I am planning an app transfer between two developer teams, iOS only, no macOS app. The app shares an app group with a notification service extension and a share extension. The container holds a SQLite database, message attachments and user avatars. The database encryption key is in the keychain.
I have read thread https://developer.apple.com/forums/thread/706128 (including the 2026-03-31 revision), and the plan is to follow it: a pre-transfer release moving keychain items into the AGI keychain access group, time for adoption, then the app transfer, then the app group transfer. I've also read https://developer.apple.com/forums/thread/774831, https://developer.apple.com/forums/thread/782132 and https://developer.apple.com/forums/thread/815779.
My questions are about the container rather than the keychain:
- Step 7 of 706128 says that when a user installs the post-transfer version, "it will have access to your app group, and hence your keychain items". Does that access include the files already in the app group container, written while the app was signed by the old team? Or does the transfer restore only AGI keychain access group membership, leaving the container's prior contents inaccessible?
- If those files are not preserved, is there a supported way to migrate them, or should I relocate that data into the app's own container before the transfer?
- Thread 815779 asked this and I do not think it was answered. While the app group transfer is in progress, do already installed builds signed by the old team, which the user has not updated, keep working against the original container?
- App Store Connect Help (Transfer an app > Overview of app transfer > Apps using App Groups) says the app group "can be deleted from the transferor's account and registered to the recipient's account". Is that the same operation as step 5 of 706128, "transfer the app group ID", or two different things? I ask because the developer in thread 774831, who lost shared container data for roughly 25% of users, deleted and recreated the group during the transfer, whereas 706128 step 5 says to do it once the app transfer is complete.
If you read between the lines in App ID Prefix Change and Keychain Access, and my older responses on this topic, you’ll see that I’m not particularly happy with where we landed with this process. It seems to work, and the relevant folks here at Apple confirmed that we should allow it, but… yeah… it’s clunky. Hence my ER for a better process (r. 171616887).
1- … Does that access include the files already in the app group container … ?
Yes. Or at least it should (-:
3- … do already installed builds signed by the old team, which the user has not updated, keep working against the original container?
Yes.
I’m pretty confident of this answer because iOS enforces this sort of access on device, without reference to what you are doing on the Developer website or App Store Connect. You see the same thing with app transfer, where for any given device the transfer takes effect when the user installs the new app.
4- … Is that the same operation as step 5 of 706128, "transfer the app group ID", or two different things?
Yes. I though I made that obvious by linking to the specific App Store Connect Help age (-:
I ask because the developer in thread 774831, who lost shared container data for roughly 25% of users
I don’t have a good explanation as to what happened in 774831. There are many ways this could go wrong. It’s possible that there’s some unexplored edge case that we don’t understand. It’s also possible that the developer in question had a bug in their code.
For an app group container’s contents you can don both a belt and braces [1] by storing a copy of the container your app’s container. That way, if something goes wrong you can restore the app group container’s contents from that copy.
However, this isn’t an option for keychain items, and that means that it isn’t an option for you, because your database is encrypted with the key stored in the keychain.
Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"
[1] Suspenders if you speak US English.