New to the API? This page shows you the fastest path from an unsigned IPA to a signed, installable app.

Step 1 — Choose a signing method

---

Path A — Sign with Free Enterprise Cert (one-shot)

The simplest path. No certificate needed — we use our shared enterprise certificate.

curl -X POST https://api.cococloud-signing.vip/v2/free-enterprise/sign \
  -H "X-API-Key: YOUR_API_KEY" \
  -F "[email protected]"

Response includes a download_url and an ota_url (itms-services://…) for direct on-device install.

---

Path B — Sign with Your Own Certificate (one-shot)

Upload your IPA, P12, and mobileprovision in a single request.

curl -X POST https://api.cococloud-signing.vip/v2/customsign \
  -H "X-API-Key: YOUR_API_KEY" \
  -F "[email protected]" \
  -F "[email protected]" \
  -F "[email protected]" \
  -F "password=YourP12Password"

curl -X POST https://api.cococloud-signing.vip/v2/customsign \
  -H "X-API-Key: YOUR_API_KEY" \
  -F "[email protected]" \
  -F "user_cert_id=YOUR_SAVED_CERT_ID"

---

Path C — App Library: Upload → Sign → Share (3 steps)

Best for apps you want to keep, re-sign later, or share a download link for. The signed file stays in your file manager permanently.

STEP 1 — Upload the IPA

curl -X POST https://api.cococloud-signing.vip/v2/apps/upload \
  -H "X-API-Key: YOUR_API_KEY" \
  -F "[email protected]" \
  -F "access_status=0" \
  -F "expiry_duration=30d"

Save the data.id from the response — you need it for the next steps.

STEP 2 — Sign the app

# Sign with enterprise cert (simplest)
curl -X POST https://api.cococloud-signing.vip/v2/apps/APP_ID/sign \
  -H "X-API-Key: YOUR_API_KEY"

# — OR — sign with your own cert
curl -X POST https://api.cococloud-signing.vip/v2/apps/APP_ID/sign \
  -H "X-API-Key: YOUR_API_KEY" \
  -F "user_cert_id=YOUR_SAVED_CERT_ID"

The sign response includes the updated app object with ota_url, plist_url, and download_url.

STEP 3 — Get a shareable download link

curl -X POST "https://api.cococloud-signing.vip/v2/apps/APP_ID/download-link?expires=18000" \
  -H "X-API-Key: YOUR_API_KEY"

Returns a signed URL valid for up to 5 hours. Anyone with the URL can download the IPA — no API key needed.

---

Common Signing Options

These parameters work across all three signing methods:

• bundleId — Override bundle identifier (e.g. com.mycompany.myapp)
• bundleName — Override the display name
• bundle_version — Override version string (e.g. 2.1.0)
• bypassapplerevokes / random_bundle_id — Append a random suffix to the bundle ID to bypass revocation checks
• remove_prov — Strip the embedded mobileprovision from the signed IPA
• ipa_compression — Zip compression level for the output IPA, 0-9 (0 = store/no compression, 9 = max compression). Defaults to 0 for the fastest sign time.

---

The API enforces several limits based on your account plan. These apply to all signing and App Library endpoints.

Programmatic Plan Detection

You can programmatically check your plan status and limits by inspecting the response headers of any API request:

• X-Plan-Type: Returns Pro or Standard
• X-Plan-Limit: Returns your upload limit (e.g., 3.95 GB standard, Unlimited Pro)

Use this endpoint to sign IPA files with your own Certificate (.p12) and Provisioning Profile.

---

Endpoint

POST https://api.cococloud-signing.vip/v2/customsign

Authentication

Include your API Key in the request header:

X-API-Key: YOUR_API_KEY

Parameters

• ipa: The IPA file or direct download URL (Required)
• user_cert_id: ID of a certificate saved to your account — replaces cert + provision New
• cert: The Certificate (.p12) file — required if not using user_cert_id
• provision: The Provisioning Profile — required if not using user_cert_id
• password: Certificate Password — optional when using user_cert_id (auto-resolved from your saved cert)
• bundleId: New Bundle ID (Optional)
• bundleName: New Bundle Name (Optional)
• bundle_version: New Bundle Version (e.g. '1.0.0') (Optional)
• random_bundle_id: Set to 'true' or '1' to append a random suffix to the bundle ID (Revoke Bypass) (Optional)
• remove_prov: Set to 'true' or '1' to remove the embedded mobileprovision file (Optional)
• ipa_compression: Zip compression level for the output IPA, 0-9 (Optional, default: 0 — fastest, no compression)

Example Request (cURL)

curl -X POST https://api.cococloud-signing.vip/v2/customsign \
  -H "X-API-Key: YOUR_API_KEY" \
  -F "[email protected]" \
  -F "[email protected]" \
  -F "[email protected]" \
  -F "password=secret" \
  -F "random_bundle_id=1" \
  -F "bundle_version=1.0.0"

Example Request with URL (cURL)

curl -X POST https://api.cococloud-signing.vip/v2/customsign \
  -H "X-API-Key: YOUR_API_KEY" \
  -F "ipa=https://example.com/app.ipa" \
  -F "[email protected]" \
  -F "[email protected]" \
  -F "password=secret"

Example Request with Saved Certificate (cURL) New

Use a certificate saved to your CocoCloud account. No file uploads needed — the platform handles everything.

curl -X POST https://api.cococloud-signing.vip/v2/customsign \
  -H "X-API-Key: YOUR_API_KEY" \
  -F "ipa=https://example.com/app.ipa" \
  -F "user_cert_id=1" \
  -F "random_bundle_id=1"

Example Response

{
  "success": true,
  "jobId": "6982c42f673c8",
  "message": "IPA signed successfully",
  "downloadUrl": "https://cococloud-signing.vip/storage/signed/6982c42f673c8_app.ipa",
  "manifestUrl": "https://cococloud-signing.vip/storage/signed/6982c42f673c8_app.plist",
  "itmsServicesUrl": "itms-services://?action=download-manifest&url=https%3A%2F%2Fcococloud-signing.vip%2Fstorage%2Fsigned%2F6982c42f673c8_app.plist",
  "installUrl": "https://cococloud-signing.vip/ota/6982c42f673c8_app.plist",
  "signingTime": "0.12s",
  "performance": "⚡ Lightning Fast",
  "appInfo": {
    "bundleId": ".fj9prv",
    "bundleName": "Noir",
    "bundleVersion": "1.0.0"
  },
  "appSize": {
    "input": "14.21 MB",
    "output": "14.22 MB"
  }
}

Error Response

{
  "error": "File size exceeds your plan limit (3.95 GB). Please upgrade to Pro."
}

The App Library lets you upload, manage, sign, and copy IPA files through the API. Unlike the one-shot signing endpoints, apps stored here are persistent and appear in your file manager, and can be re-signed at any time.

Pro apps never expire by default (set expiry_duration on upload for a shorter one). Standard-tier apps always expire — 190 days by default, or sooner if you set a shorter expiry_duration.

---

POST /v2/apps/upload — Upload IPA

Stores an IPA in your library and parses its metadata (app name, bundle ID, version, icon). The app is not signed.

Parameters

• ipa required: IPA file upload or direct download URL or use ipa_chunk_upload_id for large files
• access_status: 1 (public, default) / 0 (private — only visible to you)
• expiry_duration: 1h / 6h / 1d / 3d / 7d / 30d — omit for permanent (Pro only; standard users are capped at plan max)
• description: optional, shown on the public share page — max 1000 characters
• password: optional — password-protects the share page (max 255 characters; ignored if password protection is disabled for your plan)
• allow_download: true (default) / false
• allow_ota_install: true (default) / false

Example (cURL)

curl -X POST https://api.cococloud-signing.vip/v2/apps/upload \
  -H "X-API-Key: YOUR_API_KEY" \
  -F "[email protected]" \
  -F "access_status=1" \
  -F "expiry_duration=7d"

Example Response HTTP 201

{
  "success": true,
  "data": {
    "id": "abc123xyz12345",
    "name": "abc123xyz12345_MyApp",
    "description": null,
    "app_name": "My Application",
    "bundle_id": "com.example.myapp",
    "version": "2.1.0",
    "size": 12345678,
    "size_label": "11.77 MB",
    "extension": "ipa",
    "is_signed": false,
    "signed_at": null,
    "signed_with_cert_name": null,
    "signed_with_cert_type": null,
    "is_revoked": false,
    "expiry_at": "2026-08-15T19:17:50-04:00",
    "is_expired": false,
    "allow_download": true,
    "allow_ota_install": true,
    "allow_copy_to_library": true,
    "has_password": false,
    "access_status": 1,
    "icon_url": "https://cococloud-signing.vip/storage/icons/uuid.png",
    "download_url": "https://api.cococloud-signing.vip/v2/apps/abc123xyz12345/download",
    "ota_url": null,
    "plist_url": null,
    "share_url": "https://cococloud-signing.vip/abc123xyz12345",
    "created_at": "2026-08-08T19:17:50-04:00"
  }
}

---

GET /v2/apps — List Apps

Query Parameters

• page: Page number (default: 1)
• per_page: Results per page, max 100 (default: 20)
• signed_only: true to return only signed apps
• include_expired: true to include expired apps
• cert_type: Filter by saved, enterprise, or custom

curl "https://api.cococloud-signing.vip/v2/apps?signed_only=true&per_page=10" \
  -H "X-API-Key: YOUR_API_KEY"

Example Response

{
  "success": true,
  "data": [ { ...app object... }, ... ],
  "meta": {
    "total": 42,
    "per_page": 20,
    "current_page": 1,
    "last_page": 3
  }
}

---

GET /v2/apps/{id} — Get App

Returns the full app object. The id is the shared_id returned by upload / list.

curl "https://api.cococloud-signing.vip/v2/apps/abc123xyz12345" \
  -H "X-API-Key: YOUR_API_KEY"

---

GET /v2/apps/{id}/download — Download IPA

Streams the IPA file directly. Accepts either your API key or a pre-signed URL generated by POST /v2/apps/{id}/download-link.

curl "https://api.cococloud-signing.vip/v2/apps/abc123xyz12345/download" \
  -H "X-API-Key: YOUR_API_KEY" \
  -L -O -J

---

POST /v2/apps/{id}/download-link — Generate Download Link

Returns a temporary signed URL that lets anyone download the IPA without an API key — useful for sharing or automating installs.

Parameters

• expires: Lifetime in seconds. Default 3600 (1 hour). Maximum 18000 (5 hours).

Example (cURL)

curl -X POST "https://api.cococloud-signing.vip/v2/apps/abc123xyz12345/download-link?expires=7200" \
  -H "X-API-Key: YOUR_API_KEY"

Example Response HTTP 200

{
  "success": true,
  "url": "https://cococloud-signing.vip/api/v2/apps/abc123xyz12345/download?expires=...&signature=...",
  "expires_at": "2026-08-08T20:17:50-04:00",
  "expires_in": 3600
}

The signed URL is valid until expires_at. Anyone with the URL can download the file — treat it like a temporary password.

---

POST /v2/apps/{id}/sign — Sign App

Signs an IPA already in your library. Uses the same certificate options as the other signing endpoints. The FileEntry is updated in-place by default; pass output_type=copy to create a new entry and keep the original.

Certificate Options (choose one)

Signing Options

• bundleId: Override bundle identifier (Optional)
• bundleName: Override display name (Optional)
• bundle_version: Override version string (Optional)
• bypassapplerevokes: 1 to append random suffix to bundle ID (Optional)
• remove_prov: 1 to strip embedded mobileprovision (Optional)
• ipa_compression: Zip compression level for the output IPA, 0-9 (Optional, default: 0 — fastest, no compression)
• output_type: copy to leave original untouched and create a new entry (Optional)

Example — Sign with Enterprise Cert (cURL)

curl -X POST https://api.cococloud-signing.vip/v2/apps/abc123xyz12345/sign \
  -H "X-API-Key: YOUR_API_KEY"

Example — Sign with Custom Cert (cURL)

curl -X POST https://api.cococloud-signing.vip/v2/apps/abc123xyz12345/sign \
  -H "X-API-Key: YOUR_API_KEY" \
  -F "[email protected]" \
  -F "[email protected]" \
  -F "password=secret" \
  -F "bypassapplerevokes=1"

Example Response

{
  "success": true,
  "signing_time": "0.14s",
  "data": {
    "id": "abc123xyz12345",
    "app_name": "My Application",
    "bundle_id": "com.example.myapp",
    "version": "2.1.0",
    "is_signed": true,
    "signed_at": "2026-08-08T19:17:50-04:00",
    "signed_with_cert_name": "Enterprise Cert A",
    "signed_with_cert_type": "enterprise",
    "ota_url": "itms-services://?action=download-manifest&url=...",
    "plist_url": "https://cococloud-signing.vip/storage/users/1/signed/abc123.plist",
    "download_url": "https://api.cococloud-signing.vip/v2/apps/abc123xyz12345/download",
    ...
  }
}

---

POST /v2/apps/{id}/copy — Copy a Shared App

Clones any public shared app into your own library — the same action as the "Copy to My Library" button on a share page. Unlike every other /v2/apps/{id} endpoint, {id} here is any public shared_id, not necessarily one you own.

Parameters

• password: required only if the source app is password-protected — unlocks the source, it is not the password for your copy
• expiry_duration: 1h / 6h / 1d / 3d / 7d / 30d — omit for permanent. Applied through the same tier-aware system as uploads and signing — never hardcoded, always capped to your actual plan limit
• new_password: optional — password-protects your new copy's share page (max 255 characters; ignored if password protection is disabled for your plan)

Example (cURL)

curl -X POST https://api.cococloud-signing.vip/v2/apps/{shared_id}/copy \
  -H "X-API-Key: YOUR_API_KEY" \
  -d "expiry_duration=7d" \
  -d "new_password=mySecret123"

Example Response HTTP 201

{
  "success": true,
  "data": { ...app object, now owned by you... }
}

Error Responses

• 403 {"error": "...", "pro_required": true} — you are not a Pro member
• 403 — the owner disabled copying or downloads for this app
• 422 — this app is already yours
• 413 — copying it would exceed your storage quota

---

PATCH /v2/apps/{id} — Update App

Update metadata or expiry. All fields optional — only send what you want to change.

• name: Display name (string)
• description: shown on the public share page — max 1000 characters
• expiry_at: ISO-8601 datetime, or null to never expire (Pro only)
• allow_download: true / false
• allow_ota_install: true / false
• allow_copy_to_library: true / false — lets Pro members copy this app into their own library from the share page (default: true)
• access_status: 1 (public) / 0 (private)
• password: set/change the share-page password (max 255 characters); send an empty string to remove it (ignored if password protection is disabled for your plan)

curl -X PATCH https://api.cococloud-signing.vip/v2/apps/abc123xyz12345 \
  -H "X-API-Key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"expiry_at": "2026-09-07T19:17:50-04:00", "allow_download": true}'

---

DELETE /v2/apps/{id} — Delete App

Permanently deletes the app and its associated IPA / plist files from storage.

curl -X DELETE https://api.cococloud-signing.vip/v2/apps/abc123xyz12345 \
  -H "X-API-Key: YOUR_API_KEY"

Response

{ "success": true, "message": "App deleted." }

---

Common Error Responses

Validate iOS certificates (.p12) and provisioning profiles (.mobileprovision) with real-time certificate status checking.

---

Endpoint

POST https://api.cococloud-signing.vip/v2/certcheckerstatus

Authentication

Include your API Key in the request header:

X-API-Key: YOUR_API_KEY

Parameters

• file: The certificate (.p12) or provisioning profile (.mobileprovision) file, or a direct download URL (Required)
• password: Certificate password (Required for .p12 files, ignored for .mobileprovision)

Example Request - P12 Certificate (cURL)

curl -X POST https://api.cococloud-signing.vip/v2/certcheckerstatus \\
  -H "X-API-Key: YOUR_API_KEY" \\
  -F "[email protected]" \\
  -F "password=your_password"

Example Request - MobileProvision (cURL)

curl -X POST https://api.cococloud-signing.vip/v2/certcheckerstatus \\
  -H "X-API-Key: YOUR_API_KEY" \\
  -F "[email protected]"

Example Request - P12 from URL (cURL)

curl -X POST https://api.cococloud-signing.vip/v2/certcheckerstatus \\
  -H "X-API-Key: YOUR_API_KEY" \\
  -F "file=https://example.com/certificate.p12" \\
  -F "password=your_password"

Example Request - MobileProvision from URL (cURL)

curl -X POST https://api.cococloud-signing.vip/v2/certcheckerstatus \\
  -H "X-API-Key: YOUR_API_KEY" \\
  -F "file=https://example.com/profile.mobileprovision"

Example Response - P12 File

{
  "success": true,
  "data": {
    "certificate_info": {
      "subject": {
        "userID": "VD7465CKUB",
        "commonName": "iPhone Distribution: Jiangsu Simcere Pharmaceutical Co.,Ltd",
        "organizationalUnitName": "VD7465CKUB",
        "organizationName": "Jiangsu Simcere Pharmaceutical Co.,Ltd",
        "countryName": "US"
      },
      "issuer": {
        "commonName": "Apple Worldwide Developer Relations Certification Authority",
        "organizationalUnitName": "G3",
        "organizationName": "Apple Inc.",
        "countryName": "US"
      },
      "validity_period": {
        "valid_from": "2025-03-07T09:22:42+00:00",
        "valid_to": "2028-03-06T09:22:41+00:00"
      },
      "fingerprints": {
        "sha256": "82185c7f97d1e39c95ce905535f98a2b5a96f920fe8ecc5279f0697a6f0670d0"
      }
    },
    "certificate_status": {
      "status": "Revoked"
    },
    "entitlements": "Entitlements are not applicable for p12 files",
    "type": "N/A"
  },
  "message": "Certificate validated successfully"
}

Example Response - MobileProvision File

{
  "success": true,
  "message": "Certificate validated successfully",
  "data": {
    "certificate_info": {
      "subject": { ... },
      "issuer": { ... },
      "validity_period": { ... },
      "fingerprints": { ... }
    },
    "certificate_status": {
      "status": "Revoked",
      "reason": "cessationOfOperation (5)",
      "reason_details": "The certificate is no longer needed",
      "revocation_time": "2024-11-19T02:05:29Z"
    },
    "entitlements": {
      "Push Notifications": { "status": "active" },
      "App Groups": { "status": "active" },
      "Associated Domains": { "status": "active" }
    },
    "type": "Enterprise Certificate",
    "mobileprovision_info": {
      "Name": "iOS Team Inhouse Provisioning Profile",
      "UUID": "cc32b862-80f8-4aa3-bfca-54908f3533eb",
      "TeamName": "Example Team",
      "ExpirationDate": "2026-04-09T12:50:26"
    }
  }
}

Parameters (Dual Mode)

• file: P12 certificate file or URL (Required)
• mobileprovision: Mobileprovision file or URL (Required for dual mode)
• password: Password for P12 (Optional)

Example Request - Dual Mode (cURL)

curl -X POST https://api.cococloud-signing.vip/v2/certcheckerstatus \\
  -H "X-API-Key: YOUR_API_KEY" \\
  -F "[email protected]" \\
  -F "password=your_password" \\
  -F "[email protected]"

Example Response - Dual Mode

{
  "success": true,
  "message": "Both files validated successfully",
  "p12_certificate": {
    "certificate_info": { ... },
    "certificate_status": { "status": "Signed" },
    "entitlements": "Not applicable for p12",
    "type": "N/A"
  },
  "mobileprovision": {
    "certificate_info": { ... },
    "certificate_status": { "status": "Signed" },
    "entitlements": {
      "Push Notifications": { "status": "active" }
    },
    "type": "Enterprise Certificate",
    "mobileprovision_info": {
      "Name": "iOS Team Inhouse Provisioning Profile",
      "UUID": "cc32b862-80f8-4aa3-bfca-54908f3533eb"
    }
  }
}

Certificate Status Values

• Signed: Certificate is valid and active
• Revoked: Certificate has been revoked by Apple
• Unknown: OCSP status could not be determined

Error Response

{
  "success": false,
  "message": "Error description"
}

Change the password of a P12 certificate file. Upload a certificate or provide a URL, and get back a new P12 file with the updated password.

---

Endpoint

POST https://api.cococloud-signing.vip/v2/p12passwordchanger

Authentication

Include your API Key in the request header:

X-API-Key: YOUR_API_KEY

Parameters

• file: The P12 certificate file or direct download URL (Required)
• old_password: Current/old password of the P12 file (Required, use empty string if no password)
• new_password: New password to set (Required)

Example Request - File Upload (cURL)

curl -X POST https://api.cococloud-signing.vip/v2/p12passwordchanger \\
  -H "X-API-Key: YOUR_API_KEY" \\
  -F "[email protected]" \\
  -F "old_password=current_password" \\
  -F "new_password=new_secure_password" \\
  --output certificate_new_password.p12

Example Request - From URL (cURL)

curl -X POST https://api.cococloud-signing.vip/v2/p12passwordchanger \\
  -H "X-API-Key: YOUR_API_KEY" \\
  -F "file=https://example.com/certificate.p12" \\
  -F "old_password=current_password" \\
  -F "new_password=new_secure_password" \\
  --output certificate_new_password.p12

Response

On success, the API returns the new P12 file with the changed password as a binary download. The response includes custom headers:

• Content-Type: application/x-pkcs12
• Content-Disposition: attachment; filename="certificate_new_password.p12"
• X-Success: true
• X-Message: Password changed successfully

Error Response

{
  "success": false,
  "message": "Failed to change password",
  "error": "Error details"
}

Sign IPA files using our pre-configured enterprise certificate. This is the simplest way to sign apps.

---

Endpoint

POST https://api.cococloud-signing.vip/v2/free-enterprise/sign

Authentication

Include your API Key in the request header:

X-API-Key: YOUR_API_KEY

Parameters

• ipa: The IPA file or direct download URL (Required)
• bundleId: New Bundle ID (Optional)
• bundleName: New Bundle Name (Optional)
• bundle_version: New Bundle Version (e.g. '1.0.0') (Optional)
• random_bundle_id: Set to 'true' or '1' to append a random suffix to the bundle ID (Revoke Bypass) (Optional)
• remove_prov: Set to 'true' or '1' to remove the embedded mobileprovision file (Optional)
• ipa_compression: Zip compression level for the output IPA, 0-9 (Optional, default: 0 — fastest, no compression)
• enterprise_mp_id: Mobileprovision file ID to use for signing (Optional) Pro Feature

Example Request (cURL)

curl -X POST https://api.cococloud-signing.vip/v2/free-enterprise/sign \
  -H "X-API-Key: YOUR_API_KEY" \
  -F "[email protected]" \
  -F "random_bundle_id=1"

Example Request with URL (cURL)

curl -X POST https://api.cococloud-signing.vip/v2/free-enterprise/sign \\
  -H "X-API-Key: YOUR_API_KEY" \\
  -F "ipa=https://example.com/app.ipa"

Example Request with Mobileprovision Selection (Pro Users)

curl -X POST https://api.cococloud-signing.vip/v2/free-enterprise/sign \\
  -H "X-API-Key: YOUR_API_KEY" \\
  -F "[email protected]" \\
  -F "enterprise_mp_id=3"

Use the Shared Enterprise Certs API to get available mobileprovision IDs.

Example Response

{
  "success": true,
  "jobId": "6982c4a2ed391",
  "message": "IPA signed successfully",
  "downloadUrl": "https://cococloud-signing.vip/storage/signed/6982c4a2ed391_app.ipa",
  "manifestUrl": "https://cococloud-signing.vip/storage/signed/6982c4a2ed391_app.plist",
  "itmsServicesUrl": "itms-services://?action=download-manifest&url=https%3A%2F%2Fcococloud-signing.vip%2Fstorage%2Fsigned%2F6982c4a2ed391_app.plist",
  "installUrl": "https://cococloud-signing.vip/ota/6982c4a2ed391_app.plist",
  "signingTime": "0.09s",
  "performance": "⚡ Lightning Fast",
  "appInfo": {
    "bundleId": "nl.jeffreykuiken.NoirApp",
    "bundleName": "Noir",
    "bundleVersion": "2025.2.6"
  },
  "appSize": {
    "input": "14.21 MB",
    "output": "14.21 MB"
  },
  "certificate_info": {
    "cert_name": "Jiangsu Simcere Pharmaceutical Co.,Ltd",
    "cer_status": "Revoked",
    "revoked_from": null
  }
}

Error Response - File Size Limit

{
  "error": "File size exceeds your plan limit (3.95 GB). Please upgrade to Pro."
}

Error Response - Unauthorized Mobileprovision

{
  "error": "Standard users can only use the primary mobileprovision. Please upgrade to Pro for access to additional profiles."
}

HTTP Status: 403 Forbidden

Error Response - Invalid Mobileprovision ID

{
  "error": "Invalid mobileprovision ID"
}

HTTP Status: 404 Not Found

Same as Custom Signing, but callable with no API key at all — no account, no Bearer token, no X-API-Key header.

---

Endpoint

POST https://api.cococloud-signing.vip/v2/noauth/customsign

Authentication

None. Do not send an Authorization or X-API-Key header.

Parameters

• ipa: The IPA file or direct download URL (Required)
• cert: The Certificate (.p12) file (Required)
• provision: The Provisioning Profile (Required)
• password: Certificate Password (Optional)
• bundleId: New Bundle ID (Optional)
• bundleName: New Bundle Name (Optional)
• bundle_version: New Bundle Version (e.g. '1.0.0') (Optional)
• random_bundle_id: Set to 'true' or '1' to append a random suffix to the bundle ID (Revoke Bypass) (Optional)
• remove_prov: Set to 'true' or '1' to remove the embedded mobileprovision file (Optional)
• ipa_compression: Zip compression level for the output IPA, 0-9 (Optional, default: 0 — fastest, no compression)

Example Request — Direct File Upload (cURL)

curl -X POST https://api.cococloud-signing.vip/v2/noauth/customsign \
  -F "[email protected]" \
  -F "[email protected]" \
  -F "[email protected]" \
  -F "password=secret"

Example Request — IPA via URL (cURL)

ipa also accepts a direct download URL instead of an uploaded file — cert and provision must still be uploaded files.

curl -X POST https://api.cococloud-signing.vip/v2/noauth/customsign \
  -F "ipa=https://example.com/app.ipa" \
  -F "[email protected]" \
  -F "[email protected]" \
  -F "password=secret"

Example Response

{
  "success": true,
  "id": "75987953",
  "install_url": "https://cococloud-signing.vip/en/noauthsigning/75987953",
  "message": "IPA signed successfully. Share install_url — download and OTA install are free there for everyone; non-Pro visitors just see the usual ads (with an optional ad-code to hide them for 5 minutes).",
  "signingTime": "0.31s",
  "expiresAt": "2026-08-09T01:17:50-04:00",
  "appInfo": {
    "bundleId": "com.example.app",
    "bundleName": "Example App",
    "bundleVersion": "1.0.0"
  },
  "appSize": {
    "input": "14.21 MB",
    "output": "14.21 MB"
  },
  "certificate_info": {
    "signing_method": "custom",
    "cert_name": "iPhone Distribution: Example Corp",
    "cert_status": "Signed"
  }
}

cert_name and cert_status are extracted from the uploaded cert at sign time (same validation used by the Certificate Checker API). cert_status may be null if it could not be determined.

Same as Free Enterprise Signing, but callable with no API key at all — signs against our shared enterprise certificate, no account required.

---

Endpoint

POST https://api.cococloud-signing.vip/v2/noauth/free-enterprise/sign

Authentication

None. Do not send an Authorization or X-API-Key header.

Parameters

• ipa: The IPA file or direct download URL (Required)
• enterprise_cert_id: Use a specific enterprise certificate instead of the latest usable one (Optional)
• bundleId: New Bundle ID (Optional)
• bundleName: New Bundle Name (Optional)
• bundle_version: New Bundle Version (e.g. '1.0.0') (Optional)
• random_bundle_id: Set to 'true' or '1' to append a random suffix to the bundle ID (Revoke Bypass) (Optional)
• remove_prov: Set to 'true' or '1' to remove the embedded mobileprovision file (Optional)
• ipa_compression: Zip compression level for the output IPA, 0-9 (Optional, default: 0 — fastest, no compression)

Example Request — Direct File Upload (cURL)

curl -X POST https://api.cococloud-signing.vip/v2/noauth/free-enterprise/sign \
  -F "[email protected]" \
  -F "random_bundle_id=1"

Example Request — IPA via URL (cURL)

ipa also accepts a direct download URL instead of an uploaded file.

curl -X POST https://api.cococloud-signing.vip/v2/noauth/free-enterprise/sign \
  -F "ipa=https://example.com/app.ipa" \
  -F "random_bundle_id=1"

Example Response

{
  "success": true,
  "id": "75987953",
  "install_url": "https://cococloud-signing.vip/en/noauthsigning/75987953",
  "message": "IPA signed successfully. Share install_url — download and OTA install are free there for everyone; non-Pro visitors just see the usual ads (with an optional ad-code to hide them for 5 minutes).",
  "signingTime": "0.09s",
  "expiresAt": "2026-08-09T01:17:50-04:00",
  "appInfo": {
    "bundleId": "com.example.app",
    "bundleName": "Example App",
    "bundleVersion": "1.0.0"
  },
  "appSize": {
    "input": "14.21 MB",
    "output": "14.21 MB"
  },
  "certificate_info": {
    "signing_method": "enterprise",
    "cert_name": "Jiangsu Simcere Pharmaceutical Co.,Ltd",
    "cert_status": "Revoked"
  }
}

cert_status reflects the enterprise certificate's status at the moment of signing.

Retrieve a list of all shared enterprise certificates available on the platform.

---

Endpoint

GET https://api.cococloud-signing.vip/v1/sharedenterprisecerts

Authentication

Use a Bearer token (recommended) or legacy API key:

• Bearer Token: Authorization: Bearer <token>
• Legacy: Include your API Key as a query parameter: ?YOUR_API_KEY

Parameters

• extra_mp: Filter mobileprovisions by index (e.g., extra_mp=1 returns the 1st MP, 2 for the 2nd). Optional.
• show_revoked: Set to true to return all revoked certificates. Default: false. Optional.

Example Request with Bearer Token (cURL)

curl -X GET "https://api.cococloud-signing.vip/v1/sharedenterprisecerts" \
  -H "Authorization: Bearer YOUR_TOKEN"

Example Request with Legacy Key (cURL)

curl -X GET "https://api.cococloud-signing.vip/v1/sharedenterprisecerts?sk_YOUR_API_KEY"

Example Request with Extra MP Filter (cURL)

curl -X GET "https://api.cococloud-signing.vip/v1/sharedenterprisecerts?sk_YOUR_API_KEY&extra_mp=2"

Example Request with Show Revoked (cURL)

curl -X GET "https://api.cococloud-signing.vip/v1/sharedenterprisecerts?sk_YOUR_API_KEY&show_revoked=true"

Example Response

{
  "success": true,
  "all_revoked": false,
  "certificates": [
    {
      "id": 26,
      "name": "Jiangsu Simcere Pharmaceutical Co.,Ltd",
      "organization": "Jiangsu Simcere Pharmaceutical Co.,Ltd",
      "status": "Revoked",
      "validity": {
        "not_before": "2025-03-07T09:22:42+00:00",
        "not_after": "2028-03-06T09:22:41+00:00"
      },
      "has_password": true,
      "password": "nabzclan.vip",
      "CertificateName": "Jiangsu Simcere Pharmaceutical Co.,Ltd",
      "CertificateStatus": "Revoked",
      "addedDate": "2026-07-04T00:24:04-04:00",
      "ExpirationDate": "2028-03-06T09:22:41+00:00",
      "Subject": { ... },
      "Issuer": { ... },
      "TeamName": "Jiangsu Simcere Pharmaceutical Co.,Ltd",
      "full_zipped_files_download_url": "https://api.cococloud-signing.vip/v1/downloadcert/26?expires=...",
      "p12_download_url": "https://api.cococloud-signing.vip/v1/downloadp12/26?expires=...",
      "mp_download_url": "https://api.cococloud-signing.vip/v1/downloadmobileprovision/46?expires=...",
      "mobileprovisions": [
        {
            "id": 46,
            "name": "New1.mobileprovision",
            "is_primary": true,
            "is_extra": false,
            "extra_mp": 1,
            "uuid": "b6faffb9-be71-4711-b11a-d5e79b38537a",
            "TeamName": "Jiangsu Simcere Pharmaceutical Co.,Ltd",
            "AppID": "VD7465CKUB",
            "AppIDName": "workone",
            "ExpirationDate": "2028-03-06T09:22:41+00:00",
            "CreationDate": "2025-03-07T09:22:42+00:00",
            "download_url": "https://api.cococloud-signing.vip/v1/downloadmobileprovision/46?expires=..."
        }
      ]
    }
  ]
}

Response Fields

• all_revoked: Boolean. true if all certificates are revoked. When true, only the latest revoked certificate is returned in the certificates array.
• id: Certificate unique identifier
• name: Certificate name/common name
• CertificateName: Alias for name
• organization: Organization name from certificate subject
• status: Certificate status (Signed/Revoked)
• CertificateStatus: Alias for status
• validity: Certificate validity period (ISO-8601 format)
• ExpirationDate: Certificate expiration date
• downloads: Number of times certificate has been downloaded
• mobileprovisions_count: Number of associated mobileprovision files
• created_at: Certificate upload timestamp (ISO-8601 format)
• has_password: Boolean. true if the certificate has a password set
• password: The P12 certificate password (empty string if no password)
• revoked_date: Revocation timestamp (ISO-8601 format) or null if not revoked
• full_zipped_files_download_url: Secure signed download URL for the ZIP bundle (valid for 24 hours)
• p12_download_url: Secure signed download URL for the P12 file only (valid for 24 hours)
• mp_download_url: Secure signed download URL for the **primary** mobileprovision file (valid for 24 hours)
• mobileprovisions: Array of associated mobileprovision objects (filtered based on plan)
• mobileprovisions[].is_extra: Boolean, true if the profile is NOT primary
• mobileprovisions[].extra_mp: Integer, 1-based index of the profile in the list

Error Response

{
  "error": "Invalid API Key"
}

Look up who a Bearer token or API key belongs to, whether the account is Pro, and its current signing/storage limits and usage. Handy for clients that want to show account status without hardcoding your plan.

---

Endpoint

GET https://api.cococloud-signing.vip/v1/me

Authentication

Use a Bearer token (recommended) or legacy API key:

• Bearer Token: Authorization: Bearer <token>
• Legacy: Include your API Key as a query parameter: ?YOUR_API_KEY

Example Request with Bearer Token (cURL)

curl -X GET "https://api.cococloud-signing.vip/v1/me" \
  -H "Authorization: Bearer YOUR_TOKEN"

Example Request with Legacy Key (cURL)

curl -X GET "https://api.cococloud-signing.vip/v1/me?sk_YOUR_API_KEY"

Example Response

{
  "success": true,
  "user": {
    "name": "Jane Doe",
    "username": "janedoe",
    "email": "[email protected]",
    "member_since": "2026-01-15T10:30:00+00:00"
  },
  "is_pro": false,
  "pro": null,
  "auth": {
    "type": "bearer",
    "token_name": "My CI Token",
    "scopes": ["sign", "apps"]
  },
  "limits": {
    "signing": {
      "unlimited": false,
      "monthly_limit": 5000,
      "used_this_month": 42,
      "remaining_this_month": 4958,
      "resets_at": "2026-08-01T00:00:00+00:00"
    },
    "upload": {
      "max_file_size_bytes": 2147483648,
      "max_file_size_label": "2.00 GB"
    },
    "storage": {
      "limit_bytes": 5368709120,
      "limit_label": "5.00 GB",
      "used_bytes": 269143231,
      "remaining_bytes": 5099565889
    }
  },
  "stats": {
    "apps_count": 3,
    "files_count": 5,
    "certificates_count": 1,
    "api_tokens_count": 2
  },
  "api_banned": false,
  "api_ban_reason": null
}

Response Fields

• user.email: Only included when the token has the user scope (legacy API keys and session auth always get it, since they\'re never scoped). Otherwise null.
• is_pro: Boolean. Whether the account currently has an active Pro license.
• pro.expires_at: ISO-8601 expiry of the Pro license, or null if not Pro.
• auth.type: How this request authenticated — bearer or legacy.
• auth.token_name / auth.scopes: Only populated for Bearer tokens; null for legacy API keys.
• limits.signing.unlimited: true for Pro accounts (no monthly signing cap).
• limits.signing.monthly_limit / used_this_month / remaining_this_month: Standard-plan signing quota, null when unlimited.
• limits.signing.resets_at: When the monthly signing counter resets (1st of next month).
• limits.upload.max_file_size_bytes: Largest single file this account may upload/sign, null if unlimited.
• limits.storage: Total App Library storage quota, current usage, and bytes remaining. limit_bytes/remaining_bytes are null when unlimited.
• stats.apps_count: Number of non-expired IPAs in the App Library.
• stats.files_count: Number of non-expired files of any type owned by this account.
• stats.certificates_count: Number of custom certificates uploaded by this account.
• stats.api_tokens_count: Number of active Bearer tokens on this account.
• api_banned / api_ban_reason: Whether the account is currently banned from the API.

Error Response

{
  "error": "Authentication required. Use Bearer token or API key."
}

Webhooks allow you to receive real-time notifications about events happening in your account. You can configure webhooks for Discord, Telegram, or a generic HTTP endpoint.

---

Supported Events

Payload Structure

The payload structure depends on the webhook type (Discord, Telegram, or Generic). Below is the generic JSON payload format:

Example Payload: Enterprise Certificate Available

{
  "event": "enterprise_cert.available",
  "data": {
    "title": "New Enterprise Certificate Available",
    "message": "A new shared certificate 'Apple Inc' is now available for signing.",
    "color": 5763719,
    "fields": {
      "Certificate ID": 1,
      "Certificate Name": "Apple Inc",
      "Status": "Signed",
      "Expiration Date": "2026-02-07T11:07:09+00:00",
      "Available At": "2024-11-24 00:45:00",
      "Signer URL": "https://cococloud-signing.vip/user/ipa-signer"
    }
  },
  "timestamp": "2024-11-24T00:45:00.000000Z"
}

Example Payload: Enterprise Certificate Revoked

{
  "event": "enterprise_cert.revoked",
  "data": {
    "title": "Enterprise Certificate Revoked",
    "message": "The shared certificate 'Apple Inc' has been revoked. Please wait for a replacement.",
    "color": 16711680,
    "fields": {
      "Certificate ID": 1,
      "Certificate Name": "Apple Inc",
      "Status": "Revoked",
      "Reason": "Key Compromised",
      "Revoked At": "2024-11-25 10:00:00"
    }
  },
  "timestamp": "2024-11-25T10:00:00.000000Z"
}

Example Payload: Enterprise Mobile Provision Added

{
  "event": "enterprise_mp.available",
  "data": {
    "title": "New Mobile Provision Available",
    "message": "A new mobile provision file has been added to the certificate 'Apple Inc'.",
    "color": 5763719,
    "image": "https://cococloud-signing.vip/signing-imgs-status/signed.jpg",
    "url": "https://cococloud-signing.vip/user/certificates/1",
    "fields": {
      "Certificate Name": "Apple Inc",
      "Event": "Mobile Provision Added",
      "Added At": "2024-11-26 15:30:00",
      "Platform": "CocoCloud Signing 2.0",
      "Mobile Provision Name": "iOS Team Provisioning Profile: com.example.app",
      "UUID": "12345678-1234-1234-1234-1234567890ab",
      "Team Name": "Apple Inc",
      "Team Identifier": "ABCDE12345",
      "Creation Date": "2024-11-26 15:00:00",
      "Expiration Date": "2025-11-26 15:00:00",
      "Time To Live": "365 days",
      "App ID Name": "XC com example app"
    }
  },
  "timestamp": "2024-11-26T15:30:00.000000Z"
}

Headers

We send the following headers with every webhook request:

• User-Agent: CocoCloud-Webhook/1.0
• Content-Type: application/json
• X-Webhook-Event: The event name (e.g., enterprise_cert.available)

Import certificates directly into your account by visiting a URL with certificate file locations. Perfect for automation and sharing certificate configurations.

---

How It Works

1. Create a URL with certificate file locations as query parameters
2. Visit the URL (login required if not authenticated)
3. Certificate files are automatically downloaded and validated
4. Certificate is imported into your "My Certificates" section

URL Format

https://cococloud-signing.vip/user/certificates?p12=P12_URL&mp=MP_URL&password=PASSWORD

Parameters

• p12: Direct URL to P12 certificate file (Required)
• mp: Direct URL to mobileprovision file (Required)
• password: Certificate password (Optional)

Example: Authenticated User

If you are already logged in, visit the URL and the certificate imports immediately:

https://cococloud-signing.vip/user/certificates?\
mp=https://example.com/profile.mobileprovision&\
p12=https://example.com/cert.p12&\
password=mycertpassword

Example: Unauthenticated User

If you are not logged in, you will be redirected to login. After successful login, the import happens automatically:

https://cococloud-signing.vip/user/certificates?\
mp=https://cdn.example.com/files/profile.mobileprovision&\
p12=https://cdn.example.com/files/certificate.p12&\
password=secret123

Response Messages

Upload a .cocosigncert bundle - the same encrypted certificate bundle format CoCoSign (the iOS app) can create and read under Settings → Certificates, and the same format the standalone .cocosigncert Creator web tool builds. The bundle is decrypted, validated (revocation status comes back in the same response - no separate cert-check call needed), and added to your "My Certificates".

---

Endpoint

POST https://api.cococloud-signing.vip/v2/certificates/import-bundle

Authentication

Use a Bearer token (recommended) or legacy API key. A Bearer token needs the certs scope:

• Bearer Token: Authorization: Bearer <token> (requires the certs Scope)
• Legacy: Include your API Key in the request header: X-API-Key: YOUR_API_KEY

Parameters

• bundle: The .cocosigncert file (Required, multipart upload, max 10MB)
• passphrase: The bundle's passphrase - required only if it was exported encrypted. Omit entirely for an unencrypted bundle.

Example Request (cURL)

curl -X POST https://api.cococloud-signing.vip/v2/certificates/import-bundle \\
  -H "Authorization: Bearer YOUR_TOKEN" \\
  -F "[email protected]" \\
  -F "passphrase=your-bundle-passphrase"

Example Response

{
  "success": true,
  "message": "Certificate 'My Signing Certificate' imported successfully",
  "certificate": { "id": 123, "name": "My Signing Certificate", "...": "..." },
  "details": {
    "name": "My Signing Certificate",
    "status": "Signed",
    "ocsp": "Signed"
  },
  "extra_provisions_skipped": 0
}

Response Messages