Skip to main content

Mac App Store

The top-level mas key contains a set of options instructing electron-builder on how it should build the MAS (Mac Application Store) target. Inherits all macOS options.

Use the mas-dev target (configured via the top-level masDev key) for local testing of MAS builds with a development provisioning profile.

MAS vs. Direct Distribution​

AspectMAS DistributionDirect Distribution (DMG)
CertificateMac App DistributionDeveloper ID Application
NotarizationNot required (Apple handles it)Required (macOS 10.15+)
SandboxingMandatoryOptional
Update mechanismMac App Storeelectron-updater
RevenueApple takes 30% (15% for small dev program)100% to you
DiscoveryApp Store search and browsingYour own marketing
ReviewApple review (1-7 days)Instant
macOS version supportAs Apple dictatesYou control

Prerequisites​

Certificates​

You need a Mac App Distribution certificate (for signing the app) and a Mac Installer Distribution certificate (for signing the PKG submitted to App Store Connect). Both are issued from your Apple Developer account.

tip

For local testing with mas-dev, you use a Development provisioning profile and a standard developer certificate, not the distribution ones.

Provisioning Profile​

MAS apps require a provisioning profile that:

  • Lists the specific entitlements your app uses
  • Is tied to your App ID and certificate

Create provisioning profiles at developer.apple.com.

mas:
  provisioningProfile: build/MyApp_AppStore.provisionprofile

App Sandbox​

All MAS apps must be sandboxed. Add to your entitlements (build/entitlements.mas.plist):

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <!-- Required for sandboxed MAS apps -->
  <key>com.apple.security.app-sandbox</key>
  <true/>
  <!-- Allow JIT compilation -->
  <key>com.apple.security.cs.allow-jit</key>
  <true/>
  <!-- Network access (if needed) -->
  <key>com.apple.security.network.client</key>
  <true/>
</dict>
</plist>

And build/entitlements.mas.inherit.plist for helper processes:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>com.apple.security.app-sandbox</key>
  <true/>
  <key>com.apple.security.inherit</key>
  <true/>
</dict>
</plist>

Point to these in your configuration:

mas:
  entitlements: build/entitlements.mas.plist
  entitlementsInherit: build/entitlements.mas.inherit.plist
  provisioningProfile: build/MyApp_AppStore.provisionprofile

Common MAS Entitlements​

EntitlementPurpose
com.apple.security.app-sandboxRequired for MAS
com.apple.security.network.clientOutgoing network connections
com.apple.security.network.serverIncoming connections
com.apple.security.files.user-selected.read-writeOpen/Save panels
com.apple.security.files.downloads.read-writeDownloads folder access
com.apple.security.device.cameraCamera
com.apple.security.device.microphoneMicrophone
com.apple.security.personal-information.contactsContacts
com.apple.security.personal-information.calendarsCalendar
com.apple.security.printPrinting
com.apple.security.automation.apple-eventsAppleScript/Apple Events

Testing with mas-dev​

The mas-dev target produces a build signed with a development certificate and development provisioning profile — suitable for testing sandbox behavior on your machine without going through App Store review.

masDev:
  provisioningProfile: build/MyApp_Dev.provisionprofile
  entitlements: build/entitlements.mas.plist
  entitlementsInherit: build/entitlements.mas.inherit.plist

Build the dev target:

electron-builder --mac mas-dev

Building for the App Store​

electron-builder --mac mas

This produces:

  • MyApp-<version>.pkg — the package to upload to App Store Connect

Submitting to App Store Connect​

  1. Open App Store Connect
  2. Create your app listing (if new) under My Apps → +
  3. Use Transporter (free, from the Mac App Store) or xcrun altool / xcrun notarytool to upload the .pkg
  4. The uploaded build appears in App Store Connect after processing (usually a few minutes)
  5. Select the build for your release and submit for review

Common Review Rejection Reasons​

  • Sandbox violations — the app attempts to access files or resources not permitted by entitlements
  • Deprecated APIs — using APIs Apple has removed or flagged (check release notes)
  • Missing privacy strings — if you access camera/mic/location, NSCameraUsageDescription etc. must be in Info.plist
  • UI guidelines violations — buttons, windows, or flows that don't match Human Interface Guidelines
  • Crash on launch — always test the MAS build on a clean machine before submitting

Configuration​

Interface: MasConfiguration

Extends​

Properties​

appId?​

readonly optional appId?: string | null

The application id. Used as CFBundleIdentifier for MacOS and as Application User Model ID for Windows (NSIS target only, Squirrel.Windows not supported). It is strongly recommended that an explicit ID is set.

Default​

com.electron.${name}

Inherited from​

MacConfiguration.appId

artifactName?​

readonly optional artifactName?: string | null

The artifact file name template. Defaults to ${productName}-${version}.${ext} (some target can have other defaults, see corresponding options).

Inherited from​

MacConfiguration.artifactName

asar?​

readonly optional asar?: boolean | AsarOptions | null

Whether to package the application's source code into an archive, using Electron's archive format.

Node modules that must be unpacked will be detected automatically. Use AsarOptions.unpack to specify additional files to unpack.

Default​

true

Inherited from​

MacConfiguration.asar

bundleShortVersion?​

readonly optional bundleShortVersion?: string | null

The CFBundleShortVersionString. Do not use it unless you need to.

Inherited from​

MacConfiguration.bundleShortVersion

bundleVersion?​

readonly optional bundleVersion?: string | null

The CFBundleVersion. Do not use it unless you need to.

Inherited from​

MacConfiguration.bundleVersion

category?​

readonly optional category?: string | null

The application category type, as shown in the Finder via View -> Arrange by Application Category when viewing the Applications directory.

For example, "category": "public.app-category.developer-tools" will set the application category to Developer Tools.

Valid values are listed in Apple's documentation.

Inherited from​

MacConfiguration.category

compression?​

readonly optional compression?: CompressionLevel | null

The compression level. If you want to rapidly test build, store can reduce build time significantly. maximum doesn't lead to noticeable size difference, but increase build time.

Default​

normal

Inherited from​

MacConfiguration.compression

darkModeSupport?​

readonly optional darkModeSupport?: boolean

Whether a dark mode is supported. If your app does have a dark mode, you can make your app follow the system-wide dark mode setting.

Default​

false

Inherited from​

MacConfiguration.darkModeSupport

defaultArch?​

readonly optional defaultArch?: string

The default architecture to build for when no --arch flag is specified. Defaults to the current machine's architecture.

Inherited from​

MacConfiguration.defaultArch

detectUpdateChannel?​

readonly optional detectUpdateChannel?: boolean

Whether to infer update channel from application version pre-release components. e.g. if version 0.12.1-alpha.1, channel will be set to alpha. Otherwise to latest. This does not apply to github publishing, which will never auto-detect the update channel.

Default​

true

Inherited from​

MacConfiguration.detectUpdateChannel

electronLanguages?​

readonly optional electronLanguages?: string | string[]

The electron locales to keep. By default, all Electron locales used as-is.

Inherited from​

MacConfiguration.electronLanguages

electronUpdaterCompatibility?​

readonly optional electronUpdaterCompatibility?: string | null

The electron-updater compatibility semver range.

Inherited from​

MacConfiguration.electronUpdaterCompatibility

executableName?​

readonly optional executableName?: string | null

The executable name. Defaults to productName Note: Except for Linux, where this would constitute a breaking change in previous behavior and lead to both invalid executable names and Desktop files. Ref comments in: https://github.com/electron-userland/electron-builder/pull/9068

Inherited from​

MacConfiguration.executableName

extendInfo?​

readonly optional extendInfo?: any

The extra entries for Info.plist.

Inherited from​

MacConfiguration.extendInfo

extraDistFiles?​

readonly optional extraDistFiles?: string | string[] | null

Extra files to put in archive. Not applicable for tar.*.

Inherited from​

MacConfiguration.extraDistFiles

extraFiles?​

optional extraFiles?: string | FileSet | (string | FileSet)[] | null

The same as extraResources but copy into the app's content directory (Contents for MacOS, root directory for Linux and Windows).

Inherited from​

MacConfiguration.extraFiles

extraResources?​

optional extraResources?: string | FileSet | (string | FileSet)[] | null

A glob patterns relative to the project directory, when specified, copy the file or directory with matching names directly into the app's resources directory (Contents/Resources for MacOS, resources for Linux and Windows).

File patterns (and support for from and to fields) the same as for files.

Inherited from​

MacConfiguration.extraResources

fileAssociations?​

readonly optional fileAssociations?: FileAssociation | FileAssociation[]

The file associations.

Inherited from​

MacConfiguration.fileAssociations

files?​

optional files?: string | FileSet | (string | FileSet)[] | null

A glob patterns relative to the app directory, which specifies which files to include when copying files to create the package.

Defaults to:

[
"**/*",
"!**/node_modules/*/{CHANGELOG.md,README.md,README,readme.md,readme}",
"!**/node_modules/*/{test,__tests__,tests,powered-test,example,examples}",
"!**/node_modules/*.d.ts",
"!**/node_modules/.bin",
"!**/*.{iml,o,hprof,orig,pyc,pyo,rbc,swp,csproj,sln,xproj}",
"!.editorconfig",
"!**/._*",
"!**/{.DS_Store,.git,.hg,.svn,CVS,RCS,SCCS,.gitignore,.gitattributes}",
"!**/{__pycache__,thumbs.db,.flowconfig,.idea,.vs,.nyc_output}",
"!**/{appveyor.yml,.travis.yml,circle.yml}",
"!**/{npm-debug.log,yarn.lock,.yarn-integrity,.yarn-metadata.json}"
]

Development dependencies are never copied in any case. You don't need to ignore it explicitly. Hidden files are not ignored by default, but all files that should be ignored, are ignored by default.

Default pattern **/* is not added to your custom if some of your patterns is not ignore (i.e. not starts with !). package.json and **/node_modules/**/* (only production dependencies will be copied) is added to your custom in any case. All default ignores are added in any case — you don't need to repeat it if you configure own patterns.

May be specified in the platform options (e.g. in the mac).

You may also specify custom source and destination directories by using FileSet objects instead of simple glob patterns.

[
{
 "from": "path/to/source",
 "to": "path/to/destination",
 "filter": ["**/*", "!foo/*.js"]
}
]

You can use file macros in the from and to fields as well. from and to can be files and you can use this to rename a file while packaging.

Inherited from​

MacConfiguration.files

forceCodeSigning?​

readonly optional forceCodeSigning?: boolean

Whether to fail if app will be not code signed.

Default​

false

Inherited from​

MacConfiguration.forceCodeSigning

generateUpdatesFilesForAllChannels?​

readonly optional generateUpdatesFilesForAllChannels?: boolean

Please see Building and Releasing using Channels.

Default​

false

Inherited from​

MacConfiguration.generateUpdatesFilesForAllChannels

helperBundleId?​

readonly optional helperBundleId?: string | null

The bundle identifier to use in the application helper's plist.

Default​

${appBundleIdentifier}.helper

Inherited from​

MacConfiguration.helperBundleId

helperEHBundleId?​

readonly optional helperEHBundleId?: string | null

The bundle identifier to use in the EH helper's plist.

Default​

${appBundleIdentifier}.helper.EH

Inherited from​

MacConfiguration.helperEHBundleId

helperGPUBundleId?​

readonly optional helperGPUBundleId?: string | null

The bundle identifier to use in the GPU helper's plist.

Default​

${appBundleIdentifier}.helper.GPU

Inherited from​

MacConfiguration.helperGPUBundleId

helperNPBundleId?​

readonly optional helperNPBundleId?: string | null

The bundle identifier to use in the NP helper's plist.

Default​

${appBundleIdentifier}.helper.NP

Inherited from​

MacConfiguration.helperNPBundleId

helperPluginBundleId?​

readonly optional helperPluginBundleId?: string | null

The bundle identifier to use in the Plugin helper's plist.

Default​

${appBundleIdentifier}.helper.Plugin

Inherited from​

MacConfiguration.helperPluginBundleId

helperRendererBundleId?​

readonly optional helperRendererBundleId?: string | null

The bundle identifier to use in the Renderer helper's plist.

Default​

${appBundleIdentifier}.helper.Renderer

Inherited from​

MacConfiguration.helperRendererBundleId

icon?​

readonly optional icon?: string | null

The path to application icon. Accepts .icns (legacy) or .icon (Icon Composer asset). If a .icon asset is provided, it will be preferred and compiled to an asset catalog.

Default​

build/icon.icns

Inherited from​

MacConfiguration.icon

minimumSystemVersion?​

readonly optional minimumSystemVersion?: string | null

The minimum version of macOS required for the app to run. Corresponds to LSMinimumSystemVersion.

Inherited from​

MacConfiguration.minimumSystemVersion

notarize?​

readonly optional notarize?: boolean

Whether to disable electron-builder's @electron/notarize integration.

Note: In order to activate the notarization step You MUST specify one of the following via environment variables:

  1. APPLE_API_KEY, APPLE_API_KEY_ID and APPLE_API_ISSUER.
  2. APPLE_ID, APPLE_APP_SPECIFIC_PASSWORD, and APPLE_TEAM_ID
  3. APPLE_KEYCHAIN and APPLE_KEYCHAIN_PROFILE

For security reasons it is recommended to use the first option (see https://github.com/electron-userland/electron-builder/issues/7859)

Inherited from​

MacConfiguration.notarize

protocols?​

readonly optional protocols?: Protocol | Protocol[]

The URL protocol schemes.

Inherited from​

MacConfiguration.protocols

publish?​

optional publish?: Publish

Publisher configuration. See Auto Update for more information.

Inherited from​

MacConfiguration.publish

releaseInfo?​

readonly optional releaseInfo?: ReleaseInfo

The release info. Intended for command line usage:

-c.releaseInfo.releaseNotes="new features"

Inherited from​

MacConfiguration.releaseInfo

sign?​

readonly optional sign?: string | ElectronSignOptions | CustomMacSign | null

Codesigning configuration. The signing certificate is selected via sign.identity (or the CSC_LINK / CSC_NAME environment variables).

  • Not set (default): electron-builder auto-discovers a valid certificate in the keychain. If none is found, signing is skipped.
  • null: skip signing entirely.
  • string: path or module ID of a file that exports a CustomMacSign function.
  • CustomMacSign: inline custom signing function (JS/TS config only).
  • ElectronSignOptions: options forwarded directly to @electron/osx-sign.

See​

Inherited from​

MacConfiguration.sign

target?​

readonly optional target?: TargetConfiguration | MacOsTargetName | TargetConfiguration | MacOsTargetName[] | null

The target package type: list of default, dmg, mas, mas-dev, pkg, 7z, zip, tar.xz, tar.lz, tar.gz, tar.bz2, dir. Note: Squirrel.Mac auto update mechanism requires both dmg and zip to be enabled, even when only dmg is used. Disabling zip will break auto update in dmg packages.

Default​

default (dmg and zip for Squirrel.Mac)

Inherited from​

MacConfiguration.target

universal?​

readonly optional universal?: ElectronUniversalOptions | null

Options forwarded to @electron/universal when building a universal (multi-arch) app. Has no effect unless the target arch is universal.

See​

Inherited from​

MacConfiguration.universal