Mac app direct distribution: "Your account does not have permission to create Mac App Direct Distribution certificates"

Question

I want to distribute my mac application outside the App Store (as file downloadable from our servers), but every attempt to export archive from Xcode with option "Export a Developer ID-signed Application" ends with a "Permission failure":

Your account does not have permission to create Mac App Direct Distribution certificates

I've downloaded and added all certificates to my keychain (system). I'm using an Organization Apple Developer account, so is it possible to use this type of account to sign applications outside the App Store or must I have an Enterprise Program Account to do it? Or is there other problem?

Answer 1

I consulted this problem with Apple and their answer is:

You certainly don’t need an Enterprise account to distribute Developer ID signed apps. One gotcha here is that you must be the Team Agent in order to issue Developer ID certificates. Please double check that.

Problem was, that I have Admin role in our team, but only user with Team Agent role has permission to generate certificates for distribution of app outside the App Store (Developer-ID signed apps). So, I generated a Certificate Signing Request and sent it to our Team Agent, then he creeated and sent a certificate for me and now I can sign apps.

Answer 2

This seems to be a bug or poorly described feature in iTunes Connect & the Apple Developer portal.

I had a developer that joined my team, initially as a "member", but wasn't able to create certificates, even after giving him admin access. It turns out, that I believe we were only giving him admin access to Itunes connect, but not to the developer page.

The correct fix was to go to the developer portal, click the "People" tab (or go to this URL https://developer.apple.com/account/#/people/), remove his access, then use the Invite as Admins to add him to the account. He then had to go into Xcode and remove his developer account information, add it back in, and then he was finally able to upload builds to Testflight without this error.