

ubriot credentials upload-apns-key --app myapp --name "APNs" \
  --key-p8 AuthKey_XXXX.p8 --key-id XXXX --team-id ZZZZ --bundle-id com.you.myapp
ubriot credentials upload-firebase-service-account --app myapp --name "Firebase" --json firebase-service-account.json

--environment sandbox sends through the APNs sandbox; the default is production.

Private repositoriesCopy Anchor Link

To clone a private GitHub repository, upload a personal access token with repo scope:

ubriot credentials upload-github-token --app myapp --name "GitHub" --token <token>

Reusing credentials across appsCopy Anchor Link

Copy a team-wide credential, such as an APNs key, to another app in the same team without uploading the file again:

ubriot credentials copy --from <credId> --to-app nextapp

--name renames the copy, and --bundle-id overrides the APNs topic, which defaults to the destination app's bundle id.