Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am developing an application whose purpose is to view files uploaded to a host server. The user needs to authenticate by entering credentials on a login page.

When I post my application to the App Store, how is Apple going to test, or at least view, my application when they need to enter valid credentials that I am not supposed to know? (The credentials are private to my client.)

share|improve this question

closed as off-topic by gnat, MichaelT, Snowman, Andres F., enderland Mar 4 at 12:50

  • This question does not appear to be about software development within the scope defined in the help center.
If this question can be reworded to fit the rules in the help center, please edit the question.

If your application is "private to your client", does that mean it's not a mainstream application and you only have few clients that will use it? If so, consider an Ad-Hoc build that does not involve the app store. – badgerr Mar 17 '11 at 12:59
I'm voting to close this question as off-topic because it is about the app approval process for a third party (which has in the past and may again change in the future). – user40980 Mar 3 at 22:11
up vote 7 down vote accepted

When you submit a binary to the App Store, you can give instructions to Apple about how to test the application. There you can provide them with test credentials.

In an older version of the iTunes Connect Developer Guide, in the section "Supply Version Information", the field "Review Notes" was described as such:

Use this field to give demo account information with full access to Apple for purposes of reviewing your application.

If your application requires specific settings, user registrations, or account information prior to submission to the App Store, be sure to include that information in this field.

This is a text field visible only to the App Review team, so the information entered in this field will not appear on the App Store. You can also include general instructions or other relevant information about your application that you think would be useful for the review process.

(The text of the Guide has changed; the "Demo Account" field is now described in "iTunes Connect App Properties".)

You could create a test account that has access to example files.

share|improve this answer
that's mean if i post my app with no example they will refuse it? – Ahmad Kayyali Mar 17 '11 at 9:27
One of my apps was rejected once, due to missing Review Notes about how to logon. So I'd suggest to put up a test account with no sensitive data (similar to doing UAT) for app review. – ohho Mar 17 '11 at 10:34
@Ahmade - Apple could reject it for many reasons. I suggest you follow their directions. – Ramhound Mar 17 '11 at 11:54

An fully functional demo account with real or dummy data needs to be provided to Apple for review.

You don't have to put your clients private data in the demo account; but you may need to put some data in the demo account (for instance randomly generated medical records using fictitious names to avoid HIPPA compliance issues). Or have the demo account upload content to /dev/null instead of your client's database.

share|improve this answer

I have released an app that acts as a front-end for a paying online voicemail service. I am not related to the service provider, and could not open a test account or anything of the sort. They suggested that I simply uploaded a long video of my app (running in the iPhone simulator), demonstrating all the features, and gave Apple a link to the video in the notes of my app upload. The app was approved, and numerous updates were approved with the same modus operandi.

share|improve this answer
Wow, that's accommodating of them. Apple's review process gets all this hate, but this sort of thing is amazingly friendly and permissive. (And I guess you probably just didn't demonstrate your super secret hidden 3g tethering feature, when you made your video, right?) – Dan Ray Feb 7 '12 at 13:20

It's private to my client.

If the app is private, then your client should consider signing up for the iOS enterprise developer program. Once they do, you or they can build the app for them to distribute internally and skip the app store approval process entirely.

The enterprise program used to be available only to businesses with 500 or more employees, but it seems to be available now to any business with a DUNS number.

share|improve this answer
That program is not compatible with BYOD. The company must own the devices. – sylvanaar Jun 7 '13 at 19:52
@sylvanaar It's been a while since I read the enterprise program agreement, but I have read it pretty thoroughly in the past and I don't recall that the company owning the devices was ever a requirement. If that's changed, there's certainly nothing that enforces it -- you can install an enterprise app on any device. There is a requirement in the agreement that you limit distribution to your organization, but that's understandable and generally not a problem for people who'd be interested in the enterprise program. – Caleb Jun 7 '13 at 20:06
I suppose I could be wrong. I just recently read about all this, and admittedly was a bit confusing - there was definitely a difference somewhere in the guidelines - but I would have to re-read them now since you have a different interpretation. I think you can install a B2B app on any device. Enterprise apps require provisioned devices which can be locked down - and personally, I would not let my personal device be provisioned in that manner. – sylvanaar Jun 7 '13 at 20:21
@sylvanaar Mostly incorrect. It's true that enterprise apps come with a provision profile, and it's true that any device "can be locked down" given the right kind of provision profile, but there's no requirement that you "lock down" anything. The provision profile that the app needs just tells the device that it's okay to run the app. Now, your enterprise might decide not to give you the necessary profile until you've installed an MDM profile or something, but it's not a requirement. – Caleb Jun 7 '13 at 20:32
Fair enough - I suppose they could just provision your device with the required certificates – sylvanaar Jun 7 '13 at 20:55

Not the answer you're looking for? Browse other questions tagged or ask your own question.