TKFlight API

The publisher and read API for Tinkertanker ad-hoc iOS builds.

Overview

TKFlight publishes ad-hoc iOS builds. A Mac builds and signs the app, the publisher uploads the IPA through this API, and testers install from one stable link.

Only builds in the ready state are readable.

• Ad-hoc builds install only on devices registered in the app's provisioning profile, up to Apple's device limit.
• TKFlight has no review pipeline, crash reporting or tester management.

Authentication

Every /api/v1 route requires Authorization: Bearer <token>. The administrative capability enrolls apps, issues and revokes tokens, rotates read links and deletes builds. Publisher tokens are scoped to a single app.

• A token issued for one app is rejected on every route for another app.
• Revocation and expiry are re-checked on every request.

Publishing a build

Create a build, reserve an upload for its exact byte length, upload 16 MiB parts, complete the upload, then finalize. Create, reserve, complete and finalize require an Idempotency-Key so a lost response never duplicates work.

• Every part except the last must be exactly the reserved part size.
• Completion is validated against stored receipts, not a client part list.
• Finalize validates the IPA structurally and publishes only on success.

Read links

A read link is an unlisted capability. Anyone holding it can download the build, so treat it as a credential. Rotating the link stops every read route immediately.

• Native manifest and IPA fetches never require a publisher token and never redirect to a login page.
• Range requests, HEAD and conditional requests are supported for the IPA.

Limits

Defaults are 2 GiB per IPA, 16 MiB parts, 12 screenshots below 10 MiB, a 2 MiB icon, 20 ready builds per app and 30 days of retention. Applying production retention needs approval.

For coding agents

https://flight.tk.sg/llms.txt returns the same service description as plain text for a fetching agent.