Hello, I need to use a apple sign in in ios application, i get my authorization code from hybryde apllication : let options: SignInWithAppleOptions = { clientId: ConstConfig.APPLE_CLIENT_ID, redirectURI: ConstConfig.APPLE_REDIRECT_URI, scopes: ConstConfig.APPLE_SCOPES, state: ConstConfig.APPLE_STATE, nonce: ConstConfig.APPLE_NONCE }; SignInWithApple.authorize(options) .then((result: SignInWithAppleResponse) => { this.authenticate.appleAuthorizationCode = result.response.authorizationCode; this.authenticate.appleUser = result.response.user; this.authenticate.appleIdentityToken = result.response.identityToken; i send this 3 value to my backend JAVA to validate the accessToken and get the refrsh token, validate java Method : logger.info("Apple authorization validation"); // get the subject received from the client String clientSubject = getSubject(identityToken); // verifying the code by the apple server String token = getToken(); logger.debug("Authorize with token:" + token); Map<String, String> params = new HashMap<>(); params.put("client_id", APPLE_CLIENT_ID); params.put("client_secret", token); params.put("code", authorisationCode); params.put("grant_type", "authorization_code"); params.put("redirect_uri", ""); if (redirectURI != null) { } String response = post(APPLE_AUTH_URL, params); logger.info("Apple authorization response:" + response); AppleTokenResponse tokenResponse = objectMapper.readValue(response, AppleTokenResponse.class); if (tokenResponse.getError() != null && tokenResponse.getError().length() > 0) { logger.warn("Error during verification of the code. Reason:" + tokenResponse.getError()); return null; } String serverSubject = getSubject(tokenResponse.getId_token()); if (!serverSubject.equals(clientSubject)) { logger.warn("Validation failed, subject does not match!"); return null; } return getClaims(tokenResponse.getId_token()); the JWT TOken : return Jwts.builder() .setHeaderParam(JwsHeader.KEY_ID, APPLE_KEY_ID) .setHeaderParam(JwsHeader.ALGORITHM,"ES256") .setIssuer(APPLE_TEAM_ID) .setAudience(APPLE_APPLE_ID_URL) .setSubject(APPLE_CLIENT_ID) .setExpiration(new Date(System.currentTimeMillis() + (1000 * 60 * 5))) .setIssuedAt(new Date(System.currentTimeMillis())) .signWith(SignatureAlgorithm.ES256, pKey) .compact(); how i get my private key : File file = new File(APPLE_CERTIFICATE_PATH); try { PEMParser pemParser = new PEMParser(new FileReader(file)); JcaPEMKeyConverter converter = new JcaPEMKeyConverter(); PrivateKeyInfo object = (PrivateKeyInfo) pemParser.readObject(); APPLE_PRIVATE_KEY = converter.getPrivateKey(object); logger.info("load apple private keys Ok."); } catch (Exception ex) { logger.error("error on generate apple sign in private Key : ", ex); } thr response still return : {"error":"invalid_grant","error_description":"client_id mismatch. The code was not issued to bundleID"}, i don't know the reason. i read that i nedd to check in testFlit, ido but i still get the same error, i also put the same redirect_url in front and back (for me that not needed because i dont use u web sign in ) but i still get the same error. for my bundle id i use the APP Identifier not the service Identifier in front and back. its correct ? thank for your help.

After successfully logging in using apple sign-in. I get back the default response: the authorization code. I send the entire payload to my backend to which I then, use the docs - https://developer.apple.com/documentation/sign_in_with_apple/generate_and_validate_tokens to verify the auth_code. I get back this response. { "error": "invalid_grant", "error_description": "client_id mismatch. The code was not issued to com.example.bundle." } I've checked the bundleId several times. I've created new Identifiers and keys, used those new values instead and I get the same issue. According to the errorResponse - https://developer.apple.com/documentation/sign_in_with_apple/errorresponse documentation: invalid_grant The authorization grant or refresh token is invalid, typically due to a mismatched or invalid client identifier, invalid code (expired or previously used authorization code), or invalid refresh token. Any recommended test solutions to diagnose this issue?

Hey i am trying to Link Zelle API with SWIFT Based Ecommerce Store , Getting error code 8889275440 , and 18889275440 , Am trying to track and put balance into users account as i receive the payment from user and post directly to his account when he tries to add funds , But getting the above two error codes

I have the below code block to call the token endpoint. The endpoint succeeds from Postman with JSON response but from my web application, it fails with CORS error. What could be the reason for this behavior? const axios = require('axios'); const qs = require('qs'); let data = qs.stringify({ 'grant_type': 'authorization_code', 'code': 'xxxxxxyyyyybbb, 'redirect_uri': 'https:myApp/login', 'client_id': 'com.myclient_id', 'client_secret': 'myworkingsecret' }); let config = { method: 'post', maxBodyLength: Infinity, url: 'https://appleid.apple.com/auth/token', headers: { 'Content-Type': 'application/x-www-form-urlencoded' }, data : data }; axios.request(config) .then((response) => { console.log(JSON.stringify(response.data)); }) .catch((error) => { console.log(error); });

We are implementing a web app with Angular as frontend and java springboot as backend. while trying to use signin with Appleid in our application login page, we are getting Invalid_Client. please find the attached log and image of error. log.txt

Hey i am trying to integrate my api with my machine for some testing work but it is showing me an error code possibility combinations 18336324201 , 08336324201 , 8336324201 , Can anyone help me out fixing this i have been working really hard for this project

In the app I am currently creating, I want to make the user logged in only after signing in with apple and making in-app purchases. In other words, if the user only creates an account and does not make in-app purchases, he/she is not logged in, and we do not want to display the "delete account" button. However, if the user leaves the app without making an in-app purchase, the account information will be kept on the server. I understand that after 6/30/2022, users must be able to delete their accounts. Can we use a batch process to periodically delete accounts that have not made in-app purchases and hit the API for token deletion to satisfy the app's review requirements? Also, would it be a problem if we mention in the terms of service, etc. that accounts that have not made in-app purchases are to be deleted periodically?

We are currently developing a new iOS application, and we plan to use Sign in with Apple for user authentication. We have a few questions related to this. We understand that Sign in with Apple is compliant with OpenID Connect. However, in our service, the use cases for access_token and refresh_token are limited. Therefore, even if we do not use these tokens, is there a possibility that we will receive a rejection in the Apple Store Review process? Specifically, we are thinking of saving the user's identifier, which can be obtained at the time of authentication, on our server and using it to identify the user. ASAuthorizationAppleIDCredential According to Apple's guidelines (5.1.1 Data Collection and Storage), we need to invalidate the user's tokens when the account is deleted. Does this requirement apply even if the token has already expired? App Store Review Guidelines 5.1.1 Revoke tokens Thank you in advance for your help!

Identifiers > Web Authentication Configuration > Website URLs select domains and subdomains or return urls is not working what's problem ?

Hi there, when using Touch ID, the call back following a request to auth/authorize does not include any user information ( user={} ), but it does if the user log in using a password. Is there a reason ? How to handle that Thanks

HI just wondering if other users are experiencing apple authentication being down. I am unable to sign in using apple auth into my application, and wanted to know if this was server or client side

Hi. I transfered an app that uses apple login. but, I didn't do the Transferring your apps and users to another team process, So, I'm working on Bringing new apps and users into your team. Is it possible to transfer a user with just Bringing new apps and users into your team.? I'm having trouble with the part where I get the access_token from the Bringing new apps and users into your team. action. I've only entered it with the NEW TEAM's information. POST /auth/token HTTP/1.1 Host: appleid.apple.com Content-Type: application/x-www-form-urlencoded grant_type=client_credentials&scope=user.migration&client_id={client_id}&client_secret={client_secret} client_id : APP bundle ID client_secret : Created by referencing [Create the client secret] in Generate and validate tokens. require 'jwt' key_file = 'key.p8' team_id = 'TeamID' client_id = 'AppID' key_id = 'KeyID' ecdsa_key = OpenSSL::PKey::EC.new IO.read key_file headers = { 'kid' => key_id } claims = { 'iss' => team_id, 'iat' => Time.now.to_i, 'exp' => Time.now.to_i + 86400*180, 'aud' => 'https://appleid.apple.com', 'sub' => client_id, } token = JWT.encode claims, ecdsa_key, 'ES256', headers puts token POST /auth/token HTTP/1.1 Host: appleid.apple.com Content-Type: application/x-www-form-urlencoded grant_type=client_credentials&scope=user.migration&client_id={client_id}&client_secret={client_secret} { "error": "invalid_client" } Thank you.

Hello community! To begin I want to say that I am a junior developer. We are about to publish our app, after several tests in TestFlight and we received that our app was rejected for the following reason: Guideline 4.0 - Design Your app offers Sign in with Apple as a login option but does not follow the design and user experience requirements for Sign in with Apple. Specifically: - Your app requires users to provide their name and/or phone number after using Sign in with Apple. This information is already provided by the Authentication Services framework. These requirements provide the consistent experience users expect when using Sign In with Apple to authenticate or log in to an account. Next Steps Please review the Sign in with Apple experience in your app to address the issues we identified above. Resources To learn more about App Store design requirements, see App Store Review Guideline 4 - Design. For an overview of design and formatting recommendations for Sign in with Apple, review the Human Interface Guidelines. The application, after logging in with apple, gives the user the option to edit the name and phone number, and we save that information in our personalized server. And I am using the Ionic-Cordova framework and for Google Plus authentication --> cordova-plugin-googleplus. I was reading the guides and the resources that they offer me, but I did not reach a good resolution. Any ideas for this problem? Thank you so much!

When I attempt to get authorization token I get 400 error. I pass in the following info: client id team id key identifier client secret access code redirect url I'm testing this on a launched nodejs backend, and a testflight build of my react native/expo app. I know my code works because I'm using the exact same setup on a different project and it works perfectly. I'm assuming I'm doing something wrong setting up the keys in apples Certificates, Identifiers & Profiles site, but anything I try doesn't work. Is there clear instructions somewhere on how this should be set up?

Hello guys, please how can i create my imei verification website for all Apple products?

Hi all. In order to prepare for the new "Account deletion guidance", I have been trying to retrieve access_token and refresh_token from the authorization_code but the POST request to https://appleid.apple.com/auth/token always results invalid_grant error. https://developer.apple.com/documentation/sign_in_with_apple/generate_and_validate_tokens I've tested with fresh authorization_codes that were not expired and generated by actual devices (not simulators), but I always end up with "The code has expired or has been revoked" message. Can somebody please help? {"error":"invalid_grant","error_description":"The code has expired or has been revoked."}%   Here's my request via cURL. curl -v POST "https://appleid.apple.com/auth/token" -H 'content-type: application/x-www-form-urlencoded' -d 'client_id={bundle_id}' -d 'client_secret={new JWT string}' -d 'code={authorization_code'} -d 'grant_type=authorization_code' Here are the headers and claims for generating a new JWT string. headers = { 'kid' => private_key_id (.p8), } claims = { 'iss' => team_id, 'iat' => Time.now.to_i, 'exp' => Time.now.to_i + 86400*180, 'aud' => 'https://appleid.apple.com', 'sub' => bundle_id, } For alg Im using ES256.

I'm working on integrating Sign In with Apple into my app. The app is written in React Native using expo and I'm using this component nearly exactly for now. https://docs.expo.io/versions/latest/sdk/apple-authentication/#usage I've been able to successfully generate the Authorization Grant code with this component, however, I've been unable to validate it server side. Here is the error I'm currently getting: { "error": "invalid_grant", "error_description": "The code has expired or has been revoked." } Details I've added a Sign In with Apple key to my app and downloaded the private key. I've published the app to TestFlight so I get my own bundle identifier and not Expo's in the simulator. This is the format of the authorization grant code from the a first request (formatting not JSON as it's output from go): { realUserStatus:1 , authorizationCode:xxxx , fullName:{ middleName:null nameSuffix:null namePrefix:null givenName:null familyName:null nickname:null} state:null identityToken:xxxxxxx email:null user:xxxxx } I'm using this library to generate the verification request: https://github.com/pagnihotry/siwago I'm running a go script from my laptop (not the a domain associated with the app), as well as copying/pasting information into Postman. Both methods are using x-www-form-urlencoded. The go app is signing the client_secret, and I assume it's the correct way because I'm no longer getting a 400 invalid_client. I've decode the client_secret and confirmed that the validation request is formatted: { "alg": "ES256", "kid": "SECRET_KEY_ID" } { "iss": "TEAM_ID", "iat": 1626740200, "exp": 1629332200, "aud": "https://appleid.apple.com", "sub": "BUNDLE_ID" } I've confirmed that the client secret is signed with my private key by validating it against my private key's public complement. The form data for the authorization to https://appleid.apple.com/auth/token request is (no punctuation on values): client_id: [BUNDLE_ID] client_secret: [signed secret] code: [authorizationCode] (from the Authorization grant code) grant_type: authorization_code redirect_uri: [left empty in go, not a key in Postman] I've requested my authorization code repeatedly and thought that I might be throttled, but then I tried a brand new one the first time but still got the invalid_grant response. Looking for any help, I've spent the past two solid days on this and am exhausted.

Hi team Our app is using Apple Login and its working fine. As our focus is moving towards the enterprise customers(B2B) rather than normal cosumer, so decided to remove the Apple Login(FB, Google etc), but for the some of our customers who are already logged with Apple Login, we wanted to keep this functionality in case they want to logout and login again. So our question is this, Can we keep apple login functionality without showing the Apple login button ? Flow will be -> User will be see a login page with option to enter name and email and a continue button. As soon as user will enter the name and email and press continue, our backend will inform us that the user is old user and logged in with Apple. After getting the information we'll open the Apple Login flow without any user interaction. Please let us know in case of any confusion or doubt in explaining the question. Thanks

I created an identifier, but did not select "Sign In with Apple" I created a key, and enabled the WeatherKit service. I have a simple python script to retrieve from the API, but I am getting "NOT ENABLED" import datetime import time # pip install requests PyJWT cryptography import jwt import requests import json from cryptography.hazmat.primitives.serialization import load_ssh_private_key from hashlib import sha1 with open("/Users/don/.ssh/AuthKey_LBV5W26ZRJ.p8", "r") as f: myKey = f.read() # matches my service id WEATHERKIT_SERVICE_ID = "net.ag6hq.sandysclock" #This is my id, redacted here WEATHERKIT_TEAM_ID = "<redacted>" # this is my private key, redacted here WEATHERKIT_KID = "<redacted>" # key ID WEATHERKIT_KEY = myKey WEATHERKIT_FULL_ID = f"{WEATHERKIT_TEAM_ID}.{WEATHERKIT_SERVICE_ID}" thisLat = 34.03139251897727 thisLon = -117.41704704143667 def fetch_weatherkit( lang="en", lat="34.031392", lon="-117.41704", country="US", timezone="US/Los_Angeles", datasets = "currentWeather,forecastDaily,forecastHourly,forecastNextHour", ): url = f"https://weatherkit.apple.com/api/v1/weather/{lang}/{lat}/{lon}?dataSets={datasets}&countryCode={country}&timezone={timezone}" now = int(time.time()) exp = now + (3600 * 24) token_payload = { "sub": WEATHERKIT_SERVICE_ID, "iss": WEATHERKIT_TEAM_ID, "exp": exp, "iat": now } token_header = { "kid": WEATHERKIT_KID, "id": WEATHERKIT_FULL_ID, "alg": "ES256", "typ": "JWT" } token = jwt.encode(token_payload, WEATHERKIT_KEY, headers=token_header, algorithm="ES256") response = requests.get(url, headers={'Authorization': f'Bearer {token}'}) return response #### End of Def myFetch=fetch_weatherkit() myStatus=myFetch.status_code myJSON=myFetch.json() print("myJSON=" + str(myJSON)) print("myStatus=" + str(myStatus)) This outputs: python weatherkit.py myJSON={'reason': 'NOT_ENABLED'} myStatus=401 I get the same results if I use the jwt.io service to create a token and use curl What am I doing wrong?

Hi, I am currently implementing a validation on Apple OAuth token. When a user is trying to register, client-side receives tokens from Apple and sends the token when requesting a sign up. Therefore, I need to validate the OAuth token that it is an actual token from Apple. These are my questions: I've done some research and seems like that Apple does not allow me to have static client_secret which I need for token validation request. Also, I need to use the .p8 which I got when registering a app to the app store. But I'm uncertain of what I can do with the .p8 to receive the client secret. I think that I need to send the request with the token to this url https://appleid.apple.com/auth/token. Am I able to send an access token for validation? On Apple's developer document, it says that I need to send a refresh token. https://developer.apple.com/documentation/sign_in_with_apple/generate_and_validate_tokens Thank you.