App Store Submission Checklist for iOS Developers in 2026: 15 Configuration Issues That Cause Rejections
The 15 configuration issues responsible for most App Store rejections in 2026 — bundle IDs, privacy manifests, entitlements, metadata, IAP, and binary quality. Detectable before you submit.
App Store rejection is not random. Most rejections trace back to a small set of configuration errors that are entirely preventable before you hit Archive. This checklist covers the 15 issues responsible for the most rejections in 2026.
Why apps get rejected
Apple's review process follows documented rules. The problem is that Xcode surfaces some of these errors at build time — but not all of them. A binary can compile cleanly, pass Instruments, and still fail review because of a misaligned entitlement, a missing NSPrivacyAccessedAPITypes entry, or a privacy label that contradicts what the app actually does at runtime.
Before you archive: project configuration
1. Bundle identifier mismatch
The bundle identifier in your .xcodeproj must exactly match the App ID registered in App Store Connect and the one embedded in your provisioning profile. A single character difference — a trailing space, a capitalisation inconsistency — produces a binary that Transporter rejects before review even starts.
Check all three locations independently: the PRODUCT_BUNDLE_IDENTIFIER build setting, the App ID in your Apple Developer account, and the provisioning profile's application-identifier entitlement. They must be identical.
2. Version and build number conflicts
CFBundleShortVersionString (the marketing version) must follow semantic versioning — three dot-separated integers. CFBundleVersion (the build number) must be a monotonically increasing integer, higher than any previously uploaded build for that app record.
Uploading a build with the same or lower build number than a prior submission is an automatic Transporter rejection.
3. Provisioning profile and certificate alignment
The signing certificate embedded in your archive must match the certificate used to create the provisioning profile. A distribution profile signed with a certificate that has since been revoked or expired will fail notarisation. In Xcode's automatic signing mode, this is usually handled correctly. When manual signing is active — common in CI pipelines — certificate expiry is the most frequent silent failure.
4. Entitlements not matching capabilities
Every capability enabled in your App ID — CloudKit, Push Notifications, Sign In with Apple, HealthKit — must have a corresponding entry in the .entitlements file, and vice versa. An entitlement present in the file but absent from the App ID produces a binary that App Store Connect rejects at processing time, not at review.
5. Missing or incorrect privacy manifest
As of 2024, Apple requires a PrivacyInfo.xcprivacy file for apps that use certain APIs — including UserDefaults, file timestamp APIs, and several system APIs categorised as "required reason APIs." This requirement extended to all app updates in 2026.
The manifest must declare every required reason API your app calls, using the correct reason codes from Apple's documentation. A missing manifest — or one that omits an API your binary actually calls — triggers a rejection with a specific error code referencing the uncovered API.
Metadata and App Store Connect
6. Screenshot dimensions out of spec
App Store Connect requires screenshots for specific device classes. In 2026, required sizes include 6.9-inch display screenshots for iPhone 16 Pro Max, 12.9-inch iPad Pro screenshots if your app supports iPadOS, and App Store previews if you include video. Screenshots that are even one pixel off the required dimensions are rejected at upload.
7. App name and subtitle keyword stuffing
Apple's App Store Review Guidelines prohibit app names and subtitles that consist primarily of keywords. A name like "Budget Tracker — Finance, Money, Expense Manager" will be flagged under Guideline 2.3.7. The subtitle field (30 characters) is the correct place for a short descriptive phrase. The keyword field (100 characters, not visible to users) is where keyword targeting belongs.
8. Missing privacy nutrition labels
The privacy nutrition labels in App Store Connect must accurately reflect every data type your app collects, links to identity, or uses for tracking. Underreporting is a rejection under Guideline 5.1.2. The most common failure: an app that integrates a third-party SDK — analytics, crash reporting, advertising — but does not declare the data that SDK collects.
9. Age rating misconfiguration
The age rating questionnaire must reflect the actual content and functionality of your app. Apps with user-generated content, web browsing, or unrestricted internet access must declare those capabilities — even if the content itself is benign.
Runtime and API compliance
10. Missing NSUsageDescription keys
Every privacy-sensitive framework your app links against requires a corresponding NSUsageDescription key in Info.plist. This includes NSCameraUsageDescription, NSLocationWhenInUseUsageDescription, NSHealthShareUsageDescription, and others. The key must be present even if the permission request is conditional — if the framework is linked, the key is required.
11. Calling private or restricted APIs
Apple's automated binary analysis scans for calls to private APIs: methods and symbols not in the public SDK. This includes undocumented methods accessed via string-based selectors, private framework symbols accessed through dlopen, and deprecated APIs removed in the current SDK. The scan is static and symbol-based — it does not require the code path to execute.
12. Incomplete Sign In with Apple implementation
If your app offers any third-party or social login option, it must also offer Sign In with Apple as an equally prominent option (Guideline 4.8). The ASAuthorizationAppleIDProvider flow must handle the credential state check on every app launch, not just at sign-in.
13. In-app purchase architecture violations
Apps that sell digital goods or subscriptions must use StoreKit for those transactions. Directing users to a web checkout for digital content consumed inside the app is a Guideline 3.1.1 violation. In 2026, this applies to AI features delivered as consumable credits or subscription tiers.
Binary and build quality
14. Bitcode and architecture flags
Apple deprecated bitcode for iOS apps in Xcode 14 and removed it entirely in subsequent toolchain versions. Projects migrated from older Xcode versions sometimes carry ENABLE_BITCODE = YES in their build settings. For App Store distribution in 2026, your binary must include arm64 and must not exclude it via an EXCLUDED_ARCHS setting. Verify the Release configuration specifically.
15. Crash on launch in review environment
Apple's review environment is not a standard device. Reviewers use devices without your test accounts pre-configured, without your backend in a known state, and sometimes with network access restricted. Apps that crash on launch are rejected under Guideline 2.1.
The most common causes: a forced unwrap on a network response that returns nil in a restricted environment, a missing demo account for apps that require login, or a Core Data migration that fails when no prior store exists on a clean install.
Systematic detection before submission
Most of the issues above are detectable before submission — statically, without running the app. Xcode Doctor performs 9 specialised checks in under 2 seconds, read-only, against your project configuration. It surfaces the class of issues described in this checklist before they reach App Store Connect.
FAQ
Work With Me
The iOS Architecture Audit covers your project configuration, entitlements, privacy manifest, and App Store compliance in 5 business days. Delivered as a written recommendations report.