MDM Deployment

The installer package is for macOS. On Windows, Raycast is distributed through the Microsoft Store and winget, which most MDM solutions can deploy directly.

Every Raycast release for macOS ships as a signed and notarized installer package (.pkg) next to the regular download. It is meant for IT teams that deploy software to a fleet rather than for installing Raycast by hand: your MDM pushes it to managed Macs, optionally before anyone has logged in, and you decide which version your organization runs.

How the package behaves

It installs Raycast.app into /Applications and nowhere else, even if a copy of Raycast exists somewhere else on the Mac.
It only lays down files. Nothing is launched during installation, so it works in deployments that run before a user session exists.
The app is installed with root ownership, which is the normal outcome of an MDM install. Raycast detects this and routes its own updates through a privileged helper, so managed installs keep updating themselves unless you turn that off with DisableAutomaticUpdates.
The package is signed with Raycast's Developer ID Installer certificate and notarized by Apple, so Gatekeeper accepts it without any exceptions on your side.

Deploy it

Download the package for the release you want from the list below. Each download link points at the exact version shown, so it is safe to hand to an MDM that fetches packages by URL.
Add it to your MDM as a custom package. In Jamf this is a package in a policy, in Iru a Custom App, and in Intune a macOS app of type PKG.
Scope it to the Macs or groups that should have Raycast and let the MDM install it. Reinstalling the same version is safe; installing a newer package updates the app in place.
Deploy a configuration profile alongside the package to configure Raycast, for example to turn off automatic updates or skip the welcome walkthrough. If your organization requires members to sign in with a work account, add the MDM Sign-In Enforcement profile too.

Configure Raycast with managed preferences

Raycast reads a few keys from a configuration profile for the com.raycast.macos preference domain. A value set by a profile always wins over the member's own settings. You can put several keys in one profile.

Key	Type	Effect
`DisableAutomaticUpdates`	Boolean	Raycast never checks for, downloads, or installs updates. Update rows in Root Search and the Check for Updates command and button are hidden; the version stays visible on the About page.
`SkipInitialSetup`	Boolean	The first launch opens Raycast directly instead of the welcome walkthrough. Sign-in enforcement and macOS permission prompts still appear when needed.
`ReplaceDefaultLauncher`	Boolean	On the first launch, Raycast takes over ⌘ Space and turns off Spotlight's shortcut, the same as choosing Replace Spotlight during setup. Members can change the hotkey afterwards.
`RequiredSignInDomain`	String	Members must sign in with an email on this domain. See MDM Sign-In Enforcement.

SkipInitialSetup and ReplaceDefaultLauncher are applied once, on the first launch after the key is present. Deploy the profile before or together with the package so it is in place when Raycast first opens. Removing either key later does not bring back the walkthrough or restore the previous hotkey.

ReplaceDefaultLauncher only takes over ⌘ Space while Raycast is still on its default ⌥ Space hotkey. If the member already chose another hotkey, Raycast leaves it and Spotlight alone. If another app holds ⌘ Space, Raycast tries again on a later launch.

To set it up:

Download or copy the template .mobileconfig file below, which turns on DisableAutomaticUpdates, SkipInitialSetup, and ReplaceDefaultLauncher

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>PayloadContent</key>
  <array>
    <dict>
      <key>PayloadType</key>
      <string>com.raycast.macos</string>
      <key>PayloadIdentifier</key>
      <string>com.raycast.mdm.managedpreferences.settings</string>
      <key>PayloadUUID</key>
      <string>UNIQUE-UUID-1</string>
      <key>PayloadVersion</key>
      <integer>1</integer>
      <key>PayloadDisplayName</key>
      <string>Raycast Managed Preferences</string>
      <key>DisableAutomaticUpdates</key>
      <true/>
      <key>SkipInitialSetup</key>
      <true/>
      <key>ReplaceDefaultLauncher</key>
      <true/>
    </dict>
  </array>
  <key>PayloadType</key>
  <string>Configuration</string>
  <key>PayloadIdentifier</key>
  <string>com.raycast.mdm.managedpreferences</string>
  <key>PayloadUUID</key>
  <string>UNIQUE-UUID-2</string>
  <key>PayloadVersion</key>
  <integer>1</integer>
  <key>PayloadDisplayName</key>
  <string>Raycast Managed Preferences</string>
  <key>PayloadScope</key>
  <string>User</string>
</dict>
</plist>

Replace UNIQUE-UUID-1 and UNIQUE-UUID-2 with unique identifiers
Remove the keys you don't need, or set them to <false/>

Create a new/custom Profile in your MDM, upload the .mobileconfig file, and scope it to the same Macs or groups as the package
Verify it's installed on a managed Mac under System Settings → General → Device Management, where it appears as "Raycast Managed Preferences"

Pin the version your fleet runs

Set DisableAutomaticUpdates and deploy the package for the version you want. Members stay on that version until you deploy a newer package, which updates the app in place. Installing an older package over a newer one is not supported, because newer versions can migrate local data in ways older versions cannot read.

The key is checked on every update cycle, so you can turn automatic updates off or back on at any time without reinstalling.

Verify a package

Before adding a package to your MDM you can check its signature and notarization on any Mac:

pkgutil --check-signature Raycast_2.5.0.12_arm64.pkg
spctl --assess --type install --verbose=2 Raycast_2.5.0.12_arm64.pkg

The first command lists the certificate chain, which should start with "Developer ID Installer: Raycast Technologies Inc", and report that the package is trusted by the Apple notary service. The second prints accepted with source=Notarized Developer ID, which is the verdict a managed Mac reaches at install time. Each release below also carries the MD5 checksum of its package, which you can copy with a click, so you can confirm what your MDM fetched matches what we published.

Releases

Loading releases

Chat with Raycast AI Send Feedback