Outline:
- Intro
- Notes about fastlane and that we need Appstore Connect API Key
- Collect API Keys -> Werbung für ReBrandBox
- Manage API Keys with Gitlab
- Example whitelabeling app
TODO: Do the same for Android
Intro
Whitelabeling is the next evolutionary step of your Software as a Service business. It enables your customers to provide value to its customers without the need to reinvent the wheel.
However when talking about whitelabeled IOS applications the amount of work is not limited to just replace the logo and the colors anymore.
This blog post shall be a introduction into the world of whitelabeled ios applications and how to deploy them with Fastlane.
Demo Application
The demo app that I will reference throughout this guide is a React Native application. But any tech stack will work just fine.
The general idea: What does whitelabeling mean in this case?
We are going to change the AppIcon in the HomeScreen aka. the Launcher. Also we are going to change the theme. Maybe you have already noticed why I picked those two areas: One is for native assets and the other is about source code modification.
Thinking more about it will lead you to the conclusion that this guide is very abstract and you can not just copy paste something from here. Because your setup is probably very different.
What do we need to whitelabel and publish the app?
1) We need the app metadata (including bundle identifier, version, build number) 2) We need the assets that should be replaced 3) We also need the Appstore Connect API keys to publish it
Starting with fastlane
Fastlane is a eco system written in Ruby. It reduces the process of deploying the app to Testflight to just a few lines of Fastlane DSL.
It works by providing a set of Fastlane plugins, including a plugin to create and download signing certificates(called match), building the ios app bundle (called gym) and the one to release it to Testflight (humourusly called pilot). And a lot more for different use cases.
Prerequisites installation
So first install ruby:
$ brew install ruby@3.4
After that, go to your repository root and install fastlane with:
$ bundle add fastlane
Create the Fastfile
$ touch Fastfile # Create the fastfile
A note on the DSL of Fastlane
In Fastlane you can provide a set of so called lanes. You can later call them directly via the CLI. So a possible set of lanes could be: build, push_testflight, push_appstore. In this guide we will not cover the release to appstore
Basic Fastfile for a non-whitelabeled app
# Fastfile
platform :ios do
lane :build do
# first get the signing certificate
gym()
end
lane :push_testflight do
end
end
Get Appstore Connect API keys (from your customers)
In order for pilot to work, you need to contact the app owner and ask him for a Shared API key. This Shared part is very important, because a lot of people get confused with Individual API keys. Individual keys won’t work.
Since I had a lot of struggle with customers about this topic I created ReBrandBox. With the help of it, you can just send your customer the link to a DataBucket. He will then be prompted to enter his API credentials.
They will be then instantly validated, so that the issue with individual keys will directly be prevented and save you hours of email messaging.
Get certificates with this API key
There is a plugin called match designed for this. It creates and stores signing certificates for an application.
After that we are using fastlane to create a new testflight release with this data. We also need the api keys to access appstore connect. The place where we are pushing the ipa bundles to.
API Keys can be tricky and we definitely need one that is created by the owner of the appstore connect developer organization.
Individual keys won’t work.
Because often times customer get this crucial part wrong and we find ourselves stuck in endless email conversations, we can utilize ReBrandBox, to receive valid api keys.
How does it work? You can set up a form with several fields. One of them should be the IOS API key field.
After that you can share it with your customer via email.
When the user opens the form then and tries to submit a API key with invalid permissions or even worse, one malformed. He will get the notification instantly. The form then only accepts keys that have push access to the provided bundle identifier.
