3

Caveat - I am not the iOS developer but have been asked to research this

We submit our native iOS financial app to the Apple store for review and the person who previously managed the submission process insisted we had to provide Apple with a username and password to be able to login to our app to review the pages

The process to create and provide Apple with a username/password is very time consuming and alerts our security teams as our app holds sensitive data about people

Is it the case that Apple requires to be able to login to review? If so, how do people with financial/banking apps manage this? We cannot really create dummy users as this will skew our stats and as mentioned before, our security team do not like it

Many thanks

Improve this question
0

3 Answers 3

Reset to default
19

App Store Review Guidelines necessitates this. You will be rejected if the app requires login and you do not provide credentials.

Before you submit:

  • Provide an active demo account and login information, plus any other hardware or resources that might be needed to review your app (e.g. login credentials or a sample QR code).

2.1 App Completeness

… Make sure your app has been tested on-device for bugs and stability before you submit it, and include demo account info (and turn on your back-end service!) if your app includes a login. …

Also, how does your security team ensure that your first two users won’t see each other’s data? If adding a third account for Apple breaks your security, you’ve got your research can be concluded with the answer: the back end team is not ready to ship.

Improve this answer
4
  • 1
    To anyone reading, I would recommend this answer over mine as it includes quoted reference from the App Store Review Guidelines document.
    – Nimesh Neema ♦
    Commented Dec 10, 2019 at 10:48
  • Which is exactly how we do it. Provide Apple (and Google for the Android version) with an account on our demo server, the same server prospective customers can try the app on to see if it's a good option for them.
    – jwenting
    Commented Dec 11, 2019 at 6:14
  • Does Sign In With Apple change this at all? (support.apple.com/en-us/HT210318). My app allows me to give an invitation. User can use, for example, Apple Sign In, to accept the invitation. Is Apple willing to use one of their own accounts with Apple Sign In during a review, if I give them an invitation?
    – Chris Prince
    Commented Apr 22, 2021 at 0:45
  • I am just now seeing apple.stackexchange.com/questions/398371/… which suggests this is true.
    – Chris Prince
    Commented Apr 22, 2021 at 0:47
7

Is it the case that Apple requires to be able to login to review?

Yes. If your app requires a login to access all the functionality, Apple requires you to provide one, so that they can review the app in its entirely. Absence of login information may prevent Apple from reviewing the app in its entirely.

If so, how do people with financial/banking apps manage this?

Ask your software development team with a dummy/demo account with placeholder data. This should let the review team at Apple review the app UI and functionality to make sure they are in compliance with the guidelines.

We cannot really create dummy users as this will skew our stats and as mentioned before, our security team do not like it

Only likely way to move ahead at this point would be to request the IT/security/software development team to set up an exception, so that the review team at Apple can do their job.

Improve this answer
1
  • 1
    The advice to make a security exception or demo account seems to side step a critical flaw. How can the backend team secure any data if they cringe at adding one more account on the live system?
    – bmike ♦
    Commented Dec 14, 2019 at 3:17
2

grg's answer is perfect to show you that you must provide them with a demo login account. However I think I can provide more advice on:

If so, how do people with financial/banking apps manage this?

Provide them an account that either fakes the data exchange in the app, so they can see the UI but the data is dummy from some XML files in the app. Or make it so if that account logs in it connects to test services rather than live services. The ones I hope your dev and test team are using.

Improve this answer
4
  • In kindness, this is awful advice. The team has zero standing to ship if they can’t isolate data with distinct log in credentials.
    – bmike ♦
    Commented Dec 14, 2019 at 3:18
  • 1
    @bmike could you elaborate? I thought my suggestion was to provide access to isolated data based on the log in credentials.
    – Tom Bowen
    Commented Dec 16, 2019 at 9:38
  • Wouldn’t all data be isolated by the credentials? There shouldn’t have to be anything faked. Apple testers shouldn’t get access to any other customer data and vice versa.
    – bmike ♦
    Commented Dec 16, 2019 at 12:51
  • 3
    @bmike depends on the application. A health care app let's doctors look up patient data. You don't want apple looking at real patients. Also for reporting reasons on something like a financial app you wouldn't apple screwing things or having "pretend" money in a live system.
    – Tom Bowen
    Commented Dec 16, 2019 at 13:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .