One easy-to-miss requirement when signing an iOS app in CI with a cloud-managed distribution certificate: the App Store Connect API key (.p8) must have Admin access. App Manager or Developer access is not enough for this API-key-based export workflow, even if your Apple Account can sign successfully in Xcode.
With an existing archive and an ExportOptions.plist configured for automatic signing and your team, export it like this. Set KEY_PATH to the absolute path of your .p8 file, and provide KEY_ID and ISSUER_ID from App Store Connect:
xcodebuild -exportArchive \
-archivePath "build/MyApp.xcarchive" \
-exportPath "build/export" \
-exportOptionsPlist "ExportOptions.plist" \
-allowProvisioningUpdates \
-authenticationKeyPath "$KEY_PATH" \
-authenticationKeyID "$KEY_ID" \
-authenticationKeyIssuerID "$ISSUER_ID"
If export fails with a cloud signing permission error, check the key’s role, not just the role of the person who created it. Keep the .p8 file in your CI secrets and out of version control.
The same API-key permission issue is documented in Apple’s Developer Forums. Apple also explains cloud-managed certificates.