TKFlight API

The publisher and read API for Tinkertanker ad-hoc iOS builds.

Overview

TKFlight publishes ad-hoc iOS builds. A Mac builds and signs the app, the publisher uploads the IPA through this API, and testers install from one stable link.

Only builds in the ready state are readable.

• Ad-hoc builds install only on devices registered in the app's provisioning profile, up to Apple's device limit.
• TKFlight has no review pipeline, crash reporting or tester management.

Authentication

Every /api/v1 route requires Authorization: Bearer <token>. The administrative capability enrolls apps, issues and revokes tokens, rotates read links and deletes builds. Publisher tokens are scoped to a single app.

• A token issued for one app is rejected on every route for another app.
• Revocation and expiry are re-checked on every request.

Publishing a build

Create a build, reserve an upload for its exact byte length, upload 16 MiB parts, complete the upload, then finalize. Create, reserve, complete and finalize require an Idempotency-Key so a lost response never duplicates work.

• Every part except the last must be exactly the reserved part size.
• Completion is validated against stored receipts, not a client part list.
• Finalize validates the IPA structurally and publishes only on success.

Remote signing

For a project an operator has configured for remote signing, the IPA is signed on an isolated Mac instead of being uploaded ready-made. Nothing about the ordinary build, upload, screenshot or finalize routes changes; only which build may be finalized does.

• The requesting token needs the explicit sign:request scope. It is never part of the default publisher scopes, and no existing token gains it.
• Create a signing job, upload the ZIP holding one .xcarchive to the job's inputBuildId with the ordinary multipart flow, then submit its SHA-256. Do not finalize the input build.
• Poll the job until its state is signed, then upload screenshots and finalize the job's outputBuildId only. No other build can be published for that project.
• Disabling signing stops new work. It never falls back to publishing an unsigned IPA.
• Apple keys, profiles and the signing identity live only on the isolated Mac. Identity and policy references are opaque identifiers recorded here and resolved there; they are never paths, secrets or commands.

Read links

A read link is an unlisted capability. Anyone holding it can download the build, so treat it as a credential. Rotating the link stops every read route immediately.

• Native manifest and IPA fetches never require a publisher token and never redirect to a login page.
• Range requests, HEAD and conditional requests are supported for the IPA.

Limits

Defaults are 2 GiB per IPA, 16 MiB parts, 12 screenshots below 10 MiB, a 2 MiB icon, 20 ready builds per app and 30 days of retention. Applying production retention needs approval.

For coding agents

https://flight.tk.sg/llms.txt returns the same service description as plain text for a fetching agent.