The clean "one tap to install" experience you get with Enterprise-signed apps relies on a URL scheme Apple created called itms-services://. It's how iOS receives an IPA from a website without going through the App Store. Here's how it actually works under the hood.

The basic flow

The user taps a link that looks like:

itms-services://?action=download-manifest&url=https://your-site.com/manifest.plist

iOS recognizes the scheme, fetches the manifest plist, parses it, and prompts the user to install. If they accept, iOS downloads the IPA and provisioning profile referenced in the plist and performs the install.

The manifest plist

The plist is a small XML file describing the app:

<?xml version="1.0" encoding="UTF-8"?>
<plist version="1.0">
<dict>
  <key>items</key>
  <array>
    <dict>
      <key>assets</key>
      <array>
        <dict>
          <key>kind</key><string>software-package</string>
          <key>url</key><string>https://your-site.com/YourApp.ipa</string>
        </dict>
      </array>
      <key>metadata</key>
      <dict>
        <key>bundle-identifier</key><string>com.example.app</string>
        <key>bundle-version</key><string>1.0</string>
        <key>kind</key><string>software</string>
        <key>title</key><string>Your App</string>
      </dict>
    </dict>
  </array>
</dict>
</plist>

The HTTPS requirement

The thing that catches most people: both the manifest plist and the IPA file must be served over HTTPS. iOS will refuse to install from http:// URLs and won't show a useful error. The first time you self-host, the silent failure is confusing.

Easy fixes:

  • Use a free Let's Encrypt cert on your server
  • Host on a service that provides HTTPS by default (Cloudflare Pages, GitHub Pages, Netlify)
  • Use a signing service — they include hosted install links automatically

What can sign the IPA

itms-services install works for any IPA signed with a Distribution-type certificate:

  • Enterprise (In-House) — installs on any device
  • Ad-Hoc — installs on UDIDs listed in the profile
  • App Store — technically possible but pointless (App Store is faster)

It does not work for Development-signed IPAs (those go via Xcode or AltStore-like tools).

Why direct .ipa download doesn't work

Some people host the IPA on a website and link to https://example.com/app.ipa directly. Safari will download the file but iOS won't offer to install it — there's no install handler for raw .ipa files. The plist + itms-services scheme is the only OTA install path Apple supports.

Troubleshooting

Common reasons an itms-services install fails:

  • Plist or IPA not served over HTTPS
  • HTTPS cert is self-signed or expired
  • Wrong MIME types (plist needs application/xml, IPA needs application/octet-stream)
  • IPA signature is invalid — see install troubleshooting