# How to Notarize Electron Mac App by CLI

Currently, if you create a Mac App, but not distributed it by Mac AppStore, Apple ask developers to notarize this app, otherwise the user who download your app and click to open it, will receive an alert: **"mac cannot be opened because the developer cannot be verified"**.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1719668090270/fed42e0e-c60d-4877-b557-2ba8e31d9eaa.png align="center")

This post described how to notarize a macOS app by CLI, you must build and sign you app first.

About how to sign Mac App, please see:

* [https://www.electronjs.org/docs/latest/tutorial/code-signing](https://www.electronjs.org/docs/latest/tutorial/code-signing)
    
* [https://nocommandline.com/blog/how-to-sign-an-electron-app-on-mac-with-electron-builder/](https://nocommandline.com/blog/how-to-sign-an-electron-app-on-mac-with-electron-builder/)
    

## Generate App Specific Password

Then, you must register an [app specific password](https://support.apple.com/102654), in this case, we store it into KeyChain, run:

```bash
xcrun altool --store-password-in-keychain-item "AC_PASSWORD" \
  -u "$your_applie_id" \
  -p "$your_app_password"
```

Note, the `AC_PASSWORD` is the title of record in KeyChain, the `$your_applie_id` is your Apple ID Email, and `$your_app_password` should be the app specific password you have generated.

If you don't want to store it to KeyChain, you may replace all `AC_PASSWORD` as your password plain text when you run commands.

## Get Team ID

Run this command:

```bash
xcrun altool --list-providers -u "$your_apple_id" -p "@keychain:AC_PASSWORD"
```

You will see a team list, the column: `ProviderShortName` is your Team ID.

## Notarized App

After you build your Mac App (also, you must sign it with Developer ID Application), let's notarize it by CLI.

Run this command:

```bash
xcrun notarytool submit your-app.dmg --wait --apple-id "$your_apple_id" \
  --password "@keychain:AC_PASSWORD" \
  --team-id "$your_apple_team_id";
```

This will take a while, and shows a process, please wait for it. After process finished, run the following command:

```bash
xcrun stapler staple your-app.dmg
```

Now, you app has been notarized, you can distribute your app to the web and let users download it.

## For Electron Builder

If you are using `electron-builder` , you can make this action automatic. Just install the package: [electron-builder-notarize](https://www.npmjs.com/package/electron-builder-notarize)

```bash
npm i electron-builder-notarize --save-dev
# OR
yarn add electron-builder-notarize --dev
```

And add this config to `electron-builder.config.json`

```bash
{
  ...
  "mac": {
    ...
    // Add below 2 lines
    "hardenedRuntime": true ,
    "entitlements" : "./node_modules/electron-builder-notarize/entitlements.mac.inherit.plist"
  },
  "afterSign" : "electron-builder-notarize" // <-- Add this line
  ...
}
```

And you must add an `.env` file (remember to ignore from git):

```bash
APPLE_ID=...
APPLE_ID_PASSWORD=...
APPLE_TEAM_ID=...
```

Now, when you pack electron app by electron-builder, it will auto notarize your app everytime.