Hi thank you so much. I appreciate the clarification. You helped me to understand that the Xcode error is misleading. I'll update the original post with all my findings and solutions.

Solution Summary: To build using EAS build, we need an "Apple Distribution Certificate", but EAS's credentials tool creates an "iOS Distribution Certificate". Therefor what is needed is to create the distribution cert on Apple Dev portal, download the .cer file from there, add it to your OSX keychain, then export to .p12 with a password.

Then when using EAS build, you will choose: > eas build --profile production --platform ios --local ... ... Generate a new Apple Distribution Certificate? … no Path to P12 file: … /path/to/your.p12 P12 password: … *the password your exported to .p12 with* Would you like to reuse the original profile? … no Generate a new Apple Provisioning Profile? … yes During the build process, OSX should prompt you for your OSX login chain pw (Your OSX pw, not the .p12 export password) a few times.

As for the keychain-access-groups entitlement, even though XCode complains as follows: Provisioning profile doesn't include the com.apple.developer.keychain-access-groups entitlement. The XCode error is misleading, and you should assume it is adding com.apple.developer. as a prefix to what it really wants in your entitlements file.

So, set your Expo plugin as follows: const withKeychainSharing: ConfigPlugin = (config) => { if (!config.ios) config.ios = {}; if (!config.ios.entitlements) config.ios.entitlements = {}; // Example group: using $(AppIdentifierPrefix) plus your Bundle ID config.ios.entitlements["keychain-access-groups"] = [ "$(AppIdentifierPrefix)com.my.app", ]; return config; };