ITMS-90683 missing purpose string: what it means and how to fix it

What ITMS-90683 means

Apple protects certain resources behind user permission, including the camera, microphone, photo library, contacts, calendars, reminders, location, and the local network. To access any of these, your app must declare a purpose string in Info.plist: a short sentence the system shows in the permission prompt that explains why the app needs access.

ITMS-90683 is the error App Store Connect returns when your binary references one of these APIs but the matching purpose string key is missing. The check runs against the linked binary, so it can fire because of a framework or SDK you include, not only your own code. The email lists every missing key in the same report, so if it names five keys, all five need to be added.

Common keys and what they cover:

• NSCameraUsageDescription for the camera.
• NSPhotoLibraryUsageDescription for reading the photo library, and NSPhotoLibraryAddUsageDescription for adding to it.
• NSMicrophoneUsageDescription for the microphone.
• NSContactsUsageDescription for contacts.
• NSLocationWhenInUseUsageDescription for location while the app is in use.

Note that the keys are specific. NSCameraUsageDescription does not cover the microphone, and the when-in-use location key does not cover background location. Inventing a generic key name does not satisfy the check, because the scanner only recognizes Apple's published key list. The full set is in Apple's Information property list keys reference.

Why apps hit ITMS-90683

Common triggers:

• The app uses a privacy API, such as a photo picker or camera capture, but the purpose string was never added to Info.plist.
• A third-party SDK links a privacy API even though your own code does not call it, so the binary references the API and Apple requires the string.
• A merge, refactor, or build configuration change drops the key from the Info.plist that ships in the archive.
• The key exists in one configuration but not the one used for the release build.

The thread is the same: the binary can reach a protected resource, but there is no declared reason for it. Apple requires the reason so the user sees a meaningful explanation at the permission prompt.

How to fix it

1. Read which keys are missing. The ITMS-90683 email lists each key by name. Note every one, not just the first.
2. Add each key to Info.plist. For each flagged key, add it to the Info.plist in your app target with a clear, specific value, for example a Camera Usage Description that says why the app uses the camera.
3. Write honest, specific strings. The reason should describe the actual feature, such as scanning a receipt or attaching a photo, not a generic placeholder. Vague or empty strings can also draw a later review rejection.
4. Handle SDK-sourced hits. If a key is required only because of an SDK, you still add the string, and you should confirm the SDK genuinely needs that access. Update or remove the SDK if it does not.
5. Re-archive and re-upload. The error clears once the shipped Info.plist contains every required key.

How AppFlight helps

AppFlight generates native iOS apps in Swift and SwiftUI and manages the build, archive, and upload path, so the Info.plist that ships is part of the generated project rather than a file you have to remember to edit by hand. Because AppFlight knows which capabilities and integrations it wired in, such as a camera feature or a photo picker, it has the context to add the matching purpose string with a reason that fits the feature. ITMS-90683 is an upload-time check, and AppFlight reads the error, works on the missing key or the SDK behind it, and re-submits. AppFlight does not guarantee approval. The purpose strings still have to be accurate, and Apple reviews every app after the upload checks pass.