Unsigned IPA and Local Device Testing

Scope and Important Limitations

Local installation is for development and short-lived verification—not production distribution. An unsigned IPA cannot be installed directly on an iPhone. It must be signed with a certificate and provisioning profile that authorize the device and requested entitlements.

Apple’s free Personal Team has strict limits:

  • Up to 10 App IDs, each expiring after 7 days
  • Up to 3 registered devices, each expiring after 7 days
  • Up to 3 installed Personal Team apps per device
  • Provisioning profiles expire after 7 days, after which the app must be rebuilt or re-signed and reinstalled
  • No App Store Connect, TestFlight, Ad Hoc, or App Store distribution
  • Some managed app services and entitlements are unavailable

For ongoing team testing, use TestFlight. For known devices without beta review, use Ad Hoc.

Preferred Route: Xcode Personal Team

When you can export or open the iOS project, Apple’s supported development workflow is preferable to signing a prebuilt IPA with a third-party utility.

  1. Install the current Xcode release on a supported Mac.
  2. Sign in to Xcode with your Apple Account.
  3. Select your Personal Team under Signing & Capabilities.
  4. Connect the iPhone or iPad, trust the Mac, and enable Developer Mode if the device requests it.
  5. Select the physical device as the run destination and build the app.
  6. Repeat provisioning and installation after the 7-day profile expires.

If your MeDo workflow only provides an unsigned IPA, continue below only after reviewing the third-party signing risks.

Generate the Unsigned IPA in MeDo

In the MeDo packaging panel, select Local Debug, then choose the version to package.

Select free local debug route

Confirm:

  • App name
  • Bundle ID
  • Version and build number
  • Distribution method: Local Debug

Click Start Packaging. MeDo’s previously observed 3–8 minute range is an estimate, not a guarantee.

Build configuration confirmation step 1 Build configuration confirmation step 2

Download and Protect the IPA

After packaging, download the IPA from the result page or Export Installation Package on the app detail page.

Download IPA step 1 Download IPA step 2

Treat the file as confidential if it contains private endpoints, embedded test credentials, unreleased assets, or proprietary code. Use an approved transfer channel and delete obsolete builds.

Before Using a Third-Party Signer

Sideloadly, AltStore Classic, and AltServer are third-party products, not Apple distribution services or MeDo components. They use an Apple Account to create or select Personal Team signing assets, re-sign the IPA for your device, and install it. Neither route bypasses the free Personal Team limits or enables unsupported entitlements. Before using either route:

  • Confirm the tool is permitted by your organization and local security policy.
  • Download it only from the vendor’s authentic website and verify the installer.
  • Understand what Apple Account credentials, tokens, device identifiers, certificates, and app files the tool can access.
  • Prefer a dedicated development Apple Account with no payment data or unrelated personal content.
  • Never provide an organization Account Holder credential or a production App Store Connect API key.
  • Keep two-factor authentication enabled and review account sessions after use.
  • Do not use certificates or profiles obtained from unknown shared-signing services.

Option 1: Sideloadly

Use Sideloadly when you want the desktop tool to sign and install the IPA directly.

  1. Download Sideloadly from its official website and install it on Windows or macOS. On Windows, its official setup requires Apple’s direct-download versions of iTunes and iCloud rather than the Microsoft Store versions.
  2. Connect the unlocked iPhone or iPad by USB and approve Trust This Computer. Select the correct device in Sideloadly’s iDevice field.
  3. Drag the MeDo-generated IPA into Sideloadly, or select it from the IPA field.
  4. Enter the approved development Apple Account email and click Start.
  5. Complete the password and two-factor authentication prompts. Sideloadly then authenticates with Apple, prepares the development signing assets, re-signs the IPA, and installs it on the selected device.
  6. Complete the First Launch and Renewal checks below before opening the app.

With a free Apple Account, the signed app expires after 7 days. You can re-sign the same IPA with the same Apple Account. Sideloadly can enroll the app for automatic refresh, so verify that option before clicking Start and disable it if your security policy prohibits the background daemon. Refreshing requires USB, or an initial USB pairing followed by Wi-Fi sync in Finder or iTunes while the computer and device are on the same network.

Option 2: AltStore Classic and AltServer

Use AltStore Classic, not AltStore PAL. AltStore Classic can install arbitrary IPA files and works with the AltServer companion app on Windows or macOS; AltStore PAL does not install arbitrary IPA files.

  1. Follow the official Windows or macOS instructions to install AltServer. On Windows, install Apple’s direct-download versions of iTunes and iCloud rather than the Microsoft Store versions.
  2. Connect and unlock the device, trust the computer, and enable Wi-Fi sync in iTunes or Finder.
  3. From the AltServer menu, choose Install AltStore, select the device, and authenticate with the approved development Apple Account.
  4. On the device, trust the development identity and enable Developer Mode as described below.
  5. Keep AltServer running and connect the device by USB or to the same Wi-Fi network. Save the MeDo IPA in the Files app, open AltStore → My Apps, tap +, and select the IPA.
  6. Complete any Apple Account prompt and wait for AltStore to sign and install the app.
  7. Before the 7-day expiry, keep AltServer available and use Refresh All in AltStore. AltStore itself counts toward the free account’s three active sideloaded-app limit.

First Launch and Renewal

The exact prompts depend on the signing identity, iOS version, and device-management state.

  1. On iOS 16 or later, open Settings → Privacy & Security → Developer Mode and enable Developer Mode.
  2. Open Settings → General → VPN & Device Management (or Profiles & Device Management), select the development identity associated with the Apple Account, and confirm Trust when shown.
  3. Keep the device online for Apple certificate verification when required.
  4. Open the app and verify that the displayed developer identity belongs to the Apple Account or team you intended to use.

Do not follow an “Enterprise App” trust workflow unless the build was legitimately produced by your own eligible Apple Developer Enterprise Program organization. An ordinary Personal Team or Ad Hoc build is not an enterprise app.

Troubleshooting

App Is No Longer Available

The 7-day Personal Team provisioning profile probably expired. Re-sign the IPA with Sideloadly, or start AltServer and use Refresh All in AltStore. If AltStore itself has expired, reinstall it from AltServer without deleting it first.

The Tool Cannot Find the Device

  • Unlock the device, reconnect it by USB, and approve the trust prompt on both devices.
  • On Windows, verify that the Apple device-support components required by the selected tool are installed.
  • For Wi-Fi use, enable device Wi-Fi sync and keep the computer and device on the same network.
  • For AltStore, confirm that AltServer is running and reachable; use USB if the network blocks device discovery.

Signing Fails

  • Check the Apple Account and two-factor authentication flow.
  • Confirm the device and App ID limits have not been reached.
  • Verify the Bundle ID is not colliding with another active Personal Team App ID.
  • Remove unsupported entitlements or move to a paid Apple Developer Program route.

Installation or Launch Fails

  • Confirm the signed profile contains the target device.
  • Check Developer Mode and device trust.
  • Verify that the IPA supports the installed iOS version and architecture.
  • Keep the device online during initial certificate verification.
  • Re-sign after any Bundle ID or entitlement change.

References