no valid 'aps-environment' entitlement string found for application

I am trying to configure my app to support push notification, but keep getting this error: Failed to get token, error: Error Domain=NSCocoaErrorDomain Code=3000 "no valid 'aps-environment' entitlement string found for application" UserInfo=0x1f818fc0 {NSLocalizedDescription=no valid 'aps-environment' entitlement string found for application}

I did enable my app to support push notifications (only for development at this point).
I did create the provisioning profile AFTER enabling the push notifications.
My bundle identifier is the same as appears in the profile.
In my profile file there is a string: aps-environment
I made sure that in both project and target under the "Code signing identity" section ALL the values are selected to be my provisioning profile.

Any more ideas? Thanks.

Solution

In my case, the stuff in my provisioning profile:

security cms -D -i ~/Downloads/spolskyDevelop.mobileprovision 
...
<key>application-identifier</key>
<string>P5GM95Q9VV.com.dca.spolsky</string>
<key>aps-environment</key>
<string>development</string>

Was different than the stuff in the app that was actually built (you can find out where it is built by looking at Xcode's Logs tab)

codesign -d --entitlements - '/Users/drew/Library/Developer/Xcode/DerivedData/spolsky-bdbtdfjeeywhqzccpmmceqvnhgtm/Build/Products/Debug-iphoneos/spolsky-ios.app'
<dict>
    <key>application-identifier</key>
    <string>Y2X6Z7Z2GR.com.dca.spolsky-ios</string>
    <key>get-task-allow</key>
    <true/>
    <key>keychain-access-groups</key>
    <array>
        <string>Y2X6Z7Z2GR.com.dca.spolsky-ios</string>
    </array>
</dict>

This was true even though the "Currently Matches" hint text under Code Signing Identity was indicating the correct provisioning profile--weird, huh? To make a weird story weirder, the correct provisioning profile was being installed on the device when I ran, (Settings->General->Profiles) leading me to believe the provisioning profile was right--but it was falling back to a wildcard ID when the app was actually launched.

The clue was the difference in the output of these two commands:

Y2X6Z7Z2GR.com.dca.spolsky-ios vs P5GM95Q9VV.com.dca.spolsky

When I made the bolded part match, the italicized part changed to match automatically. In addition, the output of security and codesign were in agreement, and no more aps-entitlement error.

My guess here is that XCode was using a wildcard-style match on my non-wildcard ID. ("spolsky" is, after all, quite nearly "spolsky-ios"), and this explains the "Currently Matches" output. But something in the build chain is more strict about this, so it falls back to an actual wildcard ID during the build.