Assume you have a domain https://ota.mycompany.com . Create a folder app/ and upload:
Because itms-services bypasses the App Store review, an attacker who gains access to your enterprise signing certificate could distribute malware to your employees. with hardware security modules (HSMs) and never share them.
: Be careful with special characters in the URL string; Reddit contributors have warned that unsupported characters can invalidate the entire deployment URL. Distribute proprietary in-house apps to Apple devices
itms-services is a proprietary URL scheme used by iOS to trigger the installation of an application directly from a web server, bypassing the App Store. It is primarily designed for:
With iOS 14+, App Clips offer a code-based launch, not a full installation replacement. Itms-services Action Download-manifest Amp-url Https
When a user taps an itms-services link in Safari, it triggers a multi-step installation process handled by the device's internal "iTunes Store Manifest Service":
The exact keyword itms-services action download-manifest amp-url https is unlikely to appear in official Apple documentation, but it’s a real‑world search pattern used by developers who encounter the escaped ampersand in HTML or in logs. Understanding it means you understand the complete OTA installation flow.
By mastering the syntax balance between iOS system deep links, HTTPS data security requirements, and AMP page performance frameworks, developers can deliver reliable, rapid, and friction-free mobile application deployment funnels.
https://apps.yourcompany.com/releases/v1.2.3/MyApp.ipa https://apps.yourcompany.com/releases/v1.2.3/manifest.plist Assume you have a domain https://ota
The deployment process follows a specific three-step sequence:
In some documentation (or malformed copies), you might see amp-url . This is not a separate parameter. It is an HTML entity encoding error where & becomes & amp; (without space). Correctly parsed, amp-url is simply &url . We will address this common typo later.
| Component | Meaning | |------------------------|-------------------------------------------------------------------------| | itms-services:// | The custom scheme that tells iOS to handle the request. | | ?action=download-manifest | Required action parameter. It instructs iOS to download a manifest file. | | &url= | Separator (ampersand) followed by the location of the manifest. | | https://... | The absolute URL to the .plist manifest file. Must use HTTPS . |
Breaking it down:
: If your .plist path contains spaces or special characters, you must encode them properly. Developers on Stack Overflow often discuss the nuances of URL parameters in itms-services when debugging failed triggers.
<!DOCTYPE html> <html> <head><title>Install Company App</title></head> <body> <h1>Internal App Distribution</h1> <p>Tap the button below to install the app on your iOS device.</p> <a href="itms-services://?action=download-manifest&url=https://cdn.mycompany.com/manifest.plist"> 📱 Install App </a> <p>⚠️ You must have the enterprise provisioning profile installed on your device.</p> </body> </html>
types text/xml plist;