When you upload an app from Xcode to App Store Connect, you may see ITMS-90161: Invalid Provisioning Profile. This usually means the provisioning profile embedded in the archive does not satisfy App Store Connect distribution requirements or does not match the app’s Bundle ID, signing certificate, team, or enabled capabilities.
- Common causes
- Typical situations where it appears
- What to check first
- Fix 1: Use Automatically manage signing
- Fix 2: Regenerate the App Store Connect provisioning profile
- Fix 3: Remove outdated local provisioning profiles
- Fix 4: Inspect the provisioning profile embedded in the archive
- Fix 5: Regenerate profiles after capability changes
- Important notes
- Summary
Common causes
- A Development or Ad Hoc provisioning profile was used instead of an App Store Connect distribution profile.
- The App ID in the provisioning profile does not match the app’s Bundle Identifier.
- The distribution certificate in the profile does not match the certificate used to sign the archive.
- The provisioning profile has expired, been invalidated, or needs to be regenerated.
- The app’s capabilities changed, but the project is still using an older profile without the required entitlements.
- Manual signing is configured with the wrong Team or an outdated profile.
Typical situations where it appears
The error is especially common after changing Signing & Capabilities, renewing a distribution certificate, moving the project to another Mac, or using an outdated .mobileprovision file in a CI environment.
What to check first
- Open the target in Xcode and check the Team and Bundle Identifier under Signing & Capabilities.
- Check the Signing Certificate and Provisioning Profile used for the Release configuration.
- Create a fresh archive, then use Organizer and Distribute App.
- If you use manual signing, verify in Certificates, Identifiers & Profiles that the App Store Connect profile is tied to the correct explicit App ID and active distribution certificate.
Fix 1: Use Automatically manage signing
If you do not have a specific reason to sign manually, automatic signing is usually the simplest fix. Apple currently states that when automatic signing is used for App Store Connect uploads, Xcode manages the distribution provisioning profiles for you.
Go to Target → Signing & Capabilities, enable Automatically manage signing, and select the correct Team.
Fix 2: Regenerate the App Store Connect provisioning profile
For manual signing, create or regenerate an App Store Connect distribution profile in the Apple Developer portal. Choose the explicit App ID that matches your app’s Bundle ID and select the currently valid distribution certificate.
Download the new profile, make sure Xcode uses it for the Release configuration, and create a new archive.
Fix 3: Remove outdated local provisioning profiles
Old profiles stored locally can cause Xcode or build scripts to select the wrong file. Close Xcode if necessary and inspect the local provisioning profile directory.
~/Library/MobileDevice/Provisioning Profiles/Remove profiles that are no longer needed, then reopen Xcode and refresh the signing configuration.
Fix 4: Inspect the provisioning profile embedded in the archive
If you need to confirm which profile is actually embedded in the app, decode the embedded.mobileprovision file.
security cms -D -i embedded.mobileprovisionCheck values such as Entitlements, UUID, ExpirationDate, TeamIdentifier, and application-identifier, and compare them with the Xcode project settings.
Fix 5: Regenerate profiles after capability changes
Adding or removing capabilities such as Push Notifications, Associated Domains, or Sign in with Apple can make an older provisioning profile invalid for the current app. Verify the App ID capability settings and regenerate the profile so the required entitlements are included.
For certain managed capabilities, Apple supports enabling them directly in Xcode 15 or later. Newly generated provisioning profiles for that App ID then include the corresponding entitlements.
Important notes
- Do not submit an App Store build signed with a Development profile.
- Keep the Bundle ID, Team, App ID, and distribution certificate consistent.
- After changing certificates or capabilities, avoid reusing an old provisioning profile.
- After fixing signing settings, create a new archive instead of reusing the previous one.
Summary
ITMS-90161 Invalid Provisioning Profile means the provisioning profile embedded in your uploaded app does not match App Store Connect distribution requirements. Start by checking whether automatic signing can resolve the issue. If you use manual signing, regenerate an App Store Connect profile with the correct App ID, distribution certificate, and capabilities, then build and upload a fresh archive.
