dev.to
How we distribute an iOS app outside the App Store: a practical AltStore PAL walkthrough
App Store review rejected our app under Guideline 1.2 — the core mechanic (users rate each other's photos) is banned as a category, and no metadata change fixes that. So we became one of the first apps distributed exclusively through an alternative marketplace under the EU's DMA. Documentation for this path is thin and sometimes contradictory, so here is a step-by-step of what actually had to be done.
## Step 1. Alternative Terms Addendum
You sign an addendum to the developer agreement in App Store Connect. You don't need to be an EU resident. Distribution is free up to 1M first annual installs (companies under €10M revenue get the Core Technology Fee exemption).
## Step 2. Registering with the marketplace
AltStore has a REST API to register your developer ID — important: it's the UUID from your ASC profile, **not** the Team ID (registering with the Team ID silently fails — we stepped on that). The token goes into ASC: Users and Access → Integrations → Marketplaces.
## Step 3. Notarization instead of review
You build and upload with the usual xcodebuild + upload. Then, instead of "Submit for Review", you send it for notarization: an automated security/functionality check, without content guidelines. Ours passed on the first try in ~30 hours. A mechanic banned on the App Store passes here.
## Step 4. Hosting the ADP yourself
After notarization you download the Alternative Distribution Package: `manifest.json`, a `signature` file (no extension!), and several `.ipa` variants. You host it as-is; hierarchy and hashes must not change. Two gotchas:
* the extensionless `signature` file — our SPA fallback on ASP.NET served index.html instead; fixed with ServeUnknownFileTypes on the static handler;
* the `.ipa` must be served as `application/octet-stream`.
## Step 5. Source JSON and federation
Next to it you put a `source.json`: marketplaceID (= the app's Apple ID), the manifest downloadURL, size, icon, screenshots, versions. Users add the source via an `altstore://source?url=…` link. Enable federation (a `fediUsername` field) and the app becomes searchable right inside the marketplace, no manual source add.
## Updates
Each new version is the same loop: build → notarize → new ADP on the server → new entry in `versions[]` of source.json. AltStore picks up auto-updates itself.
## Limits and fallbacks
Marketplaces work in the EU, Japan and Brazil, iOS 17.4+. For the rest of the world we run a PWA (standalone manifest + a minimal service worker — Safari installs it to the home screen) and a sideload IPA via AltStore Classic with our own source. The biggest non-technical problem is conversion: you have to explain to users what a marketplace even is, so we funnel all traffic to a single install page.
## Takeaways
Cost beyond the developer account: zero. Actual time spent: about a week, most of it on the undocumented details above. If the App Store is closed to your app (or you just don't want to hand over 15–30%), this path works today.
The app from this case study is Rate Me (rateme.lv/ios) — happy to answer questions in the comments.
![AltServer error alert: "AltStore could not be installed onto [Device Name]. AltServer could not retrieve anisette data value 'machineID'"](https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:zf4fxeinbz7p2e2j6pp5nkxp/bafkreidsycqffj5gt4ma7c7twuyeowiimt4wkmot3u2tkkuzeoxbvokd64)
