Hi everyone,
I’m having trouble getting remote push notifications working on iOS for a production Flutter app, and it looks like it’s related to the provisioning profile / entitlements used during signing.
Context
Platform: Flutter
Push provider: OneSignal (backend is Supabase; Android push works fine)
CI: Codemagic
Target: iOS TestFlight / App Store builds
I’m on Windows, so I cannot open Xcode locally. All iOS builds happen via Codemagic.
Capabilities / entitlements
In the Apple Developer portal, my App ID for com.zachspizza.app has:
Push Notifications capability enabled
A separate Broadcast capability is listed but currently not checked.
In my repo,
ios/Runner/Runner.entitlements
contains:
xml
aps-environment
production
So the project is clearly requesting the push entitlement.
Codemagic signing setup
For my App Store workflow (ios_appstore_release in
codemagic.yaml
):
I use a combination of manual and automatic signing:
Environment variables can provide:
P12_BASE64 + P12_PASSWORD (distribution certificate)
MOBILEPROVISION_BASE64 (a .mobileprovision file)
A script in the workflow:
Creates a temporary keychain.
Imports the .p12 and installs the .mobileprovision into ~/Library/MobileDevice/Provisioning Profiles.
For the final export, I generate an exportOptions.plist that does:
If a profile name/UUID is provided via env (PROV_PROFILE_SPEC, PROV_PROFILE_UUID, PROVISIONING_PROFILE_SPECIFIER, PROVISIONING_PROFILE):
xml
signingStylemanual
provisioningProfiles
com.zachspizza.app[profile name or UUID]
Otherwise, it falls back to:
xml
signingStyleautomatic
After archiving and exporting, my script runs:
bash
codesign -d --entitlements :- "$ARCHIVE_PATH/Products/Applications/Runner.app"
...
and again on the signed Runner.app inside the exported IPA
codesign -d --entitlements :- "$SIGNED_APP"
In both cases, the effective entitlements output does not show aps-environment, even though:
The App ID has push enabled.
Runner.entitlements
includes aps-environment = production.
Observed behavior
iOS devices (TestFlight build) do not receive remote push notifications at all.
Android devices receive notifications as expected with the same backend payloads.
OneSignal configuration and backend are verified; this appears to be an APNs / signing / entitlements problem.
The Codemagic logs strongly suggest that the provisioning profile being used for signing does not carry aps-environment.
Questions
Under what conditions would a distribution provisioning profile (for an App ID with Push Notifications enabled) result in a signed app without aps-environment, even when:
The entitlements file in the project includes aps-environment, and
The App ID in the Developer portal has Push Notifications enabled?
Does using a CI flow like the above (custom .p12 + .mobileprovision installed via script, exportOptions with signingStyle=manual) increase the chances of:
Xcode ignoring the requested entitlements, or
Selecting a provisioning profile variant that does not include the push entitlement?
Is there a recommended way, from the Apple side, to verify that a given .mobileprovision (the one I’m base64-encoding and installing in CI) definitely includes the aps-environment entitlement for my bundle ID?
i.e., a canonical method to inspect the profile and confirm that APNs is included before using it in CI?
Are there any known edge cases where:
The project entitlements include aps-environment,
The App ID has Push Notifications enabled,
But the final signed app still has no aps-environment, due to profile mismatch or signing configuration?
Given that I’m on Windows and can’t open Xcode to manage signing directly, I’d really appreciate guidance on how to ensure that the correct push-enabled provisioning profile is being used in this CI/manual-signing setup, and how to debug why aps-environment is being stripped or not applied.
CodeMagic Signing/Export Step:
Signing / entitlements output from Codemagic
Dumping effective entitlements for Runner.app in archive...
/Users/builder/clone/build/ios/archive/Runner.xcarchive/Products/Applications/Runner.app: code object is not signed at all
Failed to dump entitlements
Exporting IPA with exportOptions.plist...
2025-11-20 22:25:00.111 xcodebuild[4627:42054] [MT] IDEDistribution: -[IDEDistributionLogging _createLoggingBundleAtPath:]: Created bundle at path "/var/folders/w2/rrf5p87d1bbfyphxc7jdnyvh0000gn/T/Runner_2025-11-20_22-25-00.110.xcdistributionlogs".
2025-11-20 22:25:00.222 xcodebuild[4627:42054] [MT] IDEDistribution: Command line name "app-store" is deprecated. Use "app-store-connect" instead.
▸ Export Succeeded
Dumping entitlements from signed Runner.app inside exported IPA...
Executable=/private/var/folders/w2/rrf5p87d1bbfyphxc7jdnyvh0000gn/T/tmp.LHkTK7Zar0/Payload/Runner.app/Runner
warning: Specifying ':' in the path is deprecated and will not work in a future release
application-identifier.com.zachspizza.app
beta-reports-active
com.apple.developer.team-identifier
get-task-allow
As you can see, the signed app’s entitlements do not contain aps-environment at all, even though
Runner.entitlements
in the project has aps-environmentproduction and the App ID has Push Notifications enabled.
Thanks in advance for any help and pointers.
