Which identifier should I use?

I general, I recommend that you enable automatic code signing in Xcode and it’ll take care of all this for you. However, let’s assume you want to take the hard road, in which case the answer is…

Probably all three. That is, each app-like think has its own App ID and thus needs its own provisioning profile.

That’s certainly true on iOS and its child platforms. On macOS an app-like thing only needs a provisioning profile if it uses restricted entitlements, as defined in TN3125 Inside Code Signing: Provisioning Profiles. So, you might be able to skip this step in your Finder extension and you helper.

For the app itself, it always needs restricted entitlements if you’re going to use TestFlight, and you should always use TestFlight (-: See TestFlight, Provisioning Profiles, and the Mac App Store.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"