Join our Discord
iOS keychain cleanup and access groups support in XCUI tests
Set the app upload parameter to resolve keychain cleanup and iOS keychain access group issues in XCUITest tests.
This feature is currently in beta and might change.
Apple’s Keychain Services documentation defines the keychain as an encrypted database that gives your app a mechanism to store small pieces of user data such as passwords, notes, card information, keys, or certificates.
iOS keychain cleanup
For some iOS apps, login data persists from previous sessions on BrowserStack iOS devices. This is because data that the iOS app stores in the device’s secure keychain is not cleared automatically after the app is uninstalled at the end of the test session. However, the app’s keychain data is not available to any other app, and cannot be retrieved, changed, or deleted by any other entity apart from the app itself.
iOS keychain access groups
When BrowserStack resigns your iOS app with its wildcard provisioning profile to install it on BrowserStack iOS devices, the keychain-access-groups entitlement is preserved, but the Bundle Seed ID, also called the Team ID, component of the keychain access groups changes. As a result, app features or flows that depend on the Bundle Seed ID might not work on BrowserStack iOS devices.
Set the ios_keychain_support app upload parameter
To clear keychain data between sessions and to keep keychain access groups working after re-signing, set the ios_keychain_support parameter during the app upload stage on BrowserStack. BrowserStack then instruments your app to clear keychain data automatically after every test session and to handle the change to the keychain access groups. The following app upload cURL request demonstrates how to do this:
curl -u "YOUR_USERNAME:YOUR_ACCESS_KEY" \
-X POST "https://api-cloud.browserstack.com/app-automate/xcuitest/v2/app" \
-F "file=@/path/to/app/file/application-debug.ipa" \
-F "ios_keychain_support=true"
- This feature is supported only on iOS >= 13 devices. iOS apps built for minOS < 13 will not be able to run sessions on iOS < 13 devices with this feature.
- iOS apps signed with Enterprise certificates are not supported. This feature needs the
resignAppparameter to betruein the build request.
Frequently asked questions (FAQs)
Can I resolve keychain cleanup issues without using the ios_keychain_support app upload parameter?
Yes, best practices recommend deleting keychain items that the app no longer needs, for example after a logout event. Check out Apple’s guide to updating and deleting keychain items to learn more.
You can also add an app setting that deletes keychain data at the end of the session.
The app can reset keychain values the first time it launches. For more details, refer to Delete keychain items when an app is uninstalled.
Can I resolve keychain access groups issues without using the ios_keychain_support app upload parameter?
Yes, you can read the Bundle Seed ID component of the keychain access groups programmatically from the access group attribute, kSecAttrAccessGroup, of an existing keychain item.
Related topics
-
Manage your uploaded app using our upload app REST API.
-
Check out Disable re-signing of Enterprise distributed apps to learn how the
resignAppparameter affects your app.
We're sorry to hear that. Please share your feedback so we can do better
Contact our Support team for immediate help while we work on improving our docs.
We're continuously improving our docs. We'd love to know what you liked
We're sorry to hear that. Please share your feedback so we can do better
Contact our Support team for immediate help while we work on improving our docs.
We're continuously improving our docs. We'd love to know what you liked
Thank you for your valuable feedback!