We use AuthService to authenticate users using native framework. Framework doesn't offer access/refresh token which we could send. Should we file revoke REST API for account deleting? its all abount 30th June Apples rule.

Apple requires that the delete account operation be provided in the app on June 30. Regarding signinwithapple, the Apple website says that if your app offers Sign in with Apple, you'll need to use the Sign in with Apple REST API to revoke user tokens when deleting an account. Currently connected to signinwithapple, jwt verification is used in the background, and Apple api is not requested to complete verification, please refer to https://blog.csdn.net/w_monster/article/details/124171787 Method 1: id_token verification. Question: In this case, to delete the Apple account, do I still need to call Apple's REST API?

I am investigating Sign in with Apple in detail and its relation with OpenID Connect. In line with this, it is known if Sign In with Apple supports the OpenID spec Logout endpoint? (https://medium.com/@robert.broeckelmann/openid-connect-logout-eccc73df758f) (https://openid.net/specs/openid-connect-frontchannel-1_0.html) Thanks, Dan

Usually, people respond to these types of posts with things like: "honor the users choice here" This isn't about choice. We are a bank. A literal bank. For regulatory reasons, we need to collect the user's email during onboarding. It's used for legal communications including bank statements, as well as compliance with anti money laundering laws. In fact, email is one of the least invasive things we collect. Banks need to collect SSN, mailing/billing addresses, full legal names, phone numbers, and more. If Apple's response was, "there's no way to disable Hide My Email", then we would be legally required to have entirely separate UI after the "Sign in with Apple" screen where we collect and verify their real email. Two email auth screens. By telling us to NOT disable Hide My Email, you're saying that we need to have separate email collection UI, or we need to abandon Sign in with Apple entirely and go with custom email/password auth.

I am testing the apple server api. Every works fine in the sandbox environment. But when I want to change to url from sandbox to prod environment, I only get 401 unauthorized response. I am using the same way to generate jwt token in both sandbox and prod. Is the jwt token different in this two environments? Can anybody help me with this problem?

The server IP is restricted by appleid.apple.com. I tried several ways to access but was denied. In this case, how can I access Sign in with Apple？ Under linux system, curl https://appleid.apple.com The result returns:Failed connect to appleid.apple.com:443; curl http://appleid.apple.com The result returns:Failed connect to appleid.apple.com:80; The server can access other websites except appleid.apple.com

Hello fellas, I wanted to build a website where users can ping my iPhone, but I'm facing some trouble on the back-end side. I was wondering if there is an API for such a thing that would help and save a lot of time. Note I thought of using Findmyiphone but didn't really get the hang of it, and didn't know how to use it to get what I want Would love to hear out from you people regarding any thoughts! Thanks.

Hi, Any my organization there are many apple products, i am creating an app for organization. in that app barcode scan facility is their, now i am looking for apple api which can provide details after scanning to barcode like Product type, Model number..etc, is there any api available at apple & what is charges for that api. Thanks, Yusuf Shaikh

Hello, I'm having trouble retrieving user info on a SignIn use case. To start authentication process I send a request with a scope param like scope=name email. It is sent URL encoded. However after successful login, I do get the email information in the IdToken along with the sub etc. but the name is never provided, any idea what I'm doing wrong ?

Initially, our application provided the user with SIWA without requesting an email address. A bit later, the user authorization flow was changed and the email area for authorization request was added. However, the updated areas are not reflected in further responses, whether it is a native iOS or a web client. Both give the same result without email in JWT claims until the user manually cancels the authorization of the application from his Apple ID. Is there another way of getting email from already authorized user except revoking an access to our app?

I'm building a music streaming application using Music Kit JS. The frontend uses Vue and the backend uses Express. That said I had a few questions. I'm trying to generate a token that can be used with the music player configuration. This is how I have it setup currently:   const mk = await (window as any).MusicKit;   musicKit.value = await mk.configure({     developerToken: "DevTokenExample", userToken:"userTokenExample",     app: {       name: "Apple Streaming Example",       build: "1.0.0",     },   }); I've omitted my developer token and user token. I'm able to stream music just fine, but it plays "previews" of the songs. I have a login system setup for Apple OAuth authentication using this process: https://developer.apple.com/documentation/sign_in_with_apple/sign_in_with_apple_js And all that works fine, I can get tokens and everything. I tried using the access_token as the userToken in the music kit configuration and the player still plays the previews of the songs. I also used the id_token for the userToken to see if that would make a difference and it didn't do anything different, still played the previews. To clarify, yes the account used is signed up to Apple Music. Since that didn't work, I then used the "musicKit.authorize()" method which gave me a popup and I was trying to log in like that. Once I added in my 2FA code it just says there was an error connecting and I see in the URL an "UNABLE TO VERIFY JWT". The few posts regarding that issue don't seem to have any fixes. My questions are: Can I use the Sign In With Apple Rest API method shown for the music kit user token? If I can't use the Rest API method, how do I resolve the JWT error when using musicKit.authorize()?

Hello, We've stumbled upon the issue with "Sign in with Apple" functionality today. It worked absolutely fine for quite a long time on our dev instances, but today as we've deployed it to production - it stopped working both on dev and prod. The issue is that idToken doesn't have email field for all the requests except 1 specific email for some unknown reason. Because of this - we cannot identify the user in our database. We've tried to test with multiple Apple accounts, including the ones we've already used, the ones that were never used for this app and even the absolutely new accounts with no luck (except 1 specific account). What we do: Redirect user to authorization page like this: https://appleid.apple.com/auth/authorize?client_id={SERVICE_ID}&redirect_uri={REDIRECT_URI}&response_type=code After authorization user is redirected to the redirect_uri where we get state and code. On the server-side of web app we create client_secret signed JWT (as required by documentation) and send POST https://appleid.apple.com/auth/token request with the following data: { code, client_id: result.Item.clientId, client_secret, grant_type: "authorization_code", } In response we get JSON with "access_token", "token_type", "expires_in", "refresh_token" and "id_token" We parse "id_token" to get email. Code we use to parse: const idToken = JSON.parse(body).id_token || ""; const [, infoPart] = idToken.split("."); const buff = Buffer.from(infoPart, "base64"); const text = buff.toString("ascii"); const json = JSON.parse(text); if (json.hasOwnProperty("email")) { endUserEmail = json.email; } The issue is that for all accounts we've tested except 1 - there's no "email" field. We've also tried to use AWS Cognito to verify if this is the issue with our implementation. They specify scope=email%20name&response_mode=form_post in their request. Unfortunately, the result is the same - Cognito returns an error saying that there's no email. Is it some kind of misconfiguration on our side? What should we do to allow users to sign in with Apple ID? Thank you, Dmitrii Khizhniakov Web developer Graebert GmbH https://graebert.com

I'm generating reports for a few campaigns with the Search Ads API. I've been running into this problem, where if a campaign is running in multiple countries (in my specific case: ['AR', 'CL', 'CO', 'PE']), I'm unable to find a way to get more granular results. The report only shows that list in the metadata. So my question is: is there any way to determine how well the ad performs in each country in the list as opposed to seeing the results grouped together? json payload: json = { "startTime": start_date, "endTime": end_date, "selector": { "orderBy": [ { "field": sort_field, "sortOrder": sort_order } ], "conditions": conditions, "pagination": { "offset": offset, "limit": limit } }, "timeZone": "UTC", "returnRecordsWithNoMetrics": no_metrics, "returnRowTotals": return_row_totals, "granularity":granularity, "returnGrandTotals": return_grand_totals } post request: requests.post("https://api.searchads.apple.com/api/v4/reports/campaigns", json=json, headers=headers) campaign metadata: {'campaignId': CAMPAIGN_ID, 'campaignName': CAMPAIGN_NAME, 'deleted': False, 'campaignStatus': 'PAUSED', 'app': {'appName': APP_NAME, 'adamId': ADAMID}, 'servingStatus': 'NOT_RUNNING', 'servingStateReasons': ['PAUSED_BY_USER'], 'countriesOrRegions': ['AR', 'CL', 'CO', 'PE'], 'modificationTime': '2021-12-14T23:42:57.281', 'totalBudget': {'amount': AMOUNT, 'currency': 'USD'}, 'dailyBudget': {'amount': AMOUNT, 'currency': 'USD'}, 'displayStatus': 'PAUSED', 'supplySources': ['APPSTORE_SEARCH_RESULTS'], 'adChannelType': 'SEARCH', 'orgId': ORG_ID, 'countryOrRegionServingStateReasons': {}, 'billingEvent': 'TAPS'} As you can see, there's a list of countries. At the moment, I am unaware of how to break it down into specific countries.

On my client mobile app I perform apple-id authorization and obtain IdentityToken from Apple server. Now I want to send this IdentityToken (looks like string xJahN102mdPq2jHAiisPsla012nYahKL ) to my application server. And I want to get user's email on my application server via processing this token. For google (for example) it is plain simple way, I just make a GET request to: https://www.googleapis.com/oauth2/v1/tokeninfo?access_token=google_identity_token And in case the token is correct, Google returns JSON with the user's email inside. What apple server endpoint should I call and what HTTP request should be done (GET, POST, etc) to obtain user's email using IdentityToken ? Thank you.

I'm currently using Log in with Apple and am wondering if Chrome's 3p cookie deprecation will impact any of our user flows. I was reading that for OAuth, SPA background token renewal (iframe) will break, and front-channel logout / session management will break for OIDC--has anyone heard this as well, or of any other user flows that may break?   Should I be concerned and is Apple working on developing any workarounds for breakages? Have they built anything in the past for Safari & Firefox's movement away from third party cookies (not sure if the impact will be the same for Chrome).

I'm having issues simulating a Sign In with Apple in the simulator. After some searching, it seems this has been an issue in the past iOS's but haven't found anything recent (this year 2022). The turning wheel spins in the simulator and doesn't authorize. Is this a bug still happening? I'm on iOS 15.2 Thanks.

Hi, I'm currently implementing various social login flows in Salesforce. Such an implementation essentially requires 3 steps: get an authorization code get an access token using the authorization code get user info using the access token I'm struggling with step 3. For example, Google provides this endpoint URL: https://www.googleapis.com/oauth2/v3/userinfo, but I can't find the equivalent for Apple. Can anybody help? Thanks

When I try login with apple, get "Invalid web redirect url". How can I set or update redirect url for my app. I want to see redirect url that already was set before, but I can't find where I set redirect url.

in memberships comparation table talk about free to use "Sign In..." feature (see screenshot) How I can get it for my web-site? Secret key for OAuth protocol and domain confirmation. From Xcode also dont allow to use this feature Reporting error like a "profile has been member of Developer Team" (my account Personal). In many cases from blog post which I found talk about free to use.