Thanks for being a part of WWDC25!

How did we do? We’d love to know your thoughts on this year’s conference. Take the survey here

Enable a Developer ID-signed and notarised extension without enabling "allow unsigned extension"

Hello, According to the documentation:

If you provide your extension in macOS and don’t want to use the Mac App Store for distribution, you can sign and notarize your extension’s app with a Developer ID to distribute it outside the Mac App Store.

However, I found this to be untrue in practice. Even after signing and notarising the Safari extension correctly, it is not possible to enable it in Safari without turning on "allow unsigned extension".

This makes it impossible to distribute your Developer ID–signed and notarized extension outside the Mac App Store.

I would like to distribute my web extension directly to employees in my organization using MDM without having each user manually enable "allow unsigned extension" for it to work. Any way to make it work?

The documentation is quite confusing in this aspect, it says "Safari only supports signed extensions" but my extension is rejected even if notarised and signed.

What version of Safari are you using for your testing?

I am using 18.3 (20620.2.4.11.5)

Support for Developer ID-signed and notarized Safari Web Extensions was introduced in Safari 18.4 for macOS. Please update to Safari 18.4 and try again.

Enable a Developer ID-signed and notarised extension without enabling "allow unsigned extension"
 
 
Q