macOS Production Requirements
This guide covers white-label macOS apps distributed directly to customers as a DMG, outside the Mac App Store. Production signing uses your own Apple Developer identity.
What you need
| Requirement | What to prepare |
|---|---|
| Apple account | An active paid Apple Developer Program membership. Use your organisation’s membership when distributing under its company identity. |
| Signing certificate | A Developer ID Application certificate from that account, exported with its private key as a .p12, and its export password if one was set. |
| Certificate identity | The full identity, for example Developer ID Application: Example Ltd (ABCDEFGHIJ). |
| Notarization access | A team App Store Connect API key: Issuer ID, Key ID and .p8 private key, from the same developer account as the certificate. |
| App details | Application name, stable App Identifier, macOS version and branding. |
| Update hosting and keys | Your own HTTPS update folder and the project’s matching Update Private Key and Update Public Key. |
An iOS or Mac App Store distribution certificate does not replace Developer ID Application signing for this DMG flow. A separate Developer ID Installer certificate is used for signed .pkg installers; this DMG flow does not require one. See Apple’s Developer ID guidance .
Create the signing certificate once
Your Apple account holder creates a Developer ID Application certificate through the Apple Developer website or Xcode. On the Mac that holds its private key, export the certificate and private key together as a .p12.
Follow Creating a macOS Developer ID Certificate for the certificate request and export steps. Uploading Apple’s downloaded .cer alone is insufficient because it does not contain the private key.
The API key cannot create this certificate. Apple only supports creating Developer ID certificates through its website or Xcode. Once the certificate is available, the API key can authenticate automated notarization. See Apple’s certificate API limitations and notarization authentication .
Configure production in the portal
The Test / Production selector and saved-API-key notarization flow are being introduced. If these controls are not visible in your portal, ask SessionTalk to enable the updated flow before submitting a production build.
- Open your project’s App Store section and find MacOS.
- Select Production — use your Apple Developer account where the signing selector is available.
- Upload your
.p12and enter the full Developer ID Application Certificate Identity and certificate password. - Under Apple API key for notarization, save the Issuer ID, Key ID and
.p8. If this project already has a saved key from the same Apple developer account, it can be reused. - Set MacOS Update Url to your own folder, for example
https://downloads.example.com/softphone/macos, without a trailing slash ormacconfig.xml. - Configure the matching update signing keys, set the macOS version, save and complete the normal approval and build process.
The production build signs with your certificate, submits the app and DMG for Apple notarization, and attaches Apple’s notarization tickets before publishing the build download. Invalid credentials or rejected notarization must be resolved before distributing it.
Test builds and production releases
The test flow uses SessionTalk’s signing account so customers can evaluate a branded app without supplying an Apple Developer account. For production distribution under your own company, supply your own certificate and notarization credentials.
Test the production DMG on a separate Mac, including first launch and an update from an earlier release. Moving from SessionTalk test signing to your own signing identity should also be tested before rolling it out to users.
Next, follow macOS App Updates to publish the DMG, XML and signature on your hosting.