I am integrating Declared Age Range into the initial release of an all-ages iPhone utility with an iOS 17 deployment target. It stores user-created records only on the device and has no app accounts, backend, in-app purchases, subscriptions or remotely accessible data. The planned distribution includes the United States. On iOS 26.4 and later, the planned implementation checks AgeRangeService.shared.requiredRegulatoryFeatures and requests a range when .declaredAgeRangeRequired is present. On iOS 26.2–26.3, it uses isEligibleForAgeFeatures. Returned age information would be used transiently on-device, without persistence or export. A requested boundary of 18 would not restrict this all-ages app to adults. Two technical points remain unclear: The current Q&A says existing Apple Accounts on iOS/iPadOS 18 or earlier are unaffected. What supported fallback should an app use for affected new accounts on older supported versions, including iOS 26.0–26.1 without the eligibility property? When a required eligibility or age-range request temporarily fails, is there documented guidance for the access/retry behavior of an all-ages app? The documented notAvailable outcome can represent refusal or unavailability; the implementation should not misreport either as a completed check. The Q&A says Apple prevents app launch after parental consent revocation and also directs developers to RESCIND_CONSENT App Store Server Notifications V2. For a utility with no server, app account or remote data/access to revoke, is any additional client action or notification endpoint required? If so, what technical mechanism should connect that action to the fully local installation? I am seeking the documented API and system behavior, not a determination of legal compliance. References: Age assurance Q&A Update for apps distributed in Texas Requesting an age range

iOS 27, See image below. From top to bottom I'm using: displayName containerDisplayName contentDescription I haven't found a way to remove the transaction amount from my containerDisplayName and display it in the top right with some other CSSearchableItemAttributeSet value. Is it even possible?

Hello, I've been following the Background Assets documentation, and so far everything has worked. However, when I attempt to archive my asset pack in Terminal, I receive the following error: Error: Reading the contents of the file at “Manifest.json” failed. I've double checked the provided instructions, tried archiving in different directories, and tried every permutation of Manifest.json I could think to try. Same error every time. Here's my Manifest.json code in case the issue is there. Thanks in advance! "assetPackID": "classic", "downloadPolicy": { "essential": { "installationEventTypes": [ "firstInstallation" ] } }, "fileSelectors": [ { "directory": "audio" }, ], "platforms": ["tvOS"] }

Hi all, From what I’ve seen on forums and other sources, it appears that nothing can be done to set the contact poster programmatically. Setting the imageData property affects only the thumbnail image. Does anyone know if this is explicitly documented somewhere? I need this information for a POC document. I watched the iOS 17 keynote (where it was introduced), the Platform State of Union, and other WWDC videos, but I couldn’t find any mention of it. The Contacts framework documentation only explains what can be retrieved from this property and doesn’t mention any way to set the contact poster. If anyone has any information on this, please help! Thanks in advance!

Hi, As a company, we have several apps in the AppStore that contain AppClips. With the latest iOS18 it works without any problems. With all iOS26 betas so far, however, there is always the problem “ASDErrorDomain- Error 507” and the AppClip cannot be opened. You can easily test this by scanning the following QR code with the system camera: You only ever get this error instead of the option to open the AppClip. As the iOS26 beta phase is already at an advanced stage, we are naturally concerned as to whether the problem will be solved.

I'm building a custom keyboard extension that offers voice dictation. Because keyboard extensions are constrained (memory cap ~30–48 MB, restricted audio session access), I delegate recording to my container app: User in a host app (e.g., Safari) taps the mic in my keyboard extension. The keyboard calls extensionContext.open(URL("myapp://dictation")) to launch the container app. The container app records audio via AVAudioEngine + SFSpeechRecognizer, writes the final transcript to the App Group, and signals completion via a Darwin notification. 4. The user is expected to be returned to the original host app (Safari) automatically so they can keep typing. The problem (step 4): On iOS 26.4 I can no longer identify which app was the host. Every previously-known path returns nil for the keyboard extension's host: parent.value(forKey: "_hostBundleID") → returns the literal string parent.value(forKey: "_hostApplicationBundleIdentifier") → returns NSNull xpc_connection_copy_bundle_id on the underlying XPC connection (via PKService.defaultService.personalities[…]) → returns NULL NSXPCConnection.processBundleIdentifier on extensionContext._extensionHostProxy._connection → returns nil proc_pidpath(hostPID, …) → EPERM from the keyboard sandbox LSApplicationWorkspace.frontmostApplication → selector unavailable from the extension RBSProcessHandle.handleForIdentifier:error: → returns an RBSServiceErrorDomain error Without the host's bundle ID, the container app has no way to call LSApplicationWorkspace.openApplicationWithBundleID: (the technique that worked on iOS 25 and earlier). UIApplication.suspend() correctly sends the container to background, but iOS treats us as a "fresh launch" — it returns the user to the Home Screen instead of Safari, because the container app was launched by an extension, not directly by Safari. KeyboardKit's maintainer reached the same conclusion (issue #1014) and shipped 10.4 without the feature. My questions: Is there a public, App-Store-safe API in iOS 26+ for a custom keyboard extension to identify its host application, or for the container app (launched via the extension's openURL) to identify which app initially hosted the extension that opened it? UIOpenURLContext.options.sourceApplication reports the extension's own container, not the actual host. 2. Is there a public mechanism for "return to source app" when the container app was launched by an extension's openURL? Equivalent to the ← Source affordance iOS shows for normal inter-app openURL, but triggered programmatically by the launched app. 3. Some popular keyboards (e.g., 微信输入法 / WeChat Keyboard) still appear to round-trip through their container app on iOS 26.4 and return the user to the original host — including the iOS ← WeChat back affordance in the host's status bar afterward. What's the recommended approach to achieve this? If it requires a specific scene-activation flow, NSUserActivity pattern, or extension-context configuration, please point at the relevant docs. 4. If there is no public path today, is FB22247647 (or a related radar) the right place to track this? Should developers in this position migrate to in-extension audio capture (which has its own significant constraints in keyboard extensions)? I'd much rather not rely on private APIs. Concrete guidance — or even an acknowledgment of which direction Apple intends — would help thousands of custom-keyboard developers who currently have a degraded voice-input experience on iOS 26.4+. Tested on iPhone 12 Pro Max running iOS 26.4.2 (build 23E261), Xcode 26.x, Swift 5. Thanks!

Hi, In the calendar app I created an event called E1 on an iCloud calendar and noticed 2 entries, so I suspect EKEventStore.events(matching:) returned it. Note: I am not referring to recurring events. Used an iCloud calendar Question Is it possible EKEventStore.events(matching:) to return duplicate events? When I did search the following was reported by AI, but I am not very sure, so hence the question. The EKEventStore.events(matching:) method returning duplicate events is a well-known, expected behavior in EventKit. It typically happens because a single event exists across multiple calendars, has multiple participants/invitees, or EventKit is fetching the event from different sync sources (like iCloud and a local cache) simultaneously.

Summary: When our VoIP app attempts to reject/end an incoming call, CXCallController.request(_:completion:) fails with: Error Domain=com.apple.CallKit.error.requesttransaction Code=4 "(null)" CXErrorCodeRequestTransactionError, Code 4 = unknownCallUUID — the call UUID did not match a call known to the call kit. As a result, the Incoming call screen continue to displayed and leaving a stale/ghost call in CallKit. Environment: iOS version: 26 / 18 Device model: iPhone 14 Steps to Reproduce: Receive an incoming VoIP call (reported to CallKit via CXProvider.reportNewIncomingCall). Reject the call programmatically OR manual end call Observe: app-side call state transitions to ended/rejected, but the native CallKit call UI/state does not clear — CXEndCallAction request fails with unknownCallUUID. [fill in: reproduction rate — always / intermittent / specific timing window] Full error log: 2026-08-13T13:41:16:902+0530 Thread 915 — [CallKitManager requestTransaction:]_block_invoke: Error requesting transaction: [<CXTransaction 0x14f1eb060 UUID=E1785E55-24CF-49E6-8225-372E7F5F0F9D isComplete=0 actions=( "<CXEndCallAction 0x141d18190 UUID=BBE9EB13-EFF5-49F1-99DC-96A6218C9031 state=0 commitDate=(null) callUUID=7C8A16B2-4CF4-4F66-A588-5A663A6D52D4 dateEnded=(null)>" )>] Error Domain=com.apple.CallKit.error.requesttransaction Code=4 "(null)" Questions : Can CXCallController.request(_:completion:) legitimately fail with unknownCallUUID if CXEndCallAction is issued before the reportNewIncomingCall completion handler has returned — i.e., is there a required ordering/synchronization guarantee we're missing? Are there known conditions (OS version-specific behavior, app suspension/background state, Do Not Disturb / Focus interaction, multiple concurrent CXProviders) under which CallKit's internal call controller can "lose" a UUID that was previously reported, causing a subsequent valid action to be rejected as unknown? Is there a supported way to query CXCallController/CXProvider for the current set of UUIDs it considers "known" at a given time, to diagnose this class of mismatch before issuing an action? Once unknownCallUUID occurs, is there a recommended recovery path to force-clear a stale call from CallKit's UI/state from the app side, short of ending all calls?

We adopted the "com.apple.developer.family-controls.app-and-website-usage entitlement" to read usage through "DeviceActivityData.activityData(filteredBy:using:)" after "approvedWithDataAccess". It works as documented. We want to clarify the exclusivity issues. The consent sheet says, under "Limited Access", that Screen Time "will lose access to this data as only one app or service can access it at a time." On our test devices that is exactly what happens: after allowing, the Screen Time pane in Settings shows no new usage until the app is toggled off under Apps with Screen Time Access. Is this intended as permanent design, and is there any supported way for a third-party app and Apple's Screen Time to hold the data simultaneously?

Hi Apple Developer Support, I’m developing an iOS app that uses FamilyControls, ManagedSettings, and DeviceActivity. My app requests Screen Time authorization with: try await AuthorizationCenter.shared.requestAuthorization(for: .individual) Issue: On my development-installed build, AuthorizationCenter.shared.authorizationStatus becomes .approvedWithDataAccess, and the app can display usage data. However, after installing the App Store / App Store Connect distribution build, the same device and same flow returns .approved instead of .approvedWithDataAccess. As a result, the app only treats the authorization as management access, not usage-data access. App details: App name: App时记 Main bundle ID: com.qteqpid.appstop Device Activity Monitor extension: com.qteqpid.appstop.AppStopMonitorExtension Device Activity Report extension: com.qteqpid.appstop.AppStopReportExtension Version/build tested: 2.0 (4) Team ID: 5N6B48T57B What I verified: I exported an App Store Connect IPA from Xcode Organizer on September 3, 2026 and inspected the actual signed entitlements with codesign. The main app and both Screen Time extensions all include: com.apple.developer.family-controls = true com.apple.developer.family-controls.app-and-website-usage = true com.apple.security.application-groups = group.com.qteqpid.appstop get-task-allow = false The DistributionSummary.plist also shows Apple Distribution signing and App Store provisioning profiles for the main app and both extensions. Question: Given that the App Store Connect distribution IPA appears to contain the app-and-website-usage entitlement on the main app and both extensions, what conditions would cause AuthorizationCenter.shared.authorizationStatus to return .approved instead of .approvedWithDataAccess for an .individual authorization? Is there an additional distribution-side approval, App ID setting, provisioning support setting, device state, or Screen Time privacy limitation that can prevent .approvedWithDataAccess even when the signed entitlements are present? I would appreciate guidance on how to verify why data access is not granted in the App Store/TestFlight environment. Thank you.

My app receives AuthorizationStatus.approvedWithDataAccess when run from a development build, but the identical code returns only .approved when run from a TestFlight / App Store (distribution) build. I'm trying to determine how to get the com.apple.developer.family-controls.app-and-website-usage entitlement granted for distribution, since enabling the capability in the portal has not been sufficient. Environment Xcode 26.6 (17F113) iPhone 17, iOS 26.5.2 App uses FamilyControls + ManagedSettings, plus Screen Time extensions (Shield Configuration, Shield Action, Device Activity, Live Activity, Control). Entitlement in question: com.apple.developer.family-controls.app-and-website-usage (iOS 26.4+) What works vs. what doesn't Development build (installed from Xcode): AuthorizationCenter.shared.authorizationStatus == .approvedWithDataAccess. FamilyActivityData.shared.installedApplications returns real bundle IDs and display names. TestFlight / distribution build (same source, same device, same OS): authorizationStatus == .approved. installedApplications is empty. The only variable between the two is development vs. distribution signing. What I've already done Enabled Family Controls App and Website Usage on the main App ID and on every extension identifier in Certificates, Identifiers & Profiles. Confirmed the entitlement key is present in the app's .entitlements and is signed into the distribution build. Regenerated the distribution provisioning profiles after enabling the capability (Automatically Manage Signing), archived a fresh build, ran Validate App (passed), and uploaded to TestFlight. Installed the TestFlight build on-device and verified in Settings that Authorization is still .approved. What I found in Capability Requests Under Certificates, Identifiers & Profiles -> the App ID, only Family Controls (base) shows as Assigned, its info panel lists Entitlement Keys = com.apple.developer.family-controls only. There is no entry anywhere in Capability Requests for com.apple.developer.family-controls.app-and-website-usage. So it appears there is no account-level distribution grant for the App and Website Usage tier for a distribution profile to inherit, which would explain why the checkbox alone doesn't take effect at runtime in distribution. I already have the base Family Controls distribution entitlement (the app ships and runs fine); it is specifically the App and Website Usage tier that works only in development. My questions Does the app-and-website-usage tier require a separate distribution approval (beyond enabling the checkbox on the App ID)? If so, where is that request submitted — it does not appear as a requestable item in my Capability Requests tab. Is there an additional step to make a distribution provisioning profile carry app-and-website-usage, given the base Family Controls entitlement already distributes correctly? For anyone who has shipped an app using .approvedWithDataAccess (iOS 26.4+): what did it take to get the usage tier active in an App Store/TestFlight build? I went through Developer Support; they confirmed the base Family Controls entitlement is on the account and directed me here for code-level guidance. Any pointers appreciated. Thank you!

Hi team, We're experiencing two issues with our App Clip invocation via appclip.apple.com links. Setup: App Clip URL: https://appclip.apple.com/id?p=com.x.AppClip The App Clip card and experience work correctly when the full app is NOT installed ✅ Issue 1: App Clip card shown even when the full app is installed When the full app is already installed on the device, tapping the App Clip link shows the App Clip card instead of directly opening the full app. After tapping "Open" on the card, the full app launches — but then the App Clip card appears again on top of the app, requiring the user to dismiss it a second time. Expected behavior: If the full app is installed, tapping the App Clip link should bypass the App Clip card entirely and open the full app directly, routing to the correct screen using the URL parameters. Actual behavior: User taps App Clip link → App Clip card appears (should not appear if app is installed) User taps "Open" on the card → Full app launches App Clip card appears again on top of the full app → User has to dismiss it manually This results in unnecessary friction — two extra taps just to get into the app. Issue 2: Full app does not route to the correct screen When the full app eventually opens (after dismissing the cards), it opens to the default home screen rather than routing to the screen specified by the parameter in the URL. Expected behavior: The full app should handle the URL parameters and navigate to the appropriate screen. Actual behavior: The full app opens to its default/home screen, ignoring the url parameter. Questions: Is this expected behavior that appclip.apple.com links always show the App Clip card even when the full app is installed? If so, is there a recommended approach to bypass the card and open the app directly? What is causing the duplicate App Clip card after tapping "Open"? Is this a known issue, or is there something in our configuration that could be triggering it? For the full-app-installed case, what is the recommended way to handle deep linking from an appclip.apple.com URL into a specific screen in the full app? Should we be handling this via NSUserActivity, UIApplicationDelegate, or a Universal Link handler? Environment: iOS 26.x Xcode 26.x App Clip configured with appclips associated domain Full app and App Clip share the same App ID prefix Any guidance would be greatly appreciated. Thanks!

I am developing an iOS application with a Location Push Service Extension and am trying to provide managed app configuration to the extension using Apple's ManagedAppConfigurationProvider and Declarative Device Management (DDM). The same managed configuration works correctly in the containing application, but the exact same API fails when called from the Location Push Service Extension. Environment: iOS: 26.2.1 Xcode: 16.4 Extension type: Location Push Service Extension The extension has the following entitlement in both the signed extension and provisioning profile: com.apple.developer.location.push The extension is configured through DDM using ExtensionConfigs: "ExtensionConfigs": { "bundleid (teamid)": { "DataAssetReference": "xxxxxxx" } } The Data Asset is successfully compiled by the MDM server and contains the managed configuration values. The device reports the following DDM status: "config-state": { "app-config-state": { "state": "valid" }, "extension-config-state": { "bundleidofextension": { "state": "unknown" } } } The main application can successfully retrieve the configuration using: let provider = ManagedAppConfigurationProvider() Task { for await configuration in await provider.configurations( ModelManagedAppConfiguration.self ) { print("APP CONFIG = (String(describing: configuration))") } } The same code and the same configuration type are used inside the Location Push Service Extension. Inside the extension, the provider is created successfully: LOCATION EXTENSION: creating ManagedAppConfigurationProvider LOCATION EXTENSION: provider created LOCATION EXTENSION: requesting configurations However, the request fails with: Failed to connect to managedappsd with error Error Domain=NSCocoaErrorDomain Code=4099 "The connection to service named com.apple.devicemanagementclient.managedappsd was invalidated from this process." Failed to fetch managed app configuration. Returning nil. Error: XPC connection failed with error Optional("Couldn’t communicate with a helper application.") Failed to determine managed app configuration changed notification name. Unable to register for notifications. Failed to report configuration error state. Error: XPC connection failed with error Optional("Couldn’t communicate with a helper application.") LOCATION EXTENSION: CONFIG = nil The important observation is that the configuration works from the containing application but fails from the Location Push Service Extension before the configuration reaches the Decodable configuration type. I have also verified: The extension Bundle ID matches the ExtensionConfigs entry. The Team ID matches. com.apple.developer.location.push is present in the signed extension. com.apple.developer.location.push is also present in the provisioning profile. The DDM Data Asset is successfully compiled. The containing application's managed configuration state is valid. The same ManagedAppConfigurationProvider code works in the containing application. According to Apple's documentation, ManagedAppConfigurationProvider provides configurations for a managed app or extension, and ExtensionConfigs is the DDM mechanism for configuring extensions. My question is: Is ManagedAppConfigurationProvider fully supported from a Location Push Service Extension? If it is supported, what could cause managedappsd to reject/invalidate the XPC connection specifically when the request originates from a Location Push Service Extension? Could there be an additional entitlement, extension-specific configuration, or system restriction required for ManagedAppConfigurationProvider to communicate with managedappsd from this type of extension? Any guidance on how to further diagnose the NSCocoaErrorDomain Code=4099 / "Couldn’t communicate with a helper application" error would be appreciated.

We have a Live Caller ID Lookup deployment that has been blocked for weeks, and the core difficulty is not technical. It is that we cannot find out anything about the state of our onboarding submission. Here is where we stand. We submitted the onboarding form and our configuration was approved on 8 August. That approval email is the only communication we have ever received about this feature. Our service is deployed and verified: the OHTTP gateway negotiates HTTP/2, serves a valid key configuration, the issuer directory returns 200 and Apple polls it continuously, the DNS TXT record is in place, and the validation identity is in our corpus. Development builds work end to end and display caller names correctly on incoming calls. App Store builds do not. Every authenticated request fails on the device in roughly 47 ms, before anything leaves the phone: ciphermld(CipherML) requestData(byKeywords:shardIds:clientConfig:) threw NSURLErrorDomain Code=-1009 _NSURLErrorPrivacyProxyFailureKey = true nw_endpoint_proxy_handler_should_use_proxy: "Proxies not present, but required to fail closed" The network path is healthy in the same moment, and other processes on the device do receive proxy configuration. Only our extension's bundle identifier never does. We reproduced this on Wi-Fi and on cellular, and after a device restart. We have since learned, from a maintainer replying to an issue we opened on the pir-service-example repository, that "approved" in the CloudKit console is not the same thing as "successfully onboarded", and that we are still in the first state. That explains the behavior completely. What we cannot explain is how a provider is supposed to discover this. There is no status field in the console, no notification when the state changes, and nothing in the onboarding documentation that mentions a second stage exists. We wrote to Apple several times over these weeks. We were told more than once that an internal team would look into it, and we never received a reply. Apple Support told other providers in the same situation that this is a technical matter beyond their scope. Looking through the pir-service-example issues, this pattern is common. One provider reported waiting three months without a response. Another reported that form to production took almost four months. Another only discovered the feature had been enabled by noticing traffic arriving at their own server. My questions: Is there any supported way to check the onboarding state of a submitted configuration, or to ask about one that appears stuck? If not, is anything planned? Is the transition from "approved" to "successfully onboarded" expected to be automatic, and roughly how long should it take? For anyone who has been through this: did you eventually get a notification, or did you find out by watching your own server logs? We are not asking for our submission to be prioritized. We would simply like to know whether we are waiting on something or whether something needs to be resubmitted, and right now there is no way to tell the difference. Our paying subscribers cannot use the feature, and we have not been able to give them an accurate answer either. Thank you.

Summary Our Live Caller ID Lookup deployment works end-to-end from an Xcode-signed build but fails on the App Store build of the same app, on the same device, same network, same Apple ID. On the production build every authenticated request fails locally in ~47 ms, before any packet leaves the device. Our Identity & Trust configuration in CloudKit Console has read "Approved" since 2026-08-08. Device log at the moment of failure nw_endpoint_proxy_handler_should_use_proxy: "Proxies not present, but required to fail closed" ciphermld(CipherML) <Error>: queryStatus(for:options:) threw an error: Error Domain=NSURLErrorDomain Code=-1009 "The Internet connection appears to be offline." NSErrorFailingURLKey=https://<our-issuer-host>/token-key-for-user-token _NSURLErrorPrivacyProxyFailureKey=true NSUnderlyingError={NSPOSIXErrorDomain Code=50 "Network is down"} (_NSURLErrorNWPathKey=satisfied, Wi-Fi up, LQM: good) Control experiment: the device's privacy proxy stack is healthy at that exact moment 0.93 seconds before our extension is refused, the same device attaches a proxy to another connection without any problem: 11:51:59.417 mDNSResponder nw_endpoint_proxy_add_config_if_applicable Adding proxy masque Proxy: https://mask.icloud.com:443 11:52:00.337 ciphermld [C15 ... bundle id: <our extension>, proxy fail closed] start 11:52:00.346 ciphermld Proxies not present, but required to fail closed System state in the same capture: Privacy Proxy Service Status: 1 Privacy Proxy User Tier: 1 Privacy Proxy Networks: (<Cellular, Active>, <WiFi, Active>) Counts across the capture: nw_endpoint_proxy_add_config_if_applicable appears twice (mDNSResponder and Safari SafeBrowsing), while Proxies not present appears 16 times, all from ciphermld, all for our extension's bundle id. No connection made on behalf of our extension is ever given a proxy configuration. Reproduced on two networks and after a device restart, with the device charging and Low Power Mode off. Apple's own endpoint already recognises our issuer 11:51:59.405 ciphermld(CipherML) Fetching token issuer directory from https://gateway.icloud.com/pat-issuer-directory?issuer=<our-issuer-host> 11:52:00.332 200, 1511 bytes, 928 ms Our validation Bearer token from the onboarding submission also returns 200 on /token-key-for-user-token when Apple's validator calls it, which we observe on our server several times a day. A second observation that may be the key In apple/pir-service-example issue #139 an Apple engineer stated that once onboarding is complete, "all requests ... will automatically use OHTTP even when it is a development build". We captured our development build today with full device logging. Every one of its connections goes directly to our PIR host over QUIC, with no proxy fail closed stamp, and the words ohttp, oblivious, mask.icloud and our OHTTP gateway hostname appear zero times in the capture: 16 connections, all: Hostname#<our-pir-host>:443, attribution: developer "proxy fail closed": 0 "Proxies not present": 0 If a completed onboarding forces OHTTP even for development builds, then our development build going direct indicates the relay configuration was never distributed for our extension's bundle id, despite the console showing "Approved". Fleet-level data, not a single device On the day of release, 40 distinct premium accounts on the current App Store build fetched their user tier token from our backend. Across that entire day our PIR service saw zero Privacy Pass issuances and zero queries from App Store builds. For contrast, a single development-signed device produced 144 /issue requests in one day earlier in the month. What we already checked and fixed on our side HTTP/2 ALPN negotiates on all three hosts (service, issuer, gateway). The DNS TXT ownership record is in place. The OHTTP gateway serves a valid key config (X25519 / HKDF-SHA256 / AES-128-GCM). The PIR use case names match the required <extension bundle id>.block / .identity format exactly. The validation identity +1 408 555 1212 "Johnny Appleseed" is present in the live corpus. We found and fixed a real defect of our own: our OHTTP gateway's allowed target origin list was missing the issuer host. We corrected it and restarted the gateway (its HPKE key config was byte-identical afterwards, so no key rotation occurred). The failure reproduced with an identical signature seven minutes later, and the device log confirms these hops never touch our gateway anyway. Questions Is relay / privacy proxy provisioning for a production bundle id a separate step after the Identity & Trust configuration is approved, and what is the expected propagation time? Is there any way for a developer to check provisioning status? Right now an "Approved" badge and a completely non-functional production build look identical from our side. Is there a supported way to exercise the production privacy proxy path before shipping to the App Store? Development builds bypass it by design, so the first real test of the production path was made by paying customers. This seems likely to affect other adopters. Is provisioning keyed on the extension bundle id, the app bundle id, or the team id? Other system consumers on the same device receive proxy configurations normally. We accidentally submitted two identical configurations three minutes apart on 2026-08-08 and both show "Approved". Can a duplicate block or confuse provisioning, and should one be revoked? Environment: iPhone 17 Pro Max, iOS 26.6.1, Xcode 26.5 (17F42). App Store build version 14 (36). Feedback Assistant report with full device logs: FB24501570 GitHub issue with the same detail: https://github.com/apple/pir-service-example/issues/162 Configuration ID: 693155e2-b8ba-4b47-9b6c-64fd97677386 and a1959377-8069-4225-87b9-c1ff81016611

The documentation suggests that you can transfer files out of the crash reporting extension but it doesn’t outline if there are any gotchas to watch out for. Are there any limitations to this? Does it have full network access? Are app groups and keychain groups fully supported? Does the extension have a memory footprint limit we should watch out for? What is the lifecycle of the callback, what Is a reasonable amount of time to plan our implementation to do its work and be done within? 10 seconds? 30? And so on.

Hi all, we're using a CUPS notifier in a custom printer billing software. In the current macOS 27 beta, the notifier is never executed although it's correctly registered in subscriptions.conf. Is this a bug in macOS or was the functionality intentionally removed? Thanks and greetings, Andreas

Hey Everyone, I am looking for some help as I am completely lost in what to do, maybe I am missing something simple, but, our server-side WeatherKit REST integration has returned 401 on every request for several weeks, and the evidence points to service enablement on Apple's side rather than our configuration. Details: The 401 response body is {"reason": "NOT_ENABLED"}, per the documentation this indicates the WeatherKit service is not enabled for the App ID, not a malformed token. Deliberately corrupting the JWT produces a different rejection, which we can reproduce at will, so token validation is clearly passing. The JWT is structurally correct: header {alg, kid, id: "TEAM.BUNDLE"}, payload {iss: TEAM, sub: BUNDLE}. The same Team ID and signing flow produce a working MapKit JS token in production today. In Certificates, Identifiers & Profiles, the WeatherKit capability is checked for the App ID under both App Services and Capabilities, and has been for weeks. We have since minted a brand-new key (new .p8, re-encoded and verified) and the result is unchanged. Bundle ID: run.tayro.app. The failure is identical from our production servers and from curl. Developer Support declined to escalate twice, saying this is outside their scope so I'm posting here for help :) . Has anyone seen NOT_ENABLED persist despite the portal showing the capability enabled? And long shot but... maybe someone from the WeatherKit team can check the service enablement state for this App ID? or point me at the right channel to request that?

I have a persistent WeatherKit authentication failure that could be server-side JWT minting not being enabled for my App ID. Every WeatherService.shared.weather(for:) call fails with: Failed to generate jwt token for: com.apple.weatherkit.authservice Error Domain=WeatherDaemon.WDSJWTAuthenticatorServiceListener.Errors Code=2 "(null)" The console shows the request reaching Apple's auth service and failing only at the JWT generation step. Account / app: Team ID: 634Q7K5DN8 Bundle ID: com.davidfrauenhofer.TripVault App: shipping on the App Store (this is an update adding a WeatherKit forecast) Device: iPhone 13 Pro, physical device (not simulator) Signing: Xcode automatic Everything I've verified locally: codesign -d --entitlements - on the installed binary confirms com.apple.developer.weatherkit = true, with application-identifier = 634Q7K5DN8.com.davidfrauenhofer.TripVault and matching com.apple.developer.team-identifier. WeatherKit is enabled on the App ID under both the Capabilities and App Services tabs, saved and confirmed. App ID Prefix equals my Team ID (634Q7K5DN8) — no legacy prefix mismatch. Fresh provisioning profiles downloaded; clean build folder; app deleted and reinstalled. Active Apple Developer Program membership; no pending agreements in App Store Connect. Valid coordinates passed (confirmed in logs). This has persisted for several weeks across many rebuilds and reinstalls so i should have cleared any propagation windows. Request to the WeatherKit team: Could someone verify whether JWT minting is enabled server-side for this Team ID / Bundle ID, and whether there is a stuck or incomplete WeatherKit registration for this App ID? Given the entitlement is confirmed present in the signed binary and all client-side configuration is correct, I believe this requires inspection of the auth-service registration on Apple's side. Happy to provide any additional logs or identifiers.

Hi all! I am seeing the following problem while developing a Quick Look extension to preview Markdown files on iOS and macOS: On iOS 26, Quick Look invokes an installed data-based Quick Look preview extension for .md files resolved as net.daringfireball.markdown, and the extension renders the Markdown correctly. On iOS 27, the same document and the same installed extension no longer work. Quick Look still resolves the file as net.daringfireball.markdown, but it does not invoke the extension and instead displays the raw Markdown source using the generic plain-text preview. Also the same extension runs perfectly on macOS 26 and macOS 27. The extension subclasses QLPreviewProvider, has QLIsDataBasedPreview enabled, and includes net.daringfireball.markdown in QLSupportedContentTypes. As a control, the same installed extension correctly launches and renders equivalent document content when it is presented through a custom Uniform Type Identifier. This confirms that the extension is embedded, installed, and otherwise invocable; the failure is specific to Quick Look's provider selection for Markdown on iOS 27. Reproduction: Install an app containing the data-based preview extension described above. On iOS 26, open an .md document in Quick Look and observe that the extension is launched and renders the Markdown. On iOS 27, open the same document with the same extension installed. I reproduced this through Files, although the issue concerns Quick Look provider selection rather than Files-specific behavior. Observe that the extension is not launched and the raw Markdown source is shown. Open an equivalent document registered with a custom content type supported by the same extension. Observe that Quick Look launches the extension and displays the rendered preview. The attached screenshots show the same Markdown case rendered by QuickMark on iOS 26 and falling back to plain text on iOS 27. Is there a supported way for a third-party preview extension to handle net.daringfireball.markdown on iOS 27, or is this an unintended provider-selection regression? Tested with iOS 27.0 (24A5408d) on an iPhone 17 Pro Max Simulator using Xcode 27.0 (27A5237l). Feedback filed as FB24481377.