Authentication
Sign in to Apple Developer Services with an Apple ID or an App Store Connect API key.
xcross auth saves the credentials xcross uses to talk to Apple’s Developer Services - certificates, device registration, and provisioning profiles. Pick one of two methods.
Apple ID
xcross auth --apple-id you@example.comA free Apple account works; you do not need a paid Apple Developer Program membership. If you omit --apple-id, xcross prompts for it interactively.
| Flag | Purpose |
|---|---|
--apple-id <email> | Apple ID to sign in with. Prompted if omitted. |
--password <password> | Apple ID password. Prompted (hidden) if omitted. |
--adi-library-dir <path> | Directory containing libCoreADI.so and libstoreservicescore.so. Defaults to the adi-libs directory next to xcross’s config file. Apple ID login only. |
The command prompts for your password and a 2FA code, performs the login handshake locally, and stores only the resulting Developer Services session - never your password. If the account has more than one active Developer Services team, xcross lists them and asks which one to use.
ADI machine attestation
Apple’s login flow requires machine attestation data (“anisette”), which xcross produces using the Android libCoreADI.so and libstoreservicescore.so libraries:
- Windows x64 / Linux x86_64 - the matching libraries are downloaded automatically from the Apple Music APK into
%APPDATA%\xcross\adi-libs(Windows) or~/.config/xcross/adi-libs(Linux) the first time you sign in. - Other architectures - extract the matching APK slice yourself and point xcross at it with
--adi-library-dir <path>.
App Store Connect API key
xcross auth --issuer-id <uuid> --key-id <id> --private-key /path/to/AuthKey.p8| Flag | Where it comes from |
|---|---|
--issuer-id <uuid> | The “Issuer ID” shown at the top of the Keys page in App Store Connect (one per team). |
--key-id <id> | The key’s “Key ID”, shown next to it on the same page. |
--private-key <path> | Path to the AuthKey_<keyId>.p8 file you downloaded when creating the key. |
Provide all three flags together; xcross treats them as an alternative to Apple ID login, not a supplement to it.
Choosing a method
Both methods authorize the same Developer Services access.
| Apple ID | App Store Connect API key | |
|---|---|---|
| Account type | Free Apple account works | Requires an App Store Connect key |
| Interactive prompts | Password + 2FA code | None once the key file exists |
| Good for | Local development | CI and scripted setups |
You cannot pass Apple ID flags and API key flags in the same xcross auth call, and --adi-library-dir is rejected alongside the API key flags.
Saving a new API key clears any previously saved Apple ID session, so the key is what xcross uses afterwards. The other direction is not symmetric: signing in with an Apple ID leaves a saved API key on disk, and a valid Apple ID session always wins over it. API keys are only consulted when there is no saved Apple ID session at all.
NoteSecurity: xcross auth never stores your Apple ID password. For Apple ID login it persists only the resulting Developer Services session token; for API keys it stores the issuer ID, key ID, and the path to your .p8 file.
Next steps
- Darwin SDK - extract the iOS SDK from your Xcode archive
- Quick start - use your saved credentials in a full run
- Troubleshooting - fix 2FA or ADI library failures