Kevin's Guide to DEXT Signing The question of "How do I sign a DEXT" comes up a lot, so this post is my attempt to describe both what the issues are and the best current solutions are. So... The Problems: When DEXTs were originally introduced, the recommended development signing process required disabling SIP and local signing. There is a newer, much simpler process that's built on Xcode's integrated code-signing support; however, that newer process has not yet been integrated into the documentation library. In addition, while the older flow still works, many of the details it describes are no longer correct due to changes to Xcode and the developer portal. DriverKit's use of individually customized entitlements is different than the other entitlements on our platform, and Xcode's support for it is somewhat incomplete and buggy. The situation has improved considerably over time, particularly from Xcode 15 and Xcode 16, but there are still issues that are not fully resolved. To address #1, we introduced "development" entitlement variants of all DriverKit entitlements. These entitlement variants are ONLY available in development-signed builds, but they're available on all paid developer accounts without any special approval. They also allow a DEXT to match against any hardware, greatly simplifying working with development or prototype hardware which may not match the configuration of a final product. Unfortunately, this also means that DEXT developers will always have at least two entitlement variants (the public development variant and the "private" approved entitlement), which is what then causes the problem I mentioned in #2. The Automatic Solution: If you're using Xcode 16 or above, then Xcode's Automatic code sign support will work all DEXT Families, with the exception of distribution signing the PCI and USB Families. For completeness, here is how that Automatic flow should work: Change the code signing configuration to "Automatic". Add the capability using Xcode. (USB & PCI) Edit your Entitlement.plist to include the correct "Development Only" configuration: USB Development Only Configuration: <key>com.apple.developer.driverkit.transport.usb</key> <array> <dict> <key>idVendor</key> <string>*</string> </dict> </array> PCI Development Only Configuration: <key>com.apple.developer.driverkit.transport.pci</key> <array> <dict> <key>IOPCIPrimaryMatch</key> <string>0xFFFFFFFF&amp;0x00000000</string> </dict> </array> If you've been approved for one of these entitlements, the one oddity you'll see is that adding your approved capability will add both the approved AND the development variant, while deleting either will delete both. This is a visual side effect of #2 above; however, aside from the exception described below, it can be ignored. Similarly, you can sign distribution builds by creating a build archive and then exporting the build using the standard Xcode flow. Debugging Automatic Code-signing In a new project, the flow I describe above should just work; however, if you're converting an existing project, you may get code signing errors, generally complaining about how the provisioning profile configuration doesn't match. In most cases, this happens because Xcode is choosing to reuse a previously downloaded profile with an older configuration instead of generating a new configuration which would then include the configuration changes you made. Currently, you can find these profile files in: ~/Library/Developer/Xcode/UserData/Provisioning Profiles ...which can make it easier to find and delete the specific profile (if you choose). However, one recommendation I'd have here is to not treat the contents of that folder as "precious" or special. What automatic code signing actually does is generate provisioning profiles "on demand", so if you delete an automatic profile... Xcode will just generate it again at the next build. Manually generating profiles is more cumbersome, but the solution there is to preserve them as a separate resource, probably as part of your project data, NOT to just "lose" them in the folder here. If they get deleted from Xcode's store, then you can just copy them back in from your own store (or using Xcode, which can manually download profiles as well). The advantage of this approach is that when profiles "pile up" over time (which they tend to do), you can just delete[1] all of them then let Xcode regenerate the ones you're actually trying to investigate. In terms of looking at their contents, TN3125: Inside Code Signing: Provisioning Profiles has the details of how to see exactly what's there. [1] Moving them somewhere else works too, but could indicate a fear of commitment. __ Kevin Elliott DTS Engineer, CoreOS/Hardware

I have not seen a clear answer about this: https://developer.apple.com/forums/thread/776657 https://developer.apple.com/forums/thread/743639?answerId=775701022#775701022 Thus, I would like to pose: Is there any way to install a DriverKit extension locally for development and testing using a free developer account, or is development of DriverKit extensions gated behind a paid developer account? Thank you!

I'm developing a low-latency USB audio-MIDI driver using AudioDriverKit and USBDriverKit for macOS and iPadOS. I've observed occasional delays in USB completion callbacks. The manufacturer's official macOS driver uses IOUSBHost to queue longer isochronous transfers and update their mapped OUT buffers as audio samples become available. I've reviewed the relevant IOKit and IOUSBHost documentation, but haven't established whether USBDriverKit supports an equivalent approach. Does USBDriverKit permit modifying portions of a CreateIOBuffer OUT buffer while an IsochIO request is still pending, specifically to supply audio for future USB frames? If so, what synchronization requirements and controller-prefetch guarantees determine the latest safe time to update those regions? If this isn't supported, is there a recommended alternative for maintaining low-latency isochronous audio despite delayed completion callbacks? Thanks.

Could someone help expedite our pending DriverKit USB distribution review request? Our driver works under development signing, but approval is blocking a TestFlight pilot for our accessibility product. Request: 8AR5R3NKZD Submitted October 18, 2026 (still "Submitted") Team: 7U9T57JPF7 Capability: DriverKit USB Transport – VendorID USB: VID 6790 (0x1A86), PID 29987 (0x7523) Support case: 103013236358 Thank you!

I'm developing a native macOS menu-bar utility that aims to toggle USB power to an iPhone connected directly to a MacBook Pro. Hardware: MacBook Pro with M2 Pro iPhone 13 connected via USB-C to Lightning No external hubs or adapters Goal: I want to temporarily stop the iPhone from charging without physically disconnecting the cable, then restore charging programmatically. Losing the USB data connection while power is disabled is completely acceptable. What I've investigated: uhubctl doesn't expose the built-in USB-C ports as controllable in my setup. IOKit and USBDriverKit provide USB device management, but I haven't found a supported method to disable physical VBUS. I found IOUSBHostCIMessageTypePortPowerOff, but it appears to relate to host-controller interfaces rather than controlling Apple's existing USB-C hardware. My questions: Is there any supported API or system-level mechanism for disabling VBUS on a MacBook's built-in USB-C port? Can the USB-C Power Delivery controller be instructed to stop supplying power without physically disconnecting the device? Alternatively, is there a supported mechanism for requesting that a connected iPhone temporarily stop drawing charging current? I'm open to lower-level macOS development if necessary, but I'd like to understand whether this is technically possible before pursuing it. Any insight from Apple engineers or developers familiar with Apple Silicon USB controllers would be greatly appreciated.

I have requested two entitlements for my driver: "DriverKit USB Transport - VendorID" and "DriverKit UserClient Access" I have submitted them in Sep 20, and got no response or ETA on it. It's the only thing blocking the release of my driver. Request ID: C9ULM24X2U Team: F34U2UUGXX Status: Submitted What can I do to expedite this?

Hello, We submitted five DriverKit USB Transport vendor-ID requests on 7 October for team D4D9H4M2H2 . All five still show Submitted. USB Vendor IDs (with Request IDs): 0x302C (12332), R6QKXJ65H4 0x04B8 (1208), 659D7XL6U6 0x0519 (1305), B7C5WY7LCW 0x1504 (5380), P93M2A5Y9D 0x0FE6 (4070), QG88Z375YC We have requested vendor IDs on this entitlement before and they typically came back within about a week, so 20 days is unusual for us. We are not looking to rush anyone; we would just like some insight into where these sit so we can plan our release schedule accordingly. Thanks! Jesse

Hey, We are developing a dext that would like to match with all USB devices, no matter the vendor. We use VendorID = * in the plist of the Dext to help achieve this when running it locally without entitlements. I know that the transport.usb entitlement requires a list of Vendor id's, but is it possible to receive an entitlement which is suitable for all VID's? Kind of like this: <key>com.apple.developer.driverkit.transport.usb</key> <array> <dict> <key>idVendor</key> <string>*</string> </dict> </array> Thanks

Dear Apple Developer Support Team, I am reaching out for assistance with two pending DriverKit entitlement requests. This is my first experience developing an application within Apple's ecosystem, and I recognize that my use case is somewhat unconventional. I may not have reached the appropriate support channel, so I would appreciate your guidance or assistance in directing this request to the correct team. We are currently evaluating the feasibility of adopting iPads for an internal enterprise application that communicates with our proprietary USB devices. These devices use the standard USB Communications Device Class (CDC), exposing a virtual serial port (UART). They work reliably on Windows, Linux, and macOS. To my surprise, I discovered that iPadOS does not provide general-purpose access to standard USB CDC serial devices. Based on my research, the recommended approach appears to be implementing a custom driver using DriverKit. We also use macOS as our primary development and debugging environment, so we would like to maintain a consistent DriverKit-based implementation across both platforms in macOS only for development. On September 30, 2026, I submitted the following entitlement requests: 1. Request GW966578ZB — DriverKit UserClient Access Requested entitlement: com.apple.developer.driverkit.userclient-access 2. Request 3HN2GMDFN5 — DriverKit / USB Transport Distribution Authorization Requested entitlements: com.apple.developer.driverkit com.apple.developer.driverkit.transport.usb Unfortunately, I have not received any response or status update on either request in the three weeks since submission. At this stage, our work is strictly a proof of concept (POC). We are not requesting public distribution or App Store publication. Our immediate objective is to validate the technical feasibility of communicating with our USB devices from iPadOS before committing to Apple's platform for our enterprise solution. The lack of progress on these requests has effectively blocked our evaluation for three weeks, making it difficult to assess whether iPadOS is a viable platform for our intended use case. Apple Developer Team ID: R4PSRJ28G7 We are genuinely interested in adopting Apple's technology for our enterprise operations, but we need to establish technical feasibility before proceeding. I would appreciate any guidance that could help us move forward. Best regards,Alon Bar-Lev

Hi, Any idea about the timeline for approval? It's been sitting at submit for 8+ weeks. Email support will not help. Claiming no ETA and it's a separate team that reviews that. I've requested a few as initially had some mistake on submission. Here's one of it: Request ID: R7P34F4338 Team ID: H2SLQH5546 If this forum post can help escalate, that would be appreciated.

Hello, We submitted DriverKit entitlement request B5DLZTL8UM on 26 September 2026, and it still shows "Submitted". App: Cekrekin, an iPad photobooth app on the App Store Driver extension: com.cekrekin.photobooth.ios.PrinterDriver Requested: DriverKit and DriverKit USB Transport for vendor ID 4931 (0x1343), for the DNP DS-RX1 / DS-RX1HS dye-sublimation photo printer (product 0x0005). Only our own app opens the dext; other apps do not need user-client access. The driver works with development signing. On an iPad Air (M1) running iPadOS 27.0.1, it connects to the printer, reads its status, and prints. DNP provides no iPadOS driver, so our customers (photobooth operators) need this to print from an iPad over USB. We are also filing a Code-level Support request with a focused test project. Is there anything else we should provide to move the request forward? Thank you.

Hello, we're building a DriverKit USB driver for iPadOS (M-series iPads) that lets our photo booth app BoothDock Studio print directly to DNP dye-sublimation photo printers over USB-C. These printers have no AirPrint, and the manufacturer offers no iPadOS driver. With development signing everything already works end to end on an iPad Pro (M2) with a DNP QW410: the driver matches, the app talks to it through a user client, and prints come out. For App Store distribution, the App Store provisioning profile for the driver (eu.boothdock.studio.printerdriver) doesn't contain any DriverKit entitlements, so the export fails. We submitted entitlement requests on September 28 (8BRDTKT583) and October 16 (J33U28AA4D, USB Transport for vendor IDs 5202/4931/3350 plus UserClient Access). Both are still in status "Submitted". We also opened developer support case 102998974118. Is there anything else we should provide, or a way to get these requests reviewed? Any hint is appreciated. Thanks!

I have created a USB filter using Mac DriverKit, but the filter is unable to retrieve configuration information during startup. After the USB filter has started and registered the service, my app can send the configuration information to the filter. Therefore, I would like to know if there is a way to exit the USB filter and allow the system to take control of the USB device once the filter has exited. I have tried calling Terminate(0), but it did not work as even after the USB filter exited, the Finder still couldn't display the USB device.

Hello, I have requested entitlements for my DriverKit-based driver, but the status has been "Submitted" since May 24, 2026. Below are the details of my request. Is there any way to expedite the process, as these entitlements are necessary for distributing the app? Also, what is the preferable way to follow up in such cases? Entitlements: DriverKit USB Transport - VendorID (0x0BDA), DriverKit UserClient Access Team: K89F9CL4ZU Request Id: 7W5RQ3D2X6 Requested At: May 24, 2026 Type: Team Status: Submitted Many thanks

I have developed a Driverkit extension which matches for iPadOS which is bundled within my app. My driver contains two different personalities - one with provider as USBDriverKit (USB3) and the other as PCIDriverKit (USB4). When enabled, the driver matches/loads, initiates the class with the right personality based on whether the device it matches is operating in USB3/USB4 and works as intended. Recently, we have come across an issue when operating in USB4 and below are the steps to reproduce. Platform: iPadOS 17 (Issue not observed following the same steps in iPadOS 18 and higher, though cannot be full sure as I have tested only in some versions of 18, 26 and 27). Tested in iPad having a USB-4 compatible port. Steps to reproduce: Install the app. This provides an option to enable the driver which comes with it from the app's system settings. Enable the driver from settings. Connect a device which is compatible with the driver in USB4 so that the specific personality can be loaded. Verify the same. With the driver still loaded, uninstall the application. On uninstallation, ideally, Apple's inbox IONVMeController should match on the re-enumeration and get loaded without a re-plug being required. However, this is not the case as the port becomes unresponsive. Even after a re-plug of the device, it still does not get detected by the iPad itself. This is specifically when I try to connect the device in USB 4 as this specific driver personality matches only in this case. If I try the same steps as above or try to connect the same device in USB3 after this issue has occured, the device gets detected and works as intended. To make the port to be usable again in USB4, a restart of the iPad has to be performed. Has this been observed before with PCIDriverKit or DriverKit in general? Is this some kind of a known limitation in iPadOS 17 in particular or does this have something to do with the iPad model too? Is there any workaround that can be followed to prevent this from happening?

Hello, On July 30, 2026 we submitted a DriverKit USB Transport - VendorID capability request for our iPadOS driver extension. The request ID is 83H9997N3G, team ID W33S637JJQ. Eight weeks later it still shows "Submitted". Developer Support (case 20000135736763) told us a separate team handles these requests and will contact us. We have not heard from that team yet. The driver works with development signing. Without the distribution entitlement we cannot upload a build to TestFlight. Is there anything else we should provide, or a way to find out where the request is in the queue? Thanks, Stepan

I'm asking about how to ask for an addition to a managed entitlement, where we already have a grant of that entitlement (with a different value) and we already have other managed entitlements granted. This post https://developer.apple.com/forums/thread/789176 tells me I can request entitlements at the Requests tab here: https://developer.apple.com/account/resources/, which leads me to this form: https://developer.apple.com/contact/request/system-extension/ The form URL doesn't specify a particular App Identifier, but is the Identifier implied with this form submission? Or, put another way, is the entitlement we're asking for attached only to the Team ID, or also to the bundle ID of the app which is going to use the entitlement? So if I made another app which talks to my dext, I'd have to ask again for userclient-access to the same dext, but from a different bundle ID? The form says "Which DriverKit entitlements do you need" and "select all that apply", but I'm unclear about whether I need to request ALL the DriverKit entitlements we need for all our apps, or only for the specific App Identifier I reached this form from. It also isn't clear if I need to check both the USB Transport and the UserClient Access boxes in my case. We already have UserClient Access granted for at least one bundle ID, and I want to add another. We already have USB. Transport granted for two different vendor IDs. Do I need to mention that in my request here, and also check the USB Transport box, although I'm not requesting any new vendor ID values? I don't want to end up with new profiles which break new builds of existing apps which were relying on previously-granted entitlements that are now missing from the newly-generated profiles. Here: https://developer.apple.com/forums/thread/822652 user JackLongbow submitted a request for UserClient Access for two bundle IDs, presumably in the form of a simple two-line string like this: com.turing.TuringTouch com.turing.TuringTouch.TouchDriver but the resulting provisioning profile was malformed, it contained this value under com.apple.developer.driverkit.userclient-access <string>com.turing.TuringTouch com.turing.TuringTouch.TouchDriver</string> the Forum post said that the approved entitlement looks like this: <array> <string>com.turing.TuringTouch</string> <string>com.turing.TuringTouch.TouchDriver</string> <string>com.turing.TuringTouchDriver</string> <string>com.turing.virtualpad</string> <string>com.turingdraw.DigidrawTouch.DigidrawDriver</string> </array> Should I be formatting my request as above, as a chunk of xml, or is a plain text list of bundle IDs, one per line, acceptable? Is there a way for us to get a summary of all the managed entitlements already granted to our team? At present, it seems like I have to pick a particular profile, download it, and QuickLook at it - but not all profiles contain all entitlements, just as apps don't have to claim all the entitlements the profile offers .

Please can someone bump my support request which has been pending for 1 month. It is for DriverKit access. Thanks

We have a complete iPadOS DriverKit USB extension for a Stripe Reader M2 (USB-C, M-series iPad). Development builds sign and run. We cannot ship Ad Hoc, App Store, or Enterprise builds because the distribution DriverKit entitlements are either not granted or not present in the provisioning profile Apple generates. Stripe’s iOS USB instructions say to request the entitlement at developer.apple.com/system-extensions: select HID and USB Transport, and enter USB vendor ID 11369. Platform is iPadOS. The extension also needs com.apple.developer.driverkit. The host app uses com.apple.developer.driverkit.communicates-with-drivers. We have two teams. The driver bundle ID is prefixed with the host app bundle ID and signed with the same team. Inc — Team ID HPL6Q4V5TF (Development, Ad Hoc, App Store) Host app Driver extension com.atxinnovation.union.development com.atxinnovation.union.development.usbDriver com.atxinnovation.union.qa com.atxinnovation.union.qa.usbDriver com.atxinnovation.union.production com.atxinnovation.union.production.usbDriver These are not granted. Latest submission is system-extensions request 39WL64S3LR (September 3, 2026). That form has no status page, and we have received no email. LLC — Team ID 3MAPQA4NZ6 (Enterprise in-house) Host app Driver extension com.atxinnovation.union.enterprise com.atxinnovation.union.enterprise.usbDriver Capability request ACL9VQ3BA4. The portal shows DriverKit and DriverKit USB Transport – VendorID granted and enabled on com.atxinnovation.union.enterprise.usbDriver. The Universal Distribution profile POS Prod USB Driver (platform iOS, active, expires 2027/01/22, UUID a3627c1e-451d-4d62-b871-1cb6fe21431e, created 2026-09-02 16:05:20 UTC) lists those capabilities as enabled on the Review Provisioning Profile page. The downloaded profile does not contain them. Decoding it yields only: application-identifier com.apple.developer.team-identifier get-task-allow keychain-access-groups The string driverkit does not appear in the profile. We regenerated it five times, including deleting and recreating the profile, with the same result. DriverKit development profiles for the corresponding development App ID do contain com.apple.developer.driverkit and com.apple.developer.driverkit.transport.usb. Xcode then fails the archive: Provisioning profile "POS Prod USB Driver" doesn't include the com.apple.developer.driverkit entitlement. We also do not know which idVendor values the VendorID grant assigned. The extension must match them exactly. We need 11369. What we already tried July 30: Account Holder submitted DriverKit and DriverKit USB Transport for both teams through the system-extension Contact Us form. No confirmation email. That form does not collect bundle IDs. Those July requests later showed up on the host App ID com.atxinnovation.union.enterprise, not on the usbDriver App IDs. August 12: Resubmitted on each usbDriver App ID under Certificates, Identifiers & Profiles → Capability Requests. Enterprise request ACL9VQ3BA4. August 27: Developer Support case 20000149322724. The reply pointed us back at the capability status page. September 2: Enterprise grant appeared. Enabling it on the App ID and regenerating the distribution profile still produced a profile with no DriverKit entitlements. Developer Support case 102951939894. No resolution. September 3: Resubmitted the Inc team via the system-extensions form (39WL64S3LR). The form would not accept another LLC submission because that App ID is already granted. No status since. What we are Requesting Grant DriverKit, HID, and USB Transport (vendor ID 11369) for iPadOS — Development, Ad Hoc, and App Store — on the three Inc driver App IDs above. Assistance debugging the issue of failing to embed the already-granted DriverKit entitlements in the LLC Enterprise distribution profile for com.atxinnovation.union.enterprise.usbDriver, and confirmation of the assigned idVendor values.

I am developing an independent macOS compatibility driver for the Avid/Digidesign Eleven Rack, an EOL USB audio device that does not have an Apple-silicon-compatible OEM driver. The existing hardware identifies as: Vendor ID: 0x0DBA — Digidesign/Avid Product ID: 0xB011 — Eleven Rack Transport: USB 2.0 high-speed isochronous audio The proposed implementation uses AudioDriverKit and USBDriverKit. It consists of a DriverKit system extension packaged inside a macOS control application. The USB entitlement would be restricted to this exact VID/PID. I am an independent developer and do not own the Digidesign/Avid VID. I am not manufacturing hardware or attempting to use that VID for a new USB product. The driver would only match existing Eleven Rack devices. The implementation is independently written for interoperability, and no Avid executable code would be included. I currently have a working direct user-space USB proof of concept, but I cannot properly activate and test the AudioDriverKit extension with SIP enabled without the required entitlements. Before enrolling in the paid Apple Developer Program, I would appreciate clarification on the following: Does Apple consider DriverKit development and distribution entitlement requests from independent developers supporting existing EOL hardware when the developer does not own the device’s VID? Is written authorization from the VID owner always required, or are these requests evaluated individually? Would restricting the USB transport entitlement to the exact 0x0DBA:0xB011 device affect eligibility? Is there a way to obtain an initial eligibility determination before purchasing Apple Developer Program membership? The anticipated entitlements are: com.apple.developer.driverkit com.apple.developer.driverkit.family.audio com.apple.developer.driverkit.transport.usb com.apple.developer.system-extension.install for the host application Restricted user-client access between the host application and driver I understand that the forum cannot grant an entitlement. I am trying to determine the appropriate process and whether manufacturer authorization is a prerequisite before submitting a formal request.