Before you start
- The new client app setup questionnaire must be complete. Your integration lead walks you through it, and the app record uses the values agreed there.
- The accounts stay yours. Lobyco works inside them with the access you grant: it creates the app record, manages the store listing, generates release credentials and publishes releases. Ownership never moves.
- Apple and Google both want a named work email per person, with its own multi-factor authentication. A shared mailbox or a group alias is refused, at enrolment and at invitation.
The procedure
1
Enrol in the Apple Developer Program
Enrol as an organisation, not as an individual, at developer.apple.com/programs/enroll.Apple asks for a named work email, such asname@yourcompany.com, and a D-U-N-S number for the legal entity. If the organisation has no D-U-N-S number yet, the lookup or registration can take several business days.2
Create a Google Play developer account
Create an organisation developer account, linked to a real Google Account with multi-factor authentication enabled. Google’s setup guide walks through it.Google verifies the organisation before the account can publish. It checks the company website, phone and email, and in some regions a D-U-N-S number or an equivalent business registration. Expect a few business days. The checks are described in Google’s organisation verification details.3
Declare trader status
Every developer must declare trader or non-trader status before Apple or Google accept a new app or an update. The EU Digital Services Act, articles 30 and 31, is the reason.- Distributing in the EU: declare trader. Provide the company name, registered address, business registration number and a contact email, for the same legal entity as the D-U-N-S number. Verification takes 1 to 14 days, and EU distribution is blocked until it is approved.
- Distributing outside the EU only, for example in the UK, APAC or North America: declare non-trader. There is no verification.
- Apple: App Store Connect → Business → Trader Status.
- Google: Play Console → Settings → Developer account → Account details → Trader status.
4
Invite the Lobyco team
When both accounts exist and any verification is complete, invite the Lobyco team members. Your integration lead confirms the current list: a support engineer, the Android tech lead and the iOS tech lead, each with a named@lobyco.com address.Lobyco adds its further team members, developers and QA, later through the support engineer or the tech leads. You do nothing for that.
5
Tell the integration lead
When the invitations are sent on both platforms, tell your integration lead. Lobyco accepts them and starts the configuration inside the accounts.What Lobyco does next
Once Lobyco has accepted the invitations, your part is done. Lobyco then:- Creates the app record in both stores, with the bundle id, package name and app name agreed in the questionnaire.
- Generates the keys the release pipelines use: an App Store Connect API key and a Google Play service account.
- Configures the store listing, the content rating, the data safety questionnaires, the testing tracks and the first internal release.
Failure and edge cases
Most onboardings follow the steps above unchanged. Open the case that matches yours.You already have a developer account, and the Lobyco app is new
You already have a developer account, and the Lobyco app is new
A new account is not needed. Skip the enrolment steps and invite the Lobyco team to the existing account, with the roles listed under Invite the Lobyco team.Lobyco creates the new app record beside your existing apps. The other apps are not touched.
You already have a developer account, and the Lobyco app replaces an existing one
You already have a developer account, and the Lobyco app replaces an existing one
Replacing a production app takes more coordination. Release continuity and signing keys must be migrated carefully.Contact the integration lead before you grant access, so the migration can be planned together. Have these ready:
- The existing app’s bundle id, package name and current version codes.
- Android: the keystore file that signs the current production releases, or a Play App Signing transfer if Google’s managed signing is in use.
- iOS: the existing signing certificates and provisioning profiles, or confirmation that Lobyco should regenerate them.
Your policy does not allow Admin access for external partners
Your policy does not allow Admin access for external partners
A reduced-access setup is possible. It takes more work on your side, and every later change goes through you. Contact the integration lead early to agree the arrangement. Which keys and credentials Lobyco needs depends on your policy.In this arrangement you create the app record yourself, in App Store Connect and in Google Play Console. You then grant Lobyco access to that app only:
- Apple: invite the Lobyco contacts as App Manager, scoped to the Lobyco-built app.
- Google Play: invite the Lobyco contacts as app-level Admin, scoped to the Lobyco-built app.
- Create the App Store Connect API key, scoped to the app, and share it securely.
- Create a Google Play service account in your Google Cloud project and grant it access to the app in Play Console. Share its JSON key securely.
- Invite each further Lobyco team member when the support engineer or a tech lead asks.
Your policy does not allow certificate access on the Apple account
Your policy does not allow certificate access on the Apple account
Then a yearly manual step stays with you. The Apple distribution certificate that signs the iOS app for the App Store is valid for 1 year. Once a year, someone in your organisation must create a new Apple Distribution certificate in the Apple Developer portal. That takes Admin, or App Manager with certificate access.
Related
- Mobile app authentication — how the app signs customers in once it is published.
- Access to Lobyco Admin Portal — the other account setup your IT administrator does.