Expo App Store Launch Checklist (2026)

To take an Expo app from finished code to Ready for Review: enroll in the Apple Developer Program, register your bundle ID, create the app record in App Store Connect, build with eas build --platform ios --profile production and upload with eas submit --platform ios, then complete the remaining App Store Connect pages (App Privacy, age rating, screenshots, review notes with a demo account) before you add the build for review. Since April 28, 2026, App Store Connect only accepts builds made with Xcode 26 or later, so check your build image if you pinned an old one.

Below is every step in the order we'd do it, with the rule or doc behind each one. Rules were checked against Apple's and Expo's documentation on November 3, 2026.

1. Accounts

• Apple Developer Program, $99 a year. Enroll as an organization if you want your company name on the App Store; that requires a D-U-N-S Number.
• Expo account and EAS CLI: npm install --global eas-cli, then eas login. EAS Build and EAS Submit run in the cloud, so you don't need a Mac.
• Paid Apps Agreement, if you sell anything. The Account Holder signs it under Business in App Store Connect, along with tax and banking. In-app purchases won't work, even in testing, until it's active.

2. Settle the bundle ID and project config

Set ios.bundleIdentifier in app.json, for example com.yourcompany.yourapp. Choose carefully: once you upload a build, you can't change it. EAS registers the identifier on the Apple Developer site the first time it builds, or you can register it yourself under Identifiers.

Then run npx expo-doctor and fix what it reports. A dependency mismatch caught here costs a minute; caught after a 20-minute cloud build, it costs the build.

3. Create the App Store Connect record

1. In App Store Connect → Apps, click + → New App.
2. Choose iOS, then enter the name (2 to 30 characters, and it must not already be taken on the store), the primary language, your bundle ID, and a SKU (an internal ID only you see).
3. Open App Information and copy the Apple ID. EAS Submit calls it ascAppId.

4. Create an App Store Connect API key

An API key lets EAS Submit, Fastlane and other tools talk to App Store Connect without your Apple ID password or two-factor prompts.

1. The Account Holder requests API access once: Users and Access → Integrations → Request Access.
2. An Account Holder or Admin then opens Team Keys, clicks Generate API Key, names it, and picks a role. Choose the lowest role your tools need; RevenueCat's product import, for example, needs at least App Manager.
3. Download the .p8 file (Apple lets you download it once) and note the Key ID and the Issuer ID.

Hand it to EAS with eas credentials --platform ios → App Store Connect: Manage your API Key, or point ascApiKeyPath, ascApiKeyIssuerId and ascApiKeyId at it in eas.json. Keep the .p8 out of git.

5. Capabilities and entitlements

In an Expo app, your config decides the capabilities: ios.usesAppleSignIn for Sign in with Apple, the expo-notifications plugin for push, ios.associatedDomains for universal links, and so on. EAS Build syncs these to your App ID on every build, as described in Expo's iOS capabilities docs. That sync also turns off any capability that's enabled in the portal but missing from your entitlements, so if a capability vanishes after a build, the fix belongs in app.json.

Also set export compliance once instead of answering it for every build. If your app only uses standard encryption such as HTTPS, add this, and confirm it applies to you using Apple's encryption export guidance:

{
  "expo": {
    "ios": {
      "config": { "usesNonExemptEncryption": false }
    }
  }
}

6. Version and build numbers

version is the version users see (1.0.0). ios.buildNumber must be unique for every upload. Let EAS manage the build number for you:

{
  "cli": { "appVersionSource": "remote" },
  "build": {
    "production": { "autoIncrement": true }
  },
  "submit": {
    "production": { "ios": { "ascAppId": "1234567890" } }
  }
}

That's eas.json. The remote version source is Expo's recommended setting since EAS CLI 12.

7. Build and upload

eas build --platform ios --profile production
eas submit --platform ios

# or both in one step
eas build --platform ios --profile production --auto-submit

After upload, the build shows up in TestFlight once Apple finishes processing it, which Expo's docs put at 10 to 15 minutes in most cases. If Apple finds a problem, such as a missing privacy manifest reason, you get an email shortly after upload.

Two platform minimums to know: builds must use Xcode 26 or later with the iOS 26 SDK (since April 28, 2026), and apps must target iOS 13 or later (since September 9, 2026). Current Expo SDKs already target far newer iOS versions, so the second one only bites very old projects. Apple's Upcoming Requirements page lists both.

8. Test with TestFlight

• Internal testers: people on your App Store Connect team, with a cap of 100. Builds are available to them right after processing.
• External testers: up to 10,000 people by email or public link. The first build you send them needs TestFlight App Review approval.
• Each build can be tested for up to 90 days.

On a TestFlight build, test the paths reviewers will try: sign up, sign in, purchase and restore with a sandbox account, push permission, and account deletion. TestFlight subscriptions renew once every 24 hours, so a "monthly" test plan won't lapse in minutes the way it does in the sandbox.

9. Privacy: manifest, App Privacy answers, policy

Privacy manifest

Since May 1, 2024, uploads must declare approved reasons for "required reason" APIs (UserDefaults, file timestamps, system boot time, disk space and active keyboards), including calls made by third-party SDKs. In Expo, declare them under ios.privacyManifests in app.json. Expo SDK packages ship their own manifests, but Apple doesn't always read manifests from static CocoaPods, so Expo's privacy manifest guide suggests copying their reasons into your app config.

{
  "expo": {
    "ios": {
      "privacyManifests": {
        "NSPrivacyAccessedAPITypes": [
          {
            "NSPrivacyAccessedAPIType": "NSPrivacyAccessedAPICategoryUserDefaults",
            "NSPrivacyAccessedAPITypeReasons": ["CA92.1"]
          }
        ]
      }
    }
  }
}

App Privacy answers

In App Store Connect, under App Privacy, declare every type of data your app and its SDKs collect, whether it's linked to the user, and whether it's used for tracking. Include what your backend and SDKs collect: auth providers, Supabase or Convex, RevenueCat, crash reporting, analytics. If you track users across other companies' apps or sites, you also need the App Tracking Transparency prompt. Apple's App Privacy details page defines each category.

Privacy policy

Every iOS app needs a privacy policy URL in App Store Connect and an easy-to-find link inside the app (Guideline 5.1.1(i)).

10. Account deletion, if your app has sign-in

Guideline 5.1.1(v): if users can create an account, they must be able to start deleting it inside the app. Apple's account deletion guidance adds the details reviewers check:

• Put the option somewhere easy to find, usually account settings.
• Delete the account and its personal data. Deactivating alone isn't enough.
• If deletion finishes on your website, link straight to that page.
• Outside highly regulated industries, don't make people call, email or chat with support to delete.
• Guest accounts your app creates automatically count too.
• Apps using Sign in with Apple should revoke the user's tokens through Apple's REST API.
• If the user has an active subscription, tell them billing continues through Apple and how to cancel.

11. The login rule

Guideline 4.8: if the primary account can be created with a third-party login such as Google or Facebook, you must also offer an equivalent login that limits data to name and email, lets users hide their email, and doesn't track for ads without consent. Sign in with Apple qualifies. Apps that only use their own account system are exempt, as are some enterprise, education and government-ID apps. See our Sign in with Apple guide for the Expo setup.

12. Age rating, EU trader status and other forms

• Age rating: answer the questionnaire in App Information. Apple's current ratings are 4+, 9+, 13+, 16+ and 18+, and apps had to answer the updated questions by January 31, 2026 to keep submitting updates.
• EU Digital Services Act: if your app is on the App Store in the EU, you must declare whether you're a trader. Traders provide contact details that Apple verifies and shows on the product page. Since February 17, 2025, apps without a trader status have been removed from the EU storefronts until it's provided.
• Pricing and Availability: price (or free) and the countries you ship to.
• Content rights: declare whether the app shows third-party content.

13. Screenshots

Apple's screenshot specifications list what's required right now:

• iPhone: at least one screenshot for "iPhone with Dynamic Island (medium display)", which is 1206 × 2622 or 1179 × 2556 pixels in portrait. The iPhone 17 and 17 Pro simulators save screenshots at 1206 × 2622.
• iPad: if your app runs on iPad, at least one 13-inch screenshot (2064 × 2752 or 2048 × 2732). If app.json sets ios.supportsTablet to true, your app runs on iPad.
• Other sizes, including the large Dynamic Island size of 1320 × 2868 (iPhone 17 Pro Max), are optional. If your layout is the same across devices, App Store Connect scales the screenshots you provide for the sizes you skip.
• Up to 10 per size, as .png or .jpg, with no transparency.

Apple's page also flags iPhone Duo screenshots, which become required in April 2027 for apps built with the iOS 27.1 SDK or later. Capture real screens from the simulator; for a quick capture, run xcrun simctl io booted screenshot shot.png.

14. Product page text

• Subtitle: up to 30 characters.
• Keywords: up to 100 bytes, comma-separated.
• Description: up to 4,000 characters of plain text.
• Promotional text: up to 170 characters, and you can change it without a new submission.
• Support URL: must lead to real contact information.
• Copyright, and optionally a marketing URL.

If you sell subscriptions, add working links to your privacy policy and Terms of Use (EULA) in the metadata as well as in the app (Guideline 3.1.2).

15. Review notes and demo account

Under App Review Information on the version page:

• Sign-in information: if any feature needs an account, give a working demo username and password, and keep your backend running during review. Guideline 2.1 lists missing demo access as a reason for rejection.
• Notes: explain anything a reviewer can't find alone, such as features behind a purchase, hardware the app pairs with, or region-limited content.
• Contact information for the person Apple should reach.
• If this release adds your first in-app purchase or subscription, attach it to this version.

16. Submit

1. On the version page, under Build, select the TestFlight build you tested.
2. Choose a release option: manual, automatic after approval, or scheduled.
3. Click Add for Review. The version now shows Ready for Review: everything is filled in and added to a submission, but not yet sent.
4. Click Submit to App Review. The status changes to Waiting for Review.

The short version

1. Apple Developer Program, Expo account, Paid Apps Agreement if selling.
2. Final bundle ID in app.json; npx expo-doctor passes.
3. App Store Connect record created; ascAppId copied.
4. App Store Connect API key created and stored outside git.
5. Capabilities declared in app config; export compliance set.
6. Remote build numbers with autoIncrement.
7. Production build uploaded with EAS Submit (Xcode 26 or later).
8. TestFlight run of sign-in, purchases, push and deletion.
9. Privacy manifest reasons, App Privacy answers, privacy policy link.
10. In-app account deletion if there's sign-in.
11. Sign in with Apple or an equivalent if there's third-party login.
12. Age rating, DSA trader status, pricing, content rights.
13. iPhone screenshots, and 13-inch iPad ones if you support iPad.
14. Subtitle, keywords, description, support URL.
15. Demo account and review notes.
16. Build selected, Add for Review, Submit to App Review.

Where AppSetUpKit fits

AppSetUpKit automates the first part of this list. Its setup wizard registers your bundle ID, creates the App Store Connect app record and turns on the Sign in with Apple and Push Notifications capabilities through Fastlane, using your own App Store Connect API key, and fastlane-metadata-setup.sh uploads the name, subtitle, keywords and description. Screenshots, App Privacy answers, review notes and the final submit stay with you. See what's in the kit.