Entitlements & permissions checklist
Passpoint onboarding needs a few privileged OS capabilities on both platforms. Here's the single pre-flight list to run before you ship.
iOS
| Requirement | Where | Notes |
|---|---|---|
| App Attest capability | Signing & Capabilities → App Attest | The one thing Wi-DAS trusts to prove your app is genuine. Unavailable on the Simulator, so test on a device. |
| Hotspot Configuration entitlement | Signing & Capabilities → Hotspot Configuration | com.apple.developer.networking.HotspotConfiguration. A standard managed entitlement, no special Apple approval. |
| Keychain Sharing group | Signing & Capabilities → Keychain Sharing | e.g. <TeamID>.com.apple.networkextensionsharing; pass it as keychainAccessGroup so the NetworkExtension can pair the client identity. |
| Deployment target | Build settings | iOS 14 or later. |
| Registration | Wi-DAS | Register your Team ID + bundle ID against your clientId. |
Entitlements file excerpt:
<key>com.apple.developer.devicecheck.appattest-environment</key>
<string>production</string>
<key>com.apple.developer.networking.HotspotConfiguration</key>
<true/>
Android
| Requirement | Where | Notes |
|---|---|---|
ACCESS_WIFI_STATE | Merged from SDK manifest | Normal permission; no runtime prompt. |
CHANGE_WIFI_STATE | Merged from SDK manifest | Normal permission; no runtime prompt. |
| Play Integrity API | Google Play Console | Enable it, with self-managed response encryption turned on. |
| Response encryption keys | Play Console → App integrity | The decryption key (AES) and verification key (EC) from self-managed encryption. Share both with Wi-DAS so it can read your tokens. |
| Google Cloud project number | configure(cloudProjectNumber = …) | Required for non-Play builds. |
| App-signing cert SHA-256 | Play Console → App signing | Register the app-signing cert (not the upload cert) plus package name against your partnerId. |
minSdk | build.gradle.kts | Android 11 (API 30) or later. |
| Play Services | Device | Needed at runtime for Play Integrity. |
The Wi-Fi permissions come from the SDK's manifest and merge into your app automatically:
<uses-permission android:name="android.permission.ACCESS_WIFI_STATE" />
<uses-permission android:name="android.permission.CHANGE_WIFI_STATE" />
Minimum OS versions
| Platform | Minimum | Why |
|---|---|---|
| iOS | 14 | App Attest and NEHotspotConfiguration Passpoint support. |
| Android | 11 (API 30) | Passpoint via WifiManager and the attestation floor. |
The two things that catch people out
Android — the wrong certificate. Play Integrity attests Google's app-signing certificate. Register the upload certificate's SHA-256 instead and every Play build fails attestation. The Play App Signing trap shows how to find the right one.
iOS — testing on the Simulator. App Attest doesn't run there, so connect() returns
attestationUnavailable. Always confirm issuance on hardware.
Wi-DAS vets and adds each app identity, so it's a closed-partner arrangement to begin with. Registering a new identity, or rotating a signing cert or bundle id, is a coordinated step: the new identity is added alongside the old one for an overlap window, then the old one drops off. No risky in-place swap.