Credentials

To build and ship a mobile app, Bifrost needs two things for each platform.

Signing credentials prove the app is yours: a distribution certificate and provisioning profile on iOS, a keystore on Android. Without them a build won't install on a device or get accepted by a store.

Store API access lets Bifrost upload builds for you. Apple calls this an App Store Connect API key. Google calls it a Play Store service account.

Two ways to set them up

Bifrost Managed Credentials is the default. Give Bifrost your team's store API key once and it creates the signing credentials in your Apple or Google account and renews them before they expire. You never generate or upload a certificate yourself. See Bifrost Managed Credentials.

Bring your own is for apps that are already signed. If your app is on the App Store or Google Play today, upload the certificate or keystore it was signed with. Stores tie an app to its signing key for good, so a new key would be rejected. See iOS and Android.

Both paths run through the same wizard: open your app's Settings → Credentials and click Add Bundle Identifier or Add Application Identifier.

Store keys belong to the team

API keys are stored once per team under Team → Integrations and reused by every app, so you're not uploading the same file for each project. The wizard asks the team owner for a key the first time it's needed. See Store API keys.

App IDs

Your app's identifier (bundle identifier on iOS, application ID on Android) is set when you create its credentials and must be unique in each store. Use reverse-DNS style, such as com.supernative.bifrost. The two stores can use different IDs for the same app.

Firebase configuration

If your app sends push notifications through Firebase Cloud Messaging, upload its Firebase config file at the last wizard step, or later from the credential page: GoogleService-Info.plist for iOS and google-services.json for Android. It is optional and Bifrost injects it into your builds.

How your credentials are stored

Credentials are encrypted at rest and kept apart from the rest of our infrastructure. A build reads them through single-use access that only exists while it runs. Keep your own copies out of git and in a password manager.