A web-based tool for acquiring and installing iOS apps outside the App Store. Authenticate with your Apple ID, search for apps, acquire licenses, and install IPAs directly to your device.
This fork is maintained at TO8E/AssppWeb, based on Lakr233/AssppWeb. It includes browser-side SAP authentication from upstream PR #88 and a one-time redownload fallback when the primary endpoint returns a successful but empty app list.
Existing Compose deployments can use the separate build, activation and rollback scripts. Export browser accounts before switching versions. The scripts preserve the original Compose settings and do not reauthenticate Apple accounts.
Enable Privacy mode in Settings to replace account identities with numbered labels and hide account fields, sensitive input text, notification contents, server information and install QR tooltips. The preference survives page reloads. Privacy-mode account detail links omit email addresses. This changes the displayed information; stored credentials, Apple requests and encrypted account exports retain their original data.
Version History loads the version ID list automatically. Fetch version numbers automatically in Settings is off by default, including when upgrading older settings: manual mode shows the entire list without pagination and fetches a version number only when its button is clicked. Cached numbers appear immediately in both modes. The preference persists in the current browser.
With automatic lookup enabled, version numbers resolve sequentially for the current page (20 entries), after paging has stopped for 350 ms. Passing through an intermediate page cancels its pending lookups. Turning automatic lookup off stops queued automatic requests. Failed lookups can be retried individually.
Successful labels are cached in the browser by app and storefront, with up to 1,000 entries and no account credentials. Entries expire 30 days after fetching; reading them does not extend their lifetime. Expired entries are removed on app startup, when a tab becomes visible, hourly while open, and when accessing the cache. If the browser is closed, cleanup resumes on the next visit. Old cache entries without timestamps are discarded on upgrade. The store metadata's releaseDate is the app's original release date; it is not displayed as a historical version's publication date.
SAP initialization runs in the browser and can take roughly two minutes in Chrome on the upstream test machine. Components are cached, but refreshing the page or changing account device identifiers requires a new signer. See the SAP implementation notes for measurement limitations.
AssppWeb uses a zero-trust design where the server never sees your Apple credentials. All Apple API communication happens directly in your browser via WebAssembly (libcurl.js with Mbed TLS 1.3). The server only acts as a blind TCP relay (Wisp protocol) and handles IPA compilation from public CDN downloads.
⚠️ Important Security Notice: There are no official Asspp Web instances. Use any public instance at your own risk. While the backend cannot read your encrypted traffic, a malicious host could serve a modified frontend to capture your credentials before encryption. Therefore, do not blindly trust public instances. We strongly recommend self-hosting your own instance or using one provided by a trusted partner. Always verify the SSL certificate and ensure you are connecting to a secure, authentic endpoint.
恳请所有转发项目的博主对自己的受众进行网络安全技术科普。要有哪个不拎清的大头儿子搞出事情来都够我们喝一壶的。
This builds the fork from its Dockerfile using Cloudflare Workers + Containers.
Requirements:
- Cloudflare Workers Paid plan (Containers are not available on Free).
- Deploy/build token with:
Workers Scripts EditContainers EditCloudchamber Edit
If your build log fails at Deploy a container application with Unauthorized, your build token is missing required Containers/Cloudchamber permissions.
Click to show Railway deployment instructions
- Go to railway.com/new/image → enter
ghcr.io/to8e/assppweb:latest - In service Settings, set Healthcheck Path to
/api/settingsand deploy - Right-click the service → Attach volume → mount path:
/data - In Variables, set
DATA_DIR=/dataand deploy - In Settings → Networking, generate a public domain or add a custom domain
Notes
- The free trial works but has limitations (volume expiry, network restrictions). Hobby plan ($5/month) or above is recommended for reliable use.
- Enable Serverless in service settings to scale down to zero during idle periods
- Railway auto-updates
:latestimages from GHCR — new releases will be deployed automatically within a few hours
⚠️ Custom domain with Cloudflare: Railway's Cloudflare integration creates DNS records with Proxy enabled (orange cloud) by default. After authorizing, go to Cloudflare DNS settings and switch the CNAME record to DNS only (gray cloud) — Railway handles TLS automatically. If you keep Cloudflare Proxy on, you must set SSL/TLS mode to Full (not Flexible or Full Strict), otherwise you'll get an infinite redirect loop. See Railway docs.
Click to show manual Docker Compose setup instructions
Setup Docker Compose
curl -O https://raw.githubusercontent.com/TO8E/AssppWeb/main/compose.yml
docker compose up -dEnvironment Variables
| Variable | Default | Description |
|---|---|---|
PORT |
8080 |
Server listen port |
DATA_DIR |
./data |
Directory for storing compiled IPAs |
PUBLIC_BASE_URL |
(auto-detect) | Public URL for generating install manifests (e.g. https://asspp.example.com) |
UNSAFE_DANGEROUSLY_DISABLE_HTTPS_REDIRECT |
false |
Disable HTTPS redirect (see warning below) |
AUTO_CLEANUP_DAYS |
0 |
Automatically delete cached IPA files older than specified days (0 to disable) |
AUTO_CLEANUP_MAX_MB |
0 |
Automatically delete oldest cached IPA files when size exceeds this MB limit (0 to disable) |
MAX_DOWNLOAD_MB |
0 |
Reject downloads exceeding this size in MB to prevent out-of-memory errors (0 to disable) |
DOWNLOAD_THREADS |
8 |
Number of parallel threads for IPA downloads (1–32) |
ACCESS_PASSWORD |
(none) | Require a password to access the web UI and API (empty to disable) |
Reverse Proxy (Required for Install Apps on iOS)
iOS requires HTTPS for itms-services:// install links. You must put AssppWeb behind a reverse proxy with a valid TLS certificate.
⚠️ Redirect loop (ERR_TOO_MANY_REDIRECTS)? Some reverse proxies (e.g. NAS built-in proxies) always sendX-Forwarded-Proto: httpeven when the client connected via HTTPS, causing an infinite redirect loop. If you cannot configure your proxy to send the correct header, setUNSAFE_DANGEROUSLY_DISABLE_HTTPS_REDIRECT=trueas a last resort. This disables the HTTP→HTTPS redirect — you must ensure your proxy enforces HTTPS externally.
The following is an example Caddyfile configuration:
asspp.example.com { reverse_proxy 127.0.0.1:8080 }
AssppWeb relies on the Wisp protocol over WebSocket (/wisp/) for its zero-trust architecture. Ensure your reverse proxy or CDN (e.g., Nginx, Cloudflare) is configured to allow WebSocket connections, otherwise the app will fail to communicate with Apple servers.
DDoS Protection
IPA files can be hundreds of megabytes. If your instance is publicly accessible, put it behind a CDN like Cloudflare to absorb bandwidth and prevent abuse.
MIT License. See LICENSE for details.
For projects that was stolen and used heavily:
For friends who helped with testing and feedback:
