This guide is the master reference for anyone signing or installing iOS IPA files in 2026 — whether you're a developer beta-testing your own app, a company distributing internal tools, or a user trying to install something the App Store doesn't carry. Every topic has a deep-dive companion article; this page is the map.
The iOS app ecosystem has three install paths: the App Store, TestFlight, and direct install of a signed IPA. The third path — sometimes called "sideloading" — is what this guide covers in depth. It's perfectly legitimate (Apple itself created the mechanism), it doesn't require a jailbreak, and it works on every modern iPhone and iPad.
We'll cover what's actually inside an IPA, how Apple's code signing system decides whether to trust it, the three certificate types, every common error and how to fix it, comparisons between free sideloading tools, and finally — practical playbooks for personal use, beta testing, and enterprise distribution.
Table of contents
- Foundations — what IPAs and certificates are
- How to sign and install — step-by-step
- Troubleshooting common errors
- Comparing your options
- Specific use cases & iOS versions
- Next steps
1. Foundations — what you need to know first
Before you sign or install anything, four concepts make everything else fall into place: what an IPA actually is, what a certificate does, what a provisioning profile binds together, and how Apple's code signing chain decides whether to run your app.
What is an IPA file?
An IPA is a ZIP archive containing your compiled iOS app plus the metadata iOS needs to verify it. Without a valid signature, iOS will refuse to install it. The structure inside is small but every piece matters. Full breakdown: What Is an IPA File?
How iOS code signing works
Apple's code signing system is a three-piece chain: a certificate (who signed), a provisioning profile (who and where it can run), and the signature itself (cryptographic proof of integrity). If any piece is wrong or expired, the app refuses to launch. Deep dive: iOS Code Signing Explained.
Provisioning profiles
The provisioning profile is the file that ties your certificate, your app ID, and the list of allowed devices together. It expires independently of the certificate and is the most common point of failure. See: iOS Provisioning Profile Explained.
The three types of Apple Distribution certificate
When people say "Apple Distribution certificate" they could mean App Store, Ad-Hoc, or Enterprise (In-House). Each has different rules and different distribution models. Walkthrough: Apple Distribution Certificate Guide.
UDID — the device identifier
For Developer-signed IPAs, the device's UDID must be registered in the provisioning profile. Three easy ways to find it: How to Find Your iPhone's UDID.
2. How to sign and install — step-by-step
Once the concepts are clear, the actual process is straightforward. Here are the tutorials covering every common signing and installation workflow.
Signing an IPA without an Apple Developer account
Three legitimate paths if you don't want to pay $99/year for the Developer Program: Enterprise certificate, short-term Developer signing, or free tools like AltStore. Full breakdown of each: How to Sign an IPA Without an Apple Developer Account.
Installing a signed IPA on iPhone or iPad
The end-user flow. Once you have a signed IPA, installation is a few taps in Safari plus a trust step in Settings. Complete walkthrough: Install IPA on iPhone Without Jailbreak. For iPad-specific notes: Install IPA on iPad.
Re-signing an expired or revoked IPA
When a certificate expires or gets revoked, the IPA itself is still fine — only the signature wrapper needs replacing. This is called re-signing. Full guide to re-signing.
Sideloading with AltStore
The most popular free sideloading tool. Uses your free Apple ID to re-sign apps every 7 days. Setup and usage: How to Install IPA with AltStore.
Sideloading with Sideloadly
Simpler than AltStore for one-time installs — no phone-side app required. Sideloadly tutorial.
The itms-services install protocol
The Apple-blessed OTA install method for Enterprise and Ad-Hoc apps. Requires a manifest plist and HTTPS hosting. How itms-services install links work.
iOS beta testing without TestFlight
When TestFlight's 90-day expiry, 10k user cap, or review process don't fit, Ad-Hoc and Enterprise signing are the alternatives. iOS Beta Testing Without TestFlight.
3. Troubleshooting common errors
90% of "my IPA won't install" or "the app stopped working" issues come down to one of a handful of certificate or profile problems. Here's the diagnostic playbook for each.
The master troubleshooting checklist
The 10 most common causes of IPA install failures, with diagnostic order: Why Your IPA Isn't Installing.
"Unable to Verify App" error
This error means iOS couldn't reach Apple to validate the certificate. Four causes and how to fix each: Unable to Verify App Fix.
"Untrusted Developer" error
The 30-second fix for the prompt every newly-installed sideloaded app shows: How to Trust a Developer Profile.
Recovering from a certificate revoke
When Apple kills an Enterprise certificate, every signed app stops working simultaneously. Recovery playbook: iOS Certificate Revoked Recovery.
4. Comparing your options
The signing world has many overlapping options. These comparisons help you pick the right one without trial-and-error.
Developer vs Enterprise certificate
The fundamental choice for paid signing. Developer = cheap, low-risk, 7-day. Enterprise = unlimited devices, no Apple ID, but revoke risk. Full comparison: Developer vs Enterprise Certificate.
What an Enterprise certificate actually is
Detailed explanation of the Enterprise (In-House) certificate program — eligibility, install flow, and the revoke risk. Apple Enterprise Certificate Explained.
AltStore vs SideStore vs TrollStore
The three free sideloading tools. Each solves a different problem; one is iOS-version restricted. Comparison: AltStore vs SideStore vs TrollStore.
How to evaluate a paid signing service
Seven concrete criteria for choosing a service — beyond what the homepage tells you. How to Choose an IPA Signing Service.
Alternatives to Scarlet and ESign
If you've been burned by shared-cert installers, here's what works instead: Scarlet and ESign Alternatives.
5. Specific use cases & iOS versions
iOS 17 specific guide
What changed in iOS 17 for sideloading, the updated trust flow, and known issues. Install IPA on iOS 17.
iOS 18 specific guide
The EU's Digital Markets Act split iOS 18 into two sideloading worlds. Here's what changed and what didn't. Install IPA on iOS 18.
Enterprise distribution for companies
Practical playbook for getting an iOS app onto employee phones — MDM, Apple Business Manager, or direct Enterprise signing. Enterprise iOS App Distribution for Companies.
6. Next steps
If you've made it this far, you have a complete map of iOS IPA signing. The practical question is which path fits your situation:
- Testing your own app on your own device? → Developer signing.
- Distributing to a team, clients, or customers? → Enterprise signing.
- Already have a signed IPA that stopped working? → re-signing as an add-on.
- Free option for personal use? → AltStore or SideStore (with the weekly-resign tradeoff).
We offer both Developer ($99) and Enterprise ($259) signing with fresh certificate rotation, free re-signs if a revoke happens, and turnaround usually under 10 minutes.