Getting Started with AAX Code Signing for Pro Tools Plugins

If you're building an AAX plugin for Pro Tools and looking for the code signing tools, you've probably noticed the answer isn't immediately obvious. A lot of developers reach out to PACE first. This makes sense as PACE provides the signing tools; but the process actually starts with Avid.

AAX plugins must be signed

Code signing is not optional for Pro Tools plugins. Without a valid signature, your plugin will fail to load in commercial versions of Pro Tools.

At its core, code signing proves two things: that the plugin came from a verified developer, and that it hasn't been modified since release.

For AAX plugins, the signing process is managed jointly by Avid and PACE.

Step 1: Contact Avid

Email Avid at [email protected] with the subject “PACE AAX Code Signing Tools Request” to start the process.

The email should include:

• Company name: Full name of your company
• Admin name: Name of the person responsible for administrating the process
• Admin email address: Contact email address for the Admin
• Telephone number: Contact number (including international dialling code)
• Company website: Your company’s website URL
• Brief description of the plugin: A short summary of what your plugin does
• Avid Developer email address: Your email address registered on Avid Developer

As AAX plugins run inside Pro Tools, Avid needs to verify you're a legitimate publisher before any signing certificates or tools are issued. Once they've approved your request, they'll forward your details to PACE on your behalf.

Step 2: Get set up with PACE

Once Avid approves you, PACE provides the signing tools and onboarding support you need to get started.

Note: You’ll need an iLok USB to safely store the signing certificate.

This is a good time to loop in whoever manages your build and release workflow: signing needs to become part of your pipeline, not an afterthought.

A typical AAX release workflow looks like this:

1. Build the final release version of the plugin
2. Apply AAX signing during packaging or deployment
3. Verify the integrity of the signed binary
4. Test the signed build inside Pro Tools
5. Distribute to customers

Step 3: Consider cloud signing for your CI pipeline

If you're running a cloud-based CI build system, a physical iLok USB attached to a signing machine isn't always practical. PACE's AAX Cloud Signing service solves this. It brings AAX code signing into your existing cloud pipeline without any hardware dependencies, enabling truly automated, continuous integration.

Contact PACE to learn more.

What signing doesn't do

A signed plugin is not a protected plugin. Code signing establishes authenticity; it tells Pro Tools and your customers that the binary came from you and hasn't been tampered with. It does not stop someone from reverse engineering the plugin or distributing a cracked version.

Modern audio plugins often represent years of DSP research, proprietary algorithms, or analog modeling work. That IP is usually the most valuable thing in the product, and reverse engineering tools have become increasingly accessible.

Signing is there to protect the Pro Tools ecosystem from rogue developers. It doesn’t protect the IP contained within the plugins.

Going further with iLok Licensing

For developers thinking beyond signing, the conversation usually turns to two things: protecting the software itself, and controlling how it's licensed.

Developing and managing a licensing system gets complex quickly and pulls focus away from building the product. iLok Licensing handles that infrastructure, and since iLok is already trusted across the professional audio industry, your customers will likely know it well.

If you want to talk through your licensing needs, get in touch with PACE.