Bifrost Managed Credentials

Choose Use Bifrost Managed Credentials in the wizard and Bifrost creates your signing credentials, stores them, and renews them before they expire. It's the right choice for any new app.

iOS

Managed signing needs your team's App Store Connect API key. With it, Bifrost:

1. Registers your bundle identifier as an App ID if it isn't already.
2. Creates a distribution certificate (or a development certificate for Development builds) and keeps its private key.
3. Creates a provisioning profile for the App ID and stores it on the credential. For Ad-hoc and Development, Apple needs at least one registered device on the profile, so if your team has none yet the credential is created without one. Register a device on the credential page, then click Regenerate Profile.

There is no Keychain Access step and no certificate signing request. It works for App Store, Custom Apps, Ad-hoc and Development distribution. Enterprise distribution isn't exposed by Apple's API, so it always uses uploaded credentials.

Capabilities

The wizard lets you turn on the capabilities your app uses, such as Push Notifications or Sign in with Apple. They're written to your App ID before the profile is created, so choosing them up front saves regenerating the profile later. Bifrost only ever turns capabilities on, never off. iCloud, App Groups and Apple Pay need extra setup at Apple first, so they aren't offered, and background modes are an Xcode setting rather than an App ID capability.

One certificate per team

Apple caps how many distribution certificates a team can hold. Bifrost creates one per team and reuses it for every app, so it rarely hits that cap. If you're already at the limit the wizard tells you, and revoking an old certificate is your call: it breaks any other machine or CI system still signing with it.

Renewal

Provisioning profiles expire after a year and the certificate after about three. Bifrost emails the team owner 30 days before anything expires. Renew a profile from the credential page with Renew profile; renew the team certificate from Team → Integrations → App Store Connect, which issues a new certificate and a fresh profile for every app that uses it. The old certificate is left in place so nothing else that signs with it breaks.

Android

Nothing is needed up front. Bifrost generates a keystore with its passwords and key alias, valid for 25 years.

Google Play uses Play App Signing: Google holds your app's real signing key, and you sign uploads with a separate upload key. The keystore Bifrost generates is that upload key, which is why Bifrost can create it. After the wizard, download the upload certificate from the credential page and register it in Play Console when you create the app.

Because it's a key Bifrost generated, you can also rotate its password from the credential page.

Moving an existing app to a managed keystore

If your app is already on Google Play, its builds must be signed with the upload key Google already knows. Moving to a managed keystore is a two-step switch from the credential page:

1. Prepare a managed keystore. Bifrost generates the new key and parks it alongside your current one. Download its upload certificate and request an upload key reset in Play Console. Builds keep signing with your current key while Google processes the reset, which takes a couple of days.
2. Switch to the new keystore once Google confirms the reset. From then on builds sign with the managed key. The old keystore is archived, not deleted.

Never got a reset through? Discard the pending keystore and nothing has changed.

Checking credentials

From the credentials list you can run Check credentials on any credential. Bifrost calls App Store Connect or the Play Developer API with the stored key and reports whether the store accepts it, so you find out before a build does.