Pick by how many people and machines sign, and how much control you need. Shared encrypted storage fits teams with several signers and CI. Local certificate tools fit a team that cannot revoke existing certificates. Xcode managed signing fits very small teams. Manual works for rare releases, with a safely stored private key.
The four approaches
The fastlane codesigning guide lists these options.
| Approach | How it works | Main cost |
|---|---|---|
| match | Stores certificates and keys in shared storage, syncs them to machines | You must secure the storage and passphrase. Getting started requires revoking existing certificates |
| cert and sigh | Ensures a valid certificate and its key are installed locally, and a matching profile | Each machine ends up holding its own signing material |
| Xcode code signing | Uses Xcode's built-in automatic or manual settings | Automatic can pick the wrong profile |
| Manual | You create and download certificates and profiles from the developer portal | The private key file must be stored safely, since it cannot be restored if lost |
The guide says match involves revoking existing certificates, so plan a window for that. On the manual path it says to store the .p12 of your certificates in a safe place because they cannot be restored if you lose them.
Decision guide
- How many people or machines sign? One machine: manual may be enough. Several, including CI: shared storage reduces duplicates.
- Can you afford to revoke current certificates? If not now, a local-tools approach lets you automate without that step.
- Who must be kept away from the developer portal? Shared storage lets developers sign without portal access, per the match documentation.
- How often do you release? Rarely: simpler is fine. Weekly: automate.
- What is your risk if one laptop is lost? With a local-tools approach, that laptop holds signing material. With shared storage, you revoke access to the storage.
Security notes on each
- Shared storage: protect it with a private repo, a passphrase kept elsewhere and two-factor authentication on access accounts. See git-stored certificate safety.
- Local tools: inventory which machines hold keys, and remove them from retired laptops.
- Xcode: understand that it may revoke or replace certificates, which can break a shared setup.
- Manual: keep an encrypted backup of the key in two places and document where.
Whichever you pick
Run CI in read-only mode where supported, use a store API key with a narrow role, and keep the release path separate from branch builds. Our post on automatic versus manual signing covers the build setting side.
Revisit yearly
Teams grow. A manual setup that suited two developers becomes a risk at ten. Review the choice when headcount, release frequency or the number of build machines changes.
Where Safeguard fits
Safeguard does not manage signing keys. It provides SBOM and dependency scanning, reachability analysis and policy gates for what you ship. Try the free scan.
Quick check
Does match need a shared developer account?
The documentation suggests optionally creating a shared developer portal account, but it is a choice, not a requirement.
Is manual signing unsafe?
It is fine if the private key is stored and backed up safely. The risk is a lost or copied key file.
Sources
Last reviewed: 19 October 2026.
