Expo EAS build failed with error "credentials have expired" for iOS distribution

Not specified by the original author.

TL;DR

Renew the expired iOS distribution certificate or provisioning profile in EAS by clearing and regenerating the credentials, then rebuild. Run the EAS credentials flow for iOS, let Expo manage new credentials or upload fresh ones from the Apple portal, and confirm the new expiry dates exceed your release window. Expired credentials cannot be revived; the build must be re-signed with new ones.

credentials have expired - Expo EAS iOS distribution

Use this when

• EAS build fails early with credentials have expired for the iOS target.
• The distribution certificate or profile passed its one-year or profile expiry date.
• Builds worked last release cycle with the same configuration.

Not for this skill when

• The failure is an Apple ID login problem rather than credential expiry. EAS reports those differently.
• You need the same certificate for an existing enterprise distribution. Regeneration has wider effects there; plan it.

Steps

1. Open the EAS credentials view for the project and platform iOS and note which item, certificate or profile, shows expired. Verify: the expired item and its expiry date are identified
2. Check whether other apps share the same distribution certificate before revoking anything, since Apple allows only a limited number. Verify: shared apps using the certificate are listed, or confirmed none
3. Clear the expired credential in EAS and let it generate a new distribution certificate and profile, authenticating with an App Store Connect API key or Apple ID when prompted. Verify: EAS shows new credentials with expiry about a year out
4. If your team manages credentials manually, create the certificate and profile in the Apple portal and upload them through the same EAS credentials flow instead. Verify: EAS lists the uploaded credentials as valid and matched to the bundle id
5. Start a new production build, since credentials are baked in at build time and queued builds keep the old ones. Verify: the new build log shows the new profile name during signing
6. Install the resulting build through TestFlight or internal distribution and confirm it launches. Verify: the build installs and opens on a device successfully
7. Record the fix in the release runbook or the CI job notes, naming the error, the value or setting that changed, and the date, so the next release engineer does not re-diagnose it from scratch. Verify: the runbook or job notes contain an entry for this error that a teammate can find by searching the error text

Why it happens

Apple distribution certificates live for one year and profiles die with the certificate they reference. EAS stores credentials server-side, so a project can sit untouched for months and then fail on the next release even though no code changed. The build system reports the stored credential state honestly; only regeneration with fresh portal material fixes it.

In practice this failure is rarely a one-off. It tends to recur at the worst point in the release cycle, when a certificate, a toolchain, a store policy or a team process has quietly changed since the last successful release and nobody connected that change to the release pipeline. That is why the steps above insist on reading the actual store, portal or build state at each point instead of trusting configuration files or memory: the configuration usually describes the release the team intended to ship, while this error describes the release the systems actually see. Once the immediate upload or build is unblocked, treat the underlying drift as the real defect. Pin the toolchain version, expiry date, identifier or policy value that caused it in the release checklist, and add the cheapest automatic check that would have caught it before submission day, for example a preflight lane that validates signing, versions and metadata lengths before the full archive runs. A release pipeline that fails in preflight costs minutes; the same failure discovered at submission costs a day.

Variants and edge cases

EAS build credentials have expired iOS

Short phrasing for the same expiry check. When you land on this skill from that phrasing, start at step 1 rather than jumping to the most dramatic fix: the early steps are cheap state checks that confirm you are solving the failure you actually have, and they take minutes compared with a rebuild or a store-side change you cannot undo.

Expo EAS provisioning profile expired fix

Profile-side variant; regenerate the profile against a valid certificate. When you land on this skill from that phrasing, start at step 1 rather than jumping to the most dramatic fix: the early steps are cheap state checks that confirm you are solving the failure you actually have, and they take minutes compared with a rebuild or a store-side change you cannot undo.

Edge case: push key and other credentials

While in the credentials view, check push keys and notification credentials for near-term expiry to avoid a second failure next release. When you land on this skill from that phrasing, start at step 1 rather than jumping to the most dramatic fix: the early steps are cheap state checks that confirm you are solving the failure you actually have, and they take minutes compared with a rebuild or a store-side change you cannot undo.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_cG3DfJX6eGsruCGDeBkVIg

Resolved from the public thread: https://vectle.com/posts/pst_cG3DfJX6eGsruCGDeBkVIg

Thread query: Expo EAS build failed with error "credentials have expired" for iOS distribution

TL;DR: Renew the expired iOS distribution certificate or provisioning profile in EAS by clearing and regenerating the credentials, then rebuild. Run the EAS credentials flow for iOS, let Expo manage new credentials or upload fresh ones from the Apple portal, and confirm the new expiry dates exceed your release window. Expired credentials cannot be revived; the build must be re-signed with new ones.