Error: Operation not permitted. Verify the app has the necessary entitlements and that the application bundle is valid.

[Brunowilliang]

Environment:
React Native: 0.72.6
Expo: ~49.0.21 (built using --dev-client)
Package: @stripe/stripe-terminal-react-native version 0.0.1-beta.14
Test Device: iPhone 12

I am following the instructions provided in the @stripe/stripe-terminal-react-native library tutorial to implement the 'Tap to Pay' functionality in my React Native app. However, I am encountering issues in both simulated and physical modes.

Here is my code:

import React, { useEffect } from 'react'
import { Stack } from '@/components/ui/Stacks'
import { useStripeTerminal } from '@stripe/stripe-terminal-react-native'
import { Text } from '@/components/ui/Text'

export default function Home() {
  const { discoverReaders, cancelDiscovering, discoveredReaders } =
    useStripeTerminal({
      onUpdateDiscoveredReaders: (readers) => {
        console.log('onUpdateDiscoveredReaders', readers)
      },
    })

  useEffect(() => {
    console.log('Starting reader discovery...')

    const discover = async () => {
      console.log('Calling discoverReaders...')

      const { error } = await discoverReaders({
        discoveryMethod: 'localMobile',
        simulated: true, // false gives an error
      })

      if (error) {
        console.log('Error discovering readers:', error)
      } else {
        console.log('discoverReaders called successfully.')
      }
    }

    discover()

    return () => {
      console.log('Cancelling reader discovery...')
      cancelDiscovering()
    }
  }, [discoverReaders, cancelDiscovering])

  return (
    <Stack f={1} bg={'$background'}>
      {discoveredReaders.map((reader) => (
        <>
          <Text key={reader.id}>id: {reader.id}</Text>
          <Text key={reader.id}>locId:{reader.locationId}</Text>
          <Text key={reader.id}>baseUrl: {reader.baseUrl}</Text>
          <Text key={reader.id}>device: {reader.deviceType}</Text>
          <Text key={reader.id}>ip: {reader.ipAddress}</Text>
        </>
      ))}
    </Stack>
  )
}

Scenario 1: simulated: true
When the simulated property is set to true, the device reader is detected, but the status is shown as 'offline'. Here's the log:

LOG onUpdateDiscoveredReaders [{"availableUpdate": null, "batteryLevel": null, "batteryStatus": "unknown", "deviceSoftwareVersion": null, "deviceType": "appleBuiltIn", "id": null, "ipAddress": null, "isCharging": null, "label": null, "location": {"address": [Object], "displayName": "Stripe HQ", "id": "st_simulated", "livemode": false}, "locationId": "st_simulated", "locationStatus": "set", "serialNumber": "APPLEBUILTINSIMULATOR-1", "simulated": false, "status": "offline"}]

Scenario 2: simulated: false
When the simulated property is set to false, an error is displayed, indicating a problem with the app bundle's permissions or configurations:

LOG Error discovering readers: {"code": "CommandNotAllowed", "message": "Operation not permitted. Verify the app has the necessary entitlements and that the application bundle is valid."}
LOG [Stripe terminal]: didFinishDiscoveringReaders {"error": {"code": "CommandNotAllowed", "message": "Operation not permitted. Verify the app has the necessary entitlements and that the application bundle is valid."}}

I would like to request assistance in understanding and resolving this problem. Specifically, I am looking for guidance on:

How to correctly configure the 'Tap to Pay' reader in the described environment.
Suggestions for resolving the 'offline status' issue in simulated mode.
Guidelines for fixing the 'CommandNotAllowed' error in non-simulated mode.
Any assistance or guidance would be greatly appreciated. Thank you!

[klcantrellsep]

I ran into the same issue and it looks like a couple things need set up in the Apple account as well as the entitlements file for this to work. See https://developer.apple.com/documentation/proximityreader/setting-up-the-entitlement-for-tap-to-pay-on-iphone for more info.

[bric-stripe]

@Brunowilliang regarding the reader showing up as "offline" please disregard that property for local mobile readers. See headerdocs: https://stripe.dev/stripe-terminal-ios/docs/Classes/SCPReader.html#/c:objc(cs)SCPReader(py)status

Note that non-Internet readers status will always be offline

regarding attempting to connect to the real readers hopefully @klcantrellsep link helped. That entitlement is necessary, some more details here: https://stripe.dev/stripe-terminal-ios/docs/Classes/SCPReader.html#/c:objc(cs)SCPReader(py)status

please re-open if you're still running in to trouble.

[Brunowilliang]

@klcantrellsep @bric-stripe Sorry for the delay, I was on vacation.

How strange, I'm still receiving this log:

 LOG  [Stripe terminal]: didFinishDiscoveringReaders {"error": {"code": "CommandNotAllowed", "message": "Operation not permitted. Verify the app has the necessary entitlements and that the application bundle is valid."}}

however, the entitlements have already been approved by Apple and I have already enabled it, as in the image:

[bric-stripe]

@Brunowilliang can you confirm the entitlement is correctly set in the built product?

1. build your project for device
2. find the .app file on the file system[^1]
3. right click and "Show package contents"
4. use Finder's QuickLook (hit space) on the embedded.mobileprovision file

it should show you a bunch of stuff including the entitlements that it actually built with. Can you paste a screenshot of that in here? It needs to explicitly have com.apple.developer.proximity-reader.payment.acceptance: true for TTP discovery to work.

[^1] by default should be somewhere like /Users/YourUser/Library/Developer/Xcode/DerivedData/YourApp-abboxoipvabznycdqfyqnpbgckzq/Build/Products/Debug-iphoneos/YourApp.app

[zeulb]

Hi @bric-stripe, we are having the same error testing. We have only been granted development permission so we are testing a development build on a tethered device using iOS 17.5.1.

[Stripe terminal]: didFinishDiscoveringReaders {"error": {"code": "CommandNotAllowed", "message": "Operation not permitted. Verify the app has the necessary entitlements and that the application bundle is valid."}}

[bric-stripe]

@zeulb I just looked through some of our logs and I see successful discover/connecReader calls from a matching app id. Were you able to get this working? Anything extra you had to do that we should call out in our docs/debugging steps?