Killing the Export Compliance Prompt in Rork Builds for Good

Setting it once in Rork (React Native / Expo)

Rork proper is built on Expo, so this lives in app.json (or app.config.js).

{
  "expo": {
    "name": "My Wallpaper App",
    "slug": "my-wallpaper-app",
    "ios": {
      "bundleIdentifier": "net.example.mywallpaper",
      "config": {
        // false = no non-exempt encryption (HTTPS / Keychain only)
        // This becomes ITSAppUsesNonExemptEncryption in the ipa's Info.plist
        "usesNonExemptEncryption": false
      }
    }
  }
}

Per the Expo config reference, ios.config.usesNonExemptEncryption writes ITSAppUsesNonExemptEncryption into the standalone ipa's Info.plist. Push it through to native and rebuild:

# 1. Regenerate the native project so the key lands in Info.plist
npx expo prebuild --platform ios --clean
 
# 2. Read it back — do not assume it applied
/usr/libexec/PlistBuddy -c "Print :ITSAppUsesNonExemptEncryption" \
  ios/MyWallpaperApp/Info.plist
# expected: false
 
# 3. Build and submit
eas build --platform ios --profile production
eas submit --platform ios --latest

Do not skip step 2. "I set it but it didn't take" is where the hours disappear.

Setting it once in Rork Max (native Swift)

Rork Max emits native Swift rather than React Native, so there is no app.json. The key goes straight into Info.plist. If the distinction between the two products is still fuzzy, this breakdown of Rork vs Rork Max covers the split.

<!-- Info.plist -->
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN"
  "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>CFBundleShortVersionString</key>
  <string>2.1.0</string>
 
  <!-- No non-exempt encryption. The Connect prompt stops appearing. -->
  <key>ITSAppUsesNonExemptEncryption</key>
  <false/>
</dict>
</plist>

If the Rork Max editor does not expose Info.plist directly, prompting for it works fine: "add ITSAppUsesNonExemptEncryption to Info.plist with a value of false" comes back as a one-key diff. Keeping your prompts that surgical is also how generated code stays something you can maintain by hand later.

This key changes build metadata and nothing else. Your app behaves identically.

When the setting doesn't stick

Three causes cover almost every report.

1. prebuild never ran, or a cached build won

Editing app.json does not touch an already-generated ios/ directory. Run npx expo prebuild --clean, or force a clean build:

eas build --platform ios --profile production --clear-cache

2. ios.config and ios.infoPlist are fighting each other

Expo also exposes ios.infoPlist for injecting arbitrary keys. Both routes write the same key, and conflicting values cancel out. Pick one.

{
  "expo": {
    "ios": {
      // Do not set both. If you use config, drop it from infoPlist.
      "config": { "usesNonExemptEncryption": false },
      "infoPlist": { "ITSAppUsesNonExemptEncryption": false }
    }
  }
}

3. You hit the known case where the build tool ignores it

There are open reports of ios.config.usesNonExemptEncryption not being honored during EAS builds, leaving you with an interactive prompt anyway. The reliable defense is to stop trusting the config and inspect the artifact — script below.

If App Store Connect has already locked into asking every time, you can reset the answer under the app's App Information → Export Compliance Documentation. With the key present, the next build will not raise the question at all.

What answering "true" actually signs you up for

Worth knowing purely so you never check it by accident.

If you genuinely ship non-exempt crypto, you either hand documentation to Apple or file an annual self-classification report with the US Bureau of Industry and Security, due each February 1. Depending on the algorithm, a formal CCATS classification or an encryption registration (ERN) may also be required — and App Store Connect's help is explicit that making that call is your responsibility, not Apple's.

Shipping to the French App Store adds a separate French encryption declaration, aimed mainly at secure storage, secure messaging, and anti-virus apps.

For a solo developer, that paperwork earns its keep only when custom E2E encryption is the product. It stacks on top of the $99/year Apple Developer Program, in hours rather than dollars. Design around Keychain and HTTPS and you never enter this room at all — which is the trade I recommend unless you have a specific reason not to.

Verify the artifact, not the config

#!/usr/bin/env bash
# check-encryption-key.sh — verify the declaration key before you submit
set -euo pipefail
 
IPA_PATH="${1:?usage: ./check-encryption-key.sh <path-to.ipa>}"
TMP_DIR="$(mktemp -d)"
trap 'rm -rf "$TMP_DIR"' EXIT
 
unzip -q "$IPA_PATH" -d "$TMP_DIR"
PLIST="$(find "$TMP_DIR/Payload" -maxdepth 2 -name Info.plist | head -1)"
 
if [ -z "$PLIST" ]; then
  echo "No Info.plist found in: $IPA_PATH"
  exit 1
fi
 
# The plist may be binary — normalize to XML before reading
plutil -convert xml1 "$PLIST" -o "$TMP_DIR/out.plist"
 
if grep -q "ITSAppUsesNonExemptEncryption" "$TMP_DIR/out.plist"; then
  VALUE="$(/usr/libexec/PlistBuddy -c \
    'Print :ITSAppUsesNonExemptEncryption' "$TMP_DIR/out.plist")"
  echo "OK — ITSAppUsesNonExemptEncryption = ${VALUE}"
else
  echo "MISSING — Connect will ask on every single build"
  exit 1
fi

$ chmod +x check-encryption-key.sh
$ ./check-encryption-key.sh ~/Downloads/build-2.1.0.ipa
OK — ITSAppUsesNonExemptEncryption = false

No Mac in your setup because Rork Max compiles in the cloud? Then let TestFlight finish processing and treat "no warning icon in the build list" as your check. This piece on reclaiming pre-submission self-audits covers the other items that quietly vanish when Xcode is not in the loop.

Fold it into the setup, once

You set this key once per app, for the lifetime of the app. Which means the cheapest moment to do it is right when you create the project — same pass as the bundle ID, the version string, the icon.

So: open the app.json of whatever Rork project is on your screen right now (or Info.plist, on Rork Max) and look for usesNonExemptEncryption. If it isn't there, add the line, run prebuild, and call it a day. For the wider release path, the two-click publishing walkthrough picks up from there.

Small recurring warnings are the ones that never get fixed. Clearing them one at a time has made shipping feel noticeably lighter for me — I hope it does the same for you.