Publishing on the Apple App Store

What you need

• A Mac with a recent Xcode (Apple only allows iOS builds on macOS). Cloud Mac services and some CI providers are alternatives if you do not own one.
• An Apple Developer Program membership: US$99 per year at the time of writing (fee waivers exist for some non-profits and institutions). Individuals or organisations can enrol; organisations need a D-U-N-S number.
• An iPhone for testing is strongly recommended in addition to the simulator.

Bundle ID and signing

In Xcode, open ios/Runner.xcworkspace (not the .xcodeproj). In the Runner target's Signing & Capabilities tab, choose your team and enable "Automatically manage signing"; Xcode creates the certificates and provisioning profiles for you. Set the bundle identifier to your final ID, matching the App ID you register in your developer account.

A certificate proves who you are; a provisioning profile says which app may run on which devices or be distributed through the App Store. Automatic signing handles both for most apps; manual signing is mostly needed for complex enterprise setups.

Build and upload

flutter build ipa --obfuscate --split-debug-info=build/symbols
# creates an Xcode archive and an .ipa under build/ios/

The version name and build number come from pubspec.yaml (version: 1.0.0+1). Every upload must have a higher build number than earlier uploads of the same version.

TestFlight

After upload and automatic processing, a build appears in App Store Connect. TestFlight lets you install it on your own devices (internal testers, members of your App Store Connect team) and invite external testers by email or public link. The first build for external testers goes through a short beta review. Use TestFlight to catch crashes and gather feedback before release.

The App Store listing and privacy

• App name, subtitle, description, keywords, category, screenshots for required device sizes, and a support URL.
• A privacy policy URL and the App Privacy details ("privacy nutrition labels") describing data collected, including by SDKs like Firebase.
• Apps and SDKs that use certain sensitive APIs must include a privacy manifest file (PrivacyInfo.xcprivacy) declaring the reasons; Flutter and popular plugins include theirs, but check your own native code.
• Usage descriptions in Info.plist for every permission, such as NSCameraUsageDescription, written as a clear reason for the user.

App Review

Apple reviews every app and update against its App Review Guidelines. Many reviews finish within a day or two, but plan for more time. Common reasons for rejection, and their fixes:

Common mistakes

• Opening Runner.xcodeproj instead of Runner.xcworkspace, so CocoaPods dependencies are missing.
• Reusing a build number: the upload is rejected.
• Generic permission texts like "Needs camera": reviewers reject unclear reasons.
• No demo account for a login-only app.