altool ERROR ITMS-90283 invalid provisioning profile in CI

App Store Connect rejected the binary with ITMS-90283 because an entitlement signed into the app conflicts with the provisioning profile or the App ID capabilities, for example a push entitlement set to production when the profile or App ID does not enable it.

What this error means

altool --upload-app fails with "ERROR ITMS-90283: Invalid Provisioning Profile. The provisioning profile ... has an AppID ... that cannot be used..." naming the entitlement key (aps-environment, application-identifier, or an app group) that does not line up.

altool

ERROR ITMS-90283: "Invalid Provisioning Profile. The provisioning profile included in
the bundle com.example.app is invalid. The 'aps-environment' entitlement is present but
the provisioning profile does not support Push Notifications."

Common causes

An entitlement is enabled in the app but not the profile

The .entitlements file requests a capability (push, app groups, associated domains) that the profile or the App ID does not include, so the signed entitlement set is invalid.

A stale profile predates an entitlement change

A capability was added to the App ID after the profile was generated, so the cached or committed profile is missing it.

How to fix it

Enable the capability and regenerate the profile

In the Apple Developer portal, enable the capability on the App ID (for example Push Notifications).
Regenerate the distribution profile so it carries the entitlement.
Re-fetch the profile on the runner and re-archive.

Terminal

fastlane match appstore --force --app_identifier com.example.app

Match entitlements to the profile

Remove entitlements the App ID does not grant, or align the .entitlements file with the capabilities actually enabled. A push aps-environment of production requires the App ID to have Push enabled.

How to prevent it

Regenerate profiles whenever an App ID capability changes.
Keep the .entitlements file in step with the App ID configuration.
Use match force to refresh profiles instead of relying on cached ones.