What does stapling a notarization ticket actually do?

Updated October 26, 2026 · Dmytro Virych

Guide · 3 min read

Stapling attaches Apple's notarization ticket to your app, disk image or installer package, so Gatekeeper can confirm the notarization even when the Mac has no network connection. Without it, Gatekeeper has to look the ticket up online.

You uploaded your app, Apple's notary service said it was accepted, and now the guides tell you to run one more command before you ship. That command is stapler, and it is easy to skip because the app seems to work without it on your own Mac. This page explains what it changes, and for whom.

What is a notarization ticket?

When the notary service finds no problems, Apple's documentation says it "generates a ticket for you to staple to your software; the notary service also publishes that ticket online where Gatekeeper can find it."

So a ticket exists in two places once notarization succeeds: on Apple's servers, and in your hands. Stapling is the act of putting your copy inside the thing you distribute.

Do you need to staple if Gatekeeper can find the ticket online?

Not for the app to be notarized, but yes if you want it to open without a network connection. Apple describes the online case this way: after notarization completes, "the next time any user attempts to run your app on macOS 10.14 or later, Gatekeeper finds the ticket online. This includes users who downloaded your app before notarization."

Then comes the reason to staple anyway. Apple says to attach the ticket "so that future distributions include the ticket. This ensures that Gatekeeper can find the ticket even when a network connection isn't available."

Think about who that affects: someone installing from a disk image on a laptop with no Wi-Fi, a Mac behind a firewall that blocks the lookup, or a disk image copied onto a USB stick and carried to another machine. The stapled ticket travels with the file, so the answer does not depend on the network.

How do you staple?

Apple's example is one command, run after notarization has finished:

xcrun stapler staple "Overnight TextEditor.app"

(Overnight TextEditor.app is Apple's sample name; use your own.) Per Apple, you can attach a ticket to "your app, bundle, disk image, or flat installer package".

If you build with Xcode's own notarization UI, you may not run this yourself. Apple says that when notarization finishes, "Xcode downloads the ticket and staples it to your archive", and that you then export the archive again to get a distributable version that includes the ticket.

Which files can you not staple?

Two cases catch people out, and Apple documents both:

What you notarized	Can you staple it?	What Apple says to do
A ZIP archive	No, not directly	Run `stapler` on each item you added to the archive, then create a new ZIP containing the stapled items.
A standalone binary	Not currently	"Although tickets are created for standalone binaries, it's not currently possible to staple tickets to them."

The ZIP rule has a consequence for how you build a release. If you ship a ZIP, the order is: notarize, staple the app inside, then zip again. Zipping the app first and stapling afterwards leaves the ticket outside the archive your customers download.

What does "Error 65" mean?

If stapler fails with Error 65, an Apple Developer Technical Support engineer explains it on Apple's forums: "Error 65 means that stapler couldn't find a ticket for the cdhash of the item you're trying to staple."

In practice that points at the item rather than the tool. The ticket is looked up for the specific code you are stapling, so a file that was changed, re-signed or rebuilt after you uploaded it is not the file the notary service saw. Staple the exact thing you submitted.

Apple also lists a few other stapler problems, such as an old macOS or Xcode version, and points at the stapler man page for its other exit codes.

Is a stapled ticket the same thing as a signature?

No. The signature says who built the software and that it has not changed since. The ticket says Apple's notary service scanned that signed software and found nothing wrong. Apple also says the notary service keeps an audit trail of software distributed with your signing key, and if unauthorized versions of your software turn up, you can work with Apple to revoke the tickets associated with those versions.

What this page does not cover

Apple's documentation, as I could read it, describes how to attach a ticket but not a command for checking that a given file already carries one, so this page does not recommend one. If you need to confirm it, read the stapler man page on your Mac (man stapler) rather than trusting a tutorial's flags, this one included.

#notarization #distribution