How it works
What it is
A fully in-browser installer for Expo Go. It does exactly what Xcode "free provisioning," AltStore, or SideStore do — sign an app with your own Apple ID and install it onto a physical iPhone/iPad over USB, except the entire thing runs client-side in a web page. It exists so you can install any Expo Go SDK build directly onto a device.
The remarkable part is how little the server does. Almost everything — Apple authentication, certificate generation, code signing, and USB device communication — happens in your browser.
The pieces
Two WASM modules do the crypto/native work:
•
/anisette_rs.wasm — a Rust implementation of Apple "anisette" data: the device-attestation headers (X-Apple-I-MD*) required to talk to Apple's GrandSlam auth servers.
•
/openssl-wasm/openssl_wasm_bg.wasm — OpenSSL compiled to WASM, used to generate a keypair + CSR and to do PKCS7/CMS signing. Plus a signMacho/signIpa module (our zsign fork) that re-signs the Mach-O binaries and repacks the IPA.
1. Apple login (GrandSlam / GSA). It authenticates directly against gsa.apple.com/grandslam/GsService2 using SRP (Secure Remote Password), so your plaintext password never leaves the browser. It handles 2FA — trusted-device push, SMS, and phone security codes (/auth/verify/trusteddevice, /auth/verify/phone/securitycode). This is the same private protocol Apple's own tooling and projects like pymobiledevice3 use. That's the basis for the site's claim that credentials are "a temporary proxy for session authentication and are never stored, logged, or persisted."
2. A dumb CORS proxy is the only server-side logic. Browsers can't fetch Apple's domains directly, so there's a passthrough at /api/apple-proxy?host=<applehost>&path=<path>. It only relays to an allowlisted set:
new Set(["gsa.apple.com","developerservices2.apple.com","idmsa.apple.com"])
It just forwards bytes, all auth and signing crypto stays in the browser.
3. Free Apple Developer provisioning. Through developerservices2.apple.com/services/QH65B2/... it drives the classic "personal team" flow (cert valid ~7 days):
listTeams.action → get your free team
ios/submitDevelopmentCSR.action → register a dev certificate
ios/listAllDevelopmentCerts.action
ios/addDevice.action / listDevices → register the device UDID
ios/addAppId.action / listAppIds → register the Expo Go bundle ID
ios/downloadTeamProvisioningProfile → get the .mobileprovision
4. Device communication over WebUSB. It reimplements the entire libimobiledevice stack in JavaScript on top of navigator.usb (requestDevice / transferIn / transferOut), with no native helper daemon:
•
usbmux (the multiplexer), lockdownd (device info/UDID, service startup)
•
com.apple.mobile.installation_proxy (instproxy) to install the app
•
AFC (com.apple.afc) to push files
5. The IPA and re-signing. /api/expo-go-ipa returns the list of available Expo Go SDK builds. The browser downloads the chosen unsigned IPA, unzips Payload/Expo Go.app, re-signs the Mach-O binaries/frameworks with the freshly minted personal cert + provisioning profile + entitlements (the WASM signer takes certFile, pkeyFile, entitlements.plist, bundleId), rezips, and installs it to the device via instproxy over WebUSB.
6. Expo/EAS account tie-in. /api/expo-login (via an expo-session header) links your Expo account, and /api/eas-devices (register/sync) + /api/eas-certs register your device UDID and team cert with EAS — so the same device is also provisioned for ad-hoc EAS dev builds.
In one sentence
The browser logs into Apple (SRP + anisette via WASM through a thin CORS relay), mints a free 7-day developer cert and provisioning profile for your device's UDID, downloads the unsigned Expo Go IPA for your chosen SDK, re-signs it with OpenSSL/zsign compiled to WASM, and installs it straight to the USB-connected device by speaking usbmux/lockdownd/instproxy over WebUSB — a native Xcode/AltStore sideload flow reimplemented entirely as a static web app with essentially no backend beyond a proxy.
Made for the Expo community · By Expo