> For the complete documentation index, see [llms.txt](https://doc.sysdevmobile.com/kalipso/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://doc.sysdevmobile.com/kalipso/documentation/deploy/create-ipa/ipa-no-mac.md).

# IPA Without a Mac

Kalipso 6.1 introduces a new way to build and publish iOS apps **without owning a Mac**. Kalipso uses a private GitHub repository as a remote build agent: it pushes the project, a GitHub Actions workflow signs the IPA with your Apple certificate, and the signed IPA is returned to your PC — or uploaded directly to App Store Connect.

## Requirements

* **Apple Developer account** (paid — required to create App IDs, certificates and provisioning profiles)
* **GitHub account** (used by Kalipso as the remote build agent)

To upload to the App Store you also need:

* An **App ID** registered on [developer.apple.com](https://developer.apple.com/account/resources/identifiers/list)
* An **App** created in [appstoreconnect.apple.com](https://appstoreconnect.apple.com)

{% hint style="info" %}
Signing credentials and the build workflow are generated automatically by Kalipso once you provide your Apple API key and a GitHub token. Xcode and Transporter are **not** required on your PC.
{% endhint %}

## Process Overview

1. **GitHub** — create a private repository and a fine-grained personal access token.
2. **developer.apple.com** — register an App ID for the app.
3. **appstoreconnect.apple.com** — create the App entry (App Store distribution only).
4. **Kalipso** — open Generate IPA, fill the seven tabs, and let Kalipso generate the `.p12` and provisioning profile.
5. **Kalipso** — click **Generate**; the GitHub workflow signs the IPA and, if requested, uploads it to App Store Connect.

## Step 1 — GitHub: Create the repository and personal access token

Kalipso uses a private GitHub repository as a remote build agent. You need a repository to host the signing workflow, and a fine-grained personal access token so Kalipso can push the project and trigger the workflow.

### Create the repository

Sign in to [github.com](https://github.com) and click the **+** button at the top-right, then choose **New repository**.

<figure><img src="https://1614058754-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FJ5vDGuBZwhJDeu5Rq7Wt%2Fuploads%2Fgit-blob-50c2d886f02357aff97566ffd25d491dcb2e6f61%2Fipa_nomac_01.png?alt=media" alt=""><figcaption></figcaption></figure>

Give the repository a name (e.g. `KalipsoiOS`) and create it as **Private**. The same repository can be reused for all of your iOS projects.

### Create the fine-grained personal access token

Open [github.com/settings/personal-access-tokens](https://github.com/settings/personal-access-tokens) (or go to **Settings → Developer Settings → Personal access tokens → Fine-grained tokens**) and click **Generate new token**.

<figure><img src="https://1614058754-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FJ5vDGuBZwhJDeu5Rq7Wt%2Fuploads%2Fgit-blob-31090b3cfbcc32ba0a4231a86fd255e5f0ac93ed%2Fipa_nomac_02.png?alt=media" alt=""><figcaption></figcaption></figure>

Give the token a name, set the **Resource owner** that owns the repository, and under **Repository access** tick **Only select repositories** and pick the repository you just created.

Set the **Permissions**:

* **Read** access to: **Metadata**
* **Read and Write** access to: **Actions**, **Administration**, **Contents** (also called "Code"), **Secrets**, **Workflows**

<figure><img src="https://1614058754-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FJ5vDGuBZwhJDeu5Rq7Wt%2Fuploads%2Fgit-blob-0b866220c395b1ad29f4a54d568c87cdd98718a7%2Fipa_nomac_03.png?alt=media" alt=""><figcaption></figcaption></figure>

Click **Generate token**. GitHub shows the token **only once** — copy it to a secure place, you will paste it on Kalipso's **GitHub** tab in Step 4.

<figure><img src="https://1614058754-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FJ5vDGuBZwhJDeu5Rq7Wt%2Fuploads%2Fgit-blob-5a40ffcc2e1799d9de3be79f9d86523994e8fce6%2Fipa_nomac_04.png?alt=media" alt=""><figcaption></figcaption></figure>

{% hint style="warning" %}
Treat the token like a password. Anyone with it can push to your repository and trigger the signing workflow.
{% endhint %}

## Step 2 — Register the App ID on Apple Developer

{% hint style="info" %}
Steps 2 and 3 are only required if you are publishing to the **App Store**. For **Sideloading** and app builds please refer to [IPA with a Mac](/kalipso/documentation/deploy/create-ipa/ipa-with-a-mac.md).
{% endhint %}

Go to [developer.apple.com → Certificates, Identifiers & Profiles → Identifiers](https://developer.apple.com/account/resources/identifiers/list) and click the **+** button.

<figure><img src="https://1614058754-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FJ5vDGuBZwhJDeu5Rq7Wt%2Fuploads%2Fgit-blob-fa30b04c88f0df9e2558134ad8693c7c8f621991%2Fipa_nomac_05.png?alt=media" alt=""><figcaption></figcaption></figure>

Choose **App IDs** and click **Continue**.

<figure><img src="https://1614058754-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FJ5vDGuBZwhJDeu5Rq7Wt%2Fuploads%2Fgit-blob-d2b463b8b1b78f05a476fd5e15357d5788bd5dad%2Fipa_nomac_06.png?alt=media" alt=""><figcaption></figcaption></figure>

Select **App** on the next screen, then fill in:

* **Description** — a friendly name for the identifier (e.g. `BarcodeScanner`).
* **Bundle ID** — leave **Explicit** selected and paste the same **Package** value shown on Kalipso's General tab (e.g. `com.sysdev.BarcodeScanner`).

Click **Continue**, then **Register**.

<figure><img src="https://1614058754-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FJ5vDGuBZwhJDeu5Rq7Wt%2Fuploads%2Fgit-blob-b26cb4cfe12770f9d854d9e6ba551dce22b1e978%2Fipa_nomac_07.png?alt=media" alt=""><figcaption></figcaption></figure>

{% hint style="warning" %}
The Bundle ID **must match exactly** the Package shown on Kalipso's General tab. A mismatch will cause signing to fail.
{% endhint %}

## Step 3 — Create the App on App Store Connect

Go to [appstoreconnect.apple.com](https://appstoreconnect.apple.com) → **Apps**, click the **+** button and choose **New App**.

<figure><img src="https://1614058754-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FJ5vDGuBZwhJDeu5Rq7Wt%2Fuploads%2Fgit-blob-1057d26481de6552e06f6f17662705392c00d2f9%2Fipa_nomac_08.png?alt=media" alt=""><figcaption></figcaption></figure>

In the dialog:

* **Platforms** — tick **iOS**.
* **Name** — the name that will appear on the App Store.
* **Primary Language** — for example *English (U.S.)*.
* **Bundle ID** — pick the App ID you just registered.
* **SKU** — a unique internal identifier (the Bundle ID works fine).
* **User Access** — **Full Access**.

Click **Create**.

<figure><img src="https://1614058754-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FJ5vDGuBZwhJDeu5Rq7Wt%2Fuploads%2Fgit-blob-44add8dc518ccc8103278815c3c94842eb781606%2Fipa_nomac_09.png?alt=media" alt=""><figcaption></figcaption></figure>

## Step 4 — Generate the IPA in Kalipso

From the [Deploy](/kalipso/documentation/environment/ribbon/deploy.md) menu open **Create IPA**. Turn on the **Use GitHub for IPA signing** switch at the top-right — this is what enables the Mac-less flow.

### General

Fill in the IPA details (the fields are the same as in [IPA with a Mac](/kalipso/documentation/deploy/create-ipa/ipa-with-a-mac.md#general)):

* **Domain**, **Company**, **Package Name** — combine into the **Package** (bundle identifier).
* **App Title**, **Version**, **Auto increment**.
* **Deploy Type** — tick **Sideloading** and/or **Store**. If you plan to publish to the App Store, also tick **Publish on Store**.
* **Deploy Folder** — where the signed IPA will be saved.

<figure><img src="https://1614058754-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FJ5vDGuBZwhJDeu5Rq7Wt%2Fuploads%2Fgit-blob-6160e51589cb384a3c52ae77a763304a73233091%2Fipa_nomac_10.png?alt=media" alt=""><figcaption></figcaption></figure>

### Options

On the **Options** tab configure target devices (iPhone / iPad), background location, file sharing, loading image and — if the project uses Firebase push notifications — the GoogleService-info.plist file. These fields behave exactly like in [IPA with a Mac → Options](/kalipso/documentation/deploy/create-ipa/ipa-with-a-mac.md#options).

<figure><img src="https://1614058754-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FJ5vDGuBZwhJDeu5Rq7Wt%2Fuploads%2Fgit-blob-ba0b36e5df9d7215f4872be9ee3b234a46784963%2Fipa_nomac_11.png?alt=media" alt=""><figcaption></figcaption></figure>

### GitHub

On the **GitHub** tab paste the credentials you prepared in **Step 1**:

* **GitHub Token** — the fine-grained personal access token.
* **Repository** — the repository that will host the signing workflow (e.g. `KalipsoiOS`). The same repository can be reused for all your projects.

<figure><img src="https://1614058754-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FJ5vDGuBZwhJDeu5Rq7Wt%2Fuploads%2Fgit-blob-9efb3a003c5084a088dcec51c02808e3c4e27f48%2Fipa_nomac_12.png?alt=media" alt=""><figcaption></figcaption></figure>

### Apple API

The **Apple API** tab is where you provide the Apple credentials that the GitHub workflow uses to create certificates and provisioning profiles on your behalf.

* **Use Global Settings** — reuse the API key configured for the whole Kalipso installation.
* **Use Project Settings** — override the key just for this project.
* **API Key ID** and **Issuer ID** — copied from [App Store Connect → Users and Access → Integrations](https://appstoreconnect.apple.com/access/integrations/api).
* **AuthKey (.p8)** — the private key file downloaded from Apple.

{% hint style="info" %}
See [iOS USB → Apple Certificate](/kalipso/documentation/test/ios-usb.md#apple-certificate) for how to obtain the `.p8` key, the Key ID and the Issuer ID.
{% endhint %}

<figure><img src="https://1614058754-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FJ5vDGuBZwhJDeu5Rq7Wt%2Fuploads%2Fgit-blob-2f9655242913b6a20f00c53e1234379160b8b6e9%2Fipa_nomac_13.png?alt=media" alt=""><figcaption></figcaption></figure>

### Signing

Open the **Signing** tab. Two sets of credentials are needed — one for **Sideloading** (testing on your own devices) and one for **Store** (App Store distribution). If you ticked only one Deploy Type on the General tab, only that section needs to be filled in.

For each section:

* **.P12** — the distribution certificate in PKCS#12 format.
* **P12 Password** — the password used when the `.p12` was generated.
* **Mobile Provisioning Profile** — the `.mobileprovision` file that ties the certificate to your App ID.

You can select existing files or let Kalipso generate them via the Apple API key from the previous tab.

<figure><img src="https://1614058754-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FJ5vDGuBZwhJDeu5Rq7Wt%2Fuploads%2Fgit-blob-bf3a00a39cd6e67c8c704cac2109de388d39cf71%2Fipa_nomac_14.png?alt=media" alt=""><figcaption></figcaption></figure>

#### Generate P12 and **CSR**

Click the gear icon next to the `.P12` field and choose **Automatic**. \
Kalipso opens the **Generate P12** dialog:

* **Certificate Signing Request (CSR)** — Kalipso builds the CSR for you.&#x20;
* **P12 Output** — choose an **Output Folder**, give the file a **File name** (e.g. `BarcodeScanner_sideloading.p12`) and a **Password** that protects the private key.

**Generate CSR**

<figure><img src="https://1614058754-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FJ5vDGuBZwhJDeu5Rq7Wt%2Fuploads%2FB2ThMpDaPIrOit5md5T7%2Fimage.png?alt=media&amp;token=0a420ebd-d3d8-4042-ab3d-312092775340" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1614058754-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FJ5vDGuBZwhJDeu5Rq7Wt%2Fuploads%2FB0iN1zXpu3r5GmrKQOWc%2Fimage.png?alt=media&amp;token=5521f7f1-fdae-41ba-bec0-c98595be9a4d" alt=""><figcaption></figcaption></figure>

Fill in **Common Name**, **Organization** and **Country** (ISO code, e.g. PT). **Email** is optional.

Click **Generate**. Kalipso submits the CSR to Apple via the API key, downloads the resulting certificate.

<figure><img src="https://1614058754-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FJ5vDGuBZwhJDeu5Rq7Wt%2Fuploads%2FjARGL1JUQBN5Mg9A5psI%2Fimage.png?alt=media&amp;token=8b5b7c76-7c78-4a88-97f9-669676231121" alt=""><figcaption></figcaption></figure>

**Generate .p12**&#x20;

Now Select **Output Folder**, **File name** and **Password** for .p12 file and click **Generate**.&#x20;

<figure><img src="https://1614058754-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FJ5vDGuBZwhJDeu5Rq7Wt%2Fuploads%2FidHBFKKMeC0r0rabwTJ8%2Fimage.png?alt=media&amp;token=e91fa619-0b74-4d4b-9d2c-f2b0fbc77f2b" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1614058754-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FJ5vDGuBZwhJDeu5Rq7Wt%2Fuploads%2FIdhRhHnOvcxgWAfRXY9m%2Fimage.png?alt=media&amp;token=ce06272f-49fa-4b0c-b99b-b1de88d159a2" alt=""><figcaption></figcaption></figure>

Kalipso submits the CSR to Apple via the API key, downloads the resulting certificate and packages it into a `.p12`.

#### Generate Provisioning Profile

<figure><img src="https://1614058754-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FJ5vDGuBZwhJDeu5Rq7Wt%2Fuploads%2Fw6O7L5ktzPB4inMCkKRw%2Fimage.png?alt=media&amp;token=26d1d470-0434-4df9-9a79-9d9a9f239abd" alt=""><figcaption></figcaption></figure>

Click the gear icon next to **Mobile Provisioning Profile**. Pick an **Output Folder** and a **File name** for the `.mobileprovision` file and click **Generate**. Kalipso creates the profile on Apple, tying your App ID to the certificate you just generated.

<figure><img src="https://1614058754-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FJ5vDGuBZwhJDeu5Rq7Wt%2Fuploads%2Fgit-blob-f70227d3662123758ea06dd77c187c67c771d260%2Fipa_nomac_16.png?alt=media" alt=""><figcaption></figcaption></figure>

Repeat both steps for the **Store** section if you ticked **Store** on the General tab. When both are done the Signing tab is fully populated and Kalipso displays the expiry date of each `.p12`.

<figure><img src="https://1614058754-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FJ5vDGuBZwhJDeu5Rq7Wt%2Fuploads%2Fgit-blob-1466680cc067492ea9a6f89db542588d274a63e4%2Fipa_nomac_17.png?alt=media" alt=""><figcaption></figcaption></figure>

{% hint style="info" %}
Apple limits the number of active iOS Distribution certificates. If signing fails with a *certificate limit reached* error, revoke one old certificate on [Certificates, Identifiers & Profiles](https://developer.apple.com/account/resources/certificates/list) and click **Generate** again.
{% endhint %}

### Localization

On the **Localization** tab, turn **Set Languages** on and tick the languages your app supports. These are the languages advertised on the App Store listing.

Languages are not mandatory — if you leave the toggle off, Apple will rely on the metadata set in App Store Connect.

<figure><img src="https://1614058754-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FJ5vDGuBZwhJDeu5Rq7Wt%2Fuploads%2Fgit-blob-ca634f094220b28864881f47eeaa6d6a1e5c0838%2Fipa_nomac_18.png?alt=media" alt=""><figcaption></figcaption></figure>

### Usage Description

On the **Usage Description** tab, provide a short sentence for every system capability the app uses — Apple rejects builds that request a permission without a usage description.

* **Camera**, **Location**, **Microphone**, **Motion Sensor**, **Photo Library**, **Bluetooth**, **Speech Recognition**

Fill in the **Default** column (fallback language). If you enabled multiple languages on the previous tab, provide translations in the other tabs on the left.

<figure><img src="https://1614058754-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FJ5vDGuBZwhJDeu5Rq7Wt%2Fuploads%2Fgit-blob-9efa4e2793cf289c56fa40182325aafccb28a035%2Fipa_nomac_19.png?alt=media" alt=""><figcaption></figcaption></figure>

## Step 5 — Generate

Click **Generate**. Kalipso pushes the project to the GitHub repository, which runs the signing workflow using your Apple API key. When the workflow finishes, the signed IPA is downloaded to your **Deploy Folder**.

If you ticked **Publish on Store** on the General tab, the workflow also uploads the `.ipa` to App Store Connect using the same Apple API key — the build then appears in **TestFlight** / **App Store Connect** ready to be submitted for review. No Mac, no Xcode, no Transporter required.

<figure><img src="https://1614058754-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FJ5vDGuBZwhJDeu5Rq7Wt%2Fuploads%2FF1HRmN9h0o8zZWvHuCVZ%2Fv7QLBnq0bs.png?alt=media&amp;token=6c36d0a2-74c9-4187-abd6-1faab5376eb9" alt=""><figcaption></figcaption></figure>