Cocos Creator, Cocos Quick, and cocos2d-x all land on an Xcode tree before App Store submission. Crab runs on that tree, the same way it does for Unity: add COSDK, sign Debug and Release, then obfuscate languages and resources in the exported project. It is not an IPA-only pass. Uni-app is the exception; that path is IPA hardening.
Which Cocos line you have
Creator / Quick usually export a native iOS project (often ObjC plus JS or Lua bindings). cocos2d-x is a C++ engine with an Xcode target. Both need a compile that already succeeds in Xcode before you open Crab. Do not copy an Xcode folder from another game and only change the display name.
Prepare the Xcode project
Copy the provided .framework and .dat into a COSDK folder, add that folder to the target, set Framework Search Paths, and put the .dat in Copy Bundle Resources on Xcode 16+. Align Bundle Id with the one you used when requesting a license. Switch signing to Manual if it is still Automatic. Build once. Details with screenshots: Cocos tutorial and cocos2d-x tutorial.
What to watch
JS / Lua scripts and large texture atlases are visible in the IPA if you skip resource obfuscation. Engine symbols that plugins resolve by string should go on the exclusion list. CocosPods Debug-only pods (for example LookinServer) can leak into a Release IPA; the docs tell you to mark those targets confuse-type=skip. Quit Xcode before Crab rewrites files.
After a successful run
Debug the extra target Crab adds, then export the IPA from the tool. If two Cocos games still look related under review, do the 4.3 self-check. Overview page: Cocos iOS obfuscation.
Request a trial, then archive and submit
Download App Center, choose the General or Uni-app edition, then apply for a license on the registration-code page. The docs cover the operator steps.