How to submit your first app to the App Store: the complete checklist

The Apple ID needs two-factor authentication, and it should stay the Account Holder. Only that role signs the paid agreement.

The Apple Developer Program is $99 a year. Individual is your legal name and the faster path. Organization needs a D-U-N-S number, which can take days when the legal name or address does not match. Both paths are on enrollment.

Have a privacy policy URL and a support URL that load without a login.

Since 28 April 2026, uploads need Xcode 26 and the iOS 26 SDK. An older archive is rejected at upload. CI with that SDK is enough; a free Apple ID is not.

Pick the bundle ID now: reverse-DNS, no hyphens if Android will share it. The appId validator checks both stores. It cannot change after the app record exists.

Enroll on the Apple ID from the previous step and do not open a second one while the first is pending. Organization enrollment asks for the D-U-N-S number, the legal name, and authority to bind the entity.

Apple checks identity next. Individuals are often asked for a photo ID; organizations are matched to the D-U-N-S record. The $99 is charged after that check and renews yearly. A failed card leaves App Store Connect closed.

When the membership is active, App Store Connect opens with no apps and an unfinished Business section. CapWrapp does not enroll you. The Apple docs start from a membership that already exists.

A free app with nothing for sale can use the free agreement for TestFlight. A price or any digital product needs the Paid Apps agreement. Clicks: sign and update agreements.

Banking and tax follow. US persons file a W-9. Non-US individuals typically file a W-8BEN; non-US entities a W-8BEN-E. The legal name has to match the membership.

EU storefronts also need trader status: Business → Agreements → Compliance → Digital Services Act. Most apps that charge or show ads are traders and publish a phone, email, and address. See DSA trader requirements. Skip banking only if you will never sell digital goods.

Register an explicit App ID first. Enable only capabilities you use: Push, Sign in with Apple, In-App Purchase, Associated Domains. A capability in the binary that the identifier lacks will fail upload.

A manual upload also needs an Apple Distribution certificate and an App Store profile. The private key stays on the Mac that created it.

For CI, Users and Access → Integrations → App Store Connect API → an Admin key. Download the .p8 once. Copy the Issuer ID and Key ID. CapWrapp uses that key to make the certificate and upload to TestFlight. Keep it out of Git; the Apple docs say where it goes.

Sign in with Apple is a capability plus an entitlement. Harmless if you have no other social login. If you offer one, Guideline 4.8 asks for an equivalent privacy-focused option such as Sign in with Apple — see the traps step.

The dialog asks for iOS, the name, the primary language, the bundle ID, the SKU, and who on the team can see the app.

The name shoppers see is at most 30 characters and unique in that language. You can change it on a later version. You cannot take a name another live record holds, and you should not use a trademark you do not own.

Primary language is what you write first. It does not limit countries. The bundle ID menu only lists identifiers you already registered, and it cannot change after Create. The SKU is internal, invisible, and permanent.

The record opens as Prepare for Submission. The rest of this checklist is the sidebar: App Information, App Privacy, Pricing and Availability, and version 1.0.

Subtitle is 30 characters. Pick the category a shopper would browse. Content rights is yes when you show third-party media.

Ratings are 4+, 9+, 13+, 16+, and 18+. Since 31 January 2026 this is the questionnaire App Store Connect uses, and iOS 26 shows the new bands. It covers in-app controls, capabilities (user-generated content, messaging, ads, web access, social), medical or wellness, and violence, plus profanity, horror, substances, and gambling. You may override higher. You cannot go lower than the answers. Age ratings · set an age rating.

Leave Made for Kids off unless you will follow those rules. Approval makes it permanent.

The privacy policy URL must describe this app: what you collect, why, and how someone deletes it.

The nutrition label, per data type, is collect / linked to the user / used to track / purpose. Tracking means ads data combined with other companies, or a data broker. Read app privacy details before you tick it.

SDKs count — Firebase, RevenueCat, ads, crash reporters. Under-declaring is worse than an extra row.

Ship a PrivacyInfo.xcprivacy manifest. A missing required-reason API fails upload (ITMS-91053). See privacy manifest files.

Free is a price tier. A paid download stays disabled until the Paid Apps agreement is signed. Pick countries deliberately: the default is every storefront. Availability is not localization — an English app can still be sold in Japan. Remove a country only for a license, a language you refuse to ship, or a law you cannot meet.

A single base price is enough for version 1.0. Pre-orders exist, but get through review once before you depend on a pre-order date. If the download is free and money comes from subscriptions, leave the price at free. Subscription prices live on the products, not here.

Digital features and subscriptions have to exist here and go out with version 1.0. A paywall with no products is an incomplete app.

Create the subscription group first, then each product: reference name, the product id your code requests, a price, a duration, and one localization. Clicks: offer auto-renewable subscriptions. One-time unlocks use the in-app purchase overview.

Each product needs a review screenshot of the paywall, taken in the app. On a new app they are reviewed with the version, so they should be Ready to Submit first. Physical goods can use your own checkout. Digital goods generally cannot — that is the traps step.

iPhone requires a 6.3-inch screenshot set: 1206 × 2622 or 1179 × 2556 portrait. An iPad app also needs a 13-inch set: 2064 × 2752 or 2048 × 2732. App Store Connect reuses those for other screen sizes, so more sets are optional. Up to ten images, of the app rather than a splash or a laptop. Specs: screenshot specifications. The screenshot checker maps a file to a slot.

Description is up to 4,000 characters. Keywords are 100 characters, comma-separated, and spaces count. Promotional text is 170 characters and can change without a new version. The support URL must load. Copyright is the year and the legal name. The version string (1.0) is not the build number; that comes from the binary.

The archive must use the iOS 26 SDK (28 April 2026) and the record’s bundle ID.

Export compliance: HTTPS alone is exempt. Most apps answer no, which clears later uploads. More than HTTPS may need the code under App Information → App Encryption Documentation. See export compliance. CapWrapp sets the exempt flag for the common case so TestFlight is not stuck on Missing Compliance. You still confirm it.

Install from TestFlight internal (your team, up to 100) and walk every screen. Then select that build on the version page. The upload itself is send a build. Selecting it is still in App Store Connect.

If a feature needs an account, provide a username and password that reach real content on this build. An empty account comes back as guideline 2.1. If there is no login, say so.

Contact is a name, phone, and email for someone who replies within a day. Notes cover what the UI hides: a region lock, where Sign in with Apple is, where deletion is. Attach a file for licenses. Do not send the reviewer a link that asks them to request access.

Manually release this version leaves the app at Pending Developer Release after approval until you click Release This Version. Use this for a first app so the website and the email go out on the day it is actually there.

Automatically release this version publishes at whatever hour review finishes. Automatically, no earlier than a date holds an early approval until that moment, and releases immediately if review runs late. A pre-order still has to be released by hand.

After you release manually, the product page can take up to 24 hours to show in every storefront. Pick manual unless you have a reason not to.

Check four rules. Longer fixes are on AcceptMyApp, not duplicated here.

Account deletion. If people can create an account, they must start deletion in the app. Email and deactivate do not count. Since 30 June 2022: offering account deletion. Practice: AcceptMyApp’s account deletion guide.

Third-party login. Google or Facebook login requires an equivalent such as Sign in with Apple, equally visible: login services (4.8). Write-up: Sign in with Apple rejection. Email-and-password alone does not trigger it.

Digital goods use in-app purchase (payments, 3.1.1). Physical goods are the usual exception.

4.2. A web view with nothing a phone does beyond Safari fails minimum functionality. Run the 4.2 self-audit and read AcceptMyApp’s 4.2 guide. CapWrapp still uploads. It does not invent the product.

Add for Review, then Submit for Review. You can pull the submission back while it is Waiting for Review.

On App Review, Apple says 90% of submissions are reviewed in less than 24 hours. That is an average, not a promise, and the queue before someone opens the app stretches around OS releases and holidays. A first account is read more carefully. AcceptMyApp’s review-time guide separates that wait from the review itself.

Answer a rejection in that thread before you open another submission. Screenshot and note fixes do not always need a new binary. A crash does. Pending Developer Release means you passed with manual release selected. Android is the Google Play submission checklist. The web-repo path to the TestFlight build is Lovable to App Store.