iOS auto-fill password feature: development with dev server behind VPN

Hi, I'm trying to implement IOS auto-fill feature and I followed the documentation - enable autofill and shared we credentials setup.

But before going to production, I need to test it in the development environment where the web is behind VPN.

Here is my setup:

• development server https://dev.mydomain.com behind VPN
• verified thatapple-app-site-specification is reachable in path https://dev.mydomain.com/.well-known/apple-app-site-specification (connected to VPN)
• apple-app-site-specification content

  "webcredentials": {
    "apps": [
      "appteamid.com.mybundle.id",
      "appteamid.com.mybundle.id.dev"
    ]
  }
}

• Xcode associated domains

webcredentials:dev.mydomain.com?mode=development

• ipa signed by our development profile (verified can be installed on developer device)
• ipa distributed via private repo sharing (not Testflight)

and it's not working :(.

questions:

• does it have to be distributed by Testflight?
• if it could be distributed by private repo should it there be appteamid.com.mybundle.id or should be com.mybundle.id (without appteamid)
• does the domain have to be publicly available (could it be the problem that this is behind VPN)?
• any other suggestions why it is not working?

thanks for any info