Hi team, I'm troubleshooting some weird authentication issues within my website where I offer Signin with Apple option. Basically, after the user does Apple login, I have this script to update the location URI of the window opener back to my origin domain. But this line of the script is working correctly when login is launched in a browser such as Safari or Chrome, and it just got ignored when launched from a WebView within an application, and it can only be reproduced since iOS 15.5+. Here is some more context for comparison: Request from Safari: POST /callbackApple HTTP/1.1 Host: signin.example.com Content-Type: application/x-www-form-urlencoded Origin: https://appleid.apple.com Accept-Encoding: gzip, deflate, br Cookie: _ga=GA1.3.1679051778.1669664368; _gat=1; _gid=GA1.3.1808016405.1669664368; signin-cookie="5ce93a47904daa5e"; _abck=F930E04300E8E8AB552C14541A40AD3C~0~YAAQmZTYF7CO3fCBAQAAZkOmHQha0qNYdbsfcZ4zEtwsjoRST+T+DNTMb5+E9uL8OvEL3YA0K0Tn7xS+OKoGPGib5rmpBOZVQq1+XoPEFJOij8Ao8mMKrvztGMN0HgNBmldcy3BCpTLgWFgckVzF/MOLhHL87yVOhCnsKqJEG8WwuH9I1G6xb2k4R6CfX9qzCfh9pexN2KBbE/FW7KtrP5KkRq2Y2a6AlQA3hr068J426LBkRAiHhj7mrAjIZHPXVlAq9PLKSO/LOxvovAbh6bOUP6EZHk1De4IvPU5DqwdA2yQMtyrz/K+MHE5NA0oaLTjhiSmTNUFOckcmQAl+9PRuXYpgVa5UukkSztNLlbn4xOi2ZvZ4B0jtSg57AeXsl56j36NSCmBqioEdA7N54V3IiwOz~-1~-1~-1 Connection: keep-alive Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_1_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.1 Mobile/15E148 Safari/604.1 Referer: https://appleid.apple.com/ Content-Length: 1293 Accept-Language: en-US,en;q=0.9 Same request sent from WebView in another App POST /callbackApple HTTP/1.1 Host: signin.example.com Content-Type: application/x-www-form-urlencoded Origin: https://appleid.apple.com Accept-Encoding: gzip, deflate, br Cookie: ga=GA1.3.439982965.1669661343; _gat=1; _gid=GA1.3.712268364.1669661343; signin-cookie="39fd5b51e0350b24" Connection: keep-alive Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_1_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.1 Mobile/15E148 Safari/604.1 Referer: https://appleid.apple.com/ Content-Length: 1448 Accept-Language: en-US,en;q=0.9 And the response to the requests above is always the same, a blank HTML page as shown below with some scripts to update the opener and redirect user back to my website. Note that the script self.close() always works, but window.opener.location.replace(redirectUri) only works when it's inside of Safari or Chrome browser but not in Webview opened by some other application. Response body content: ... <script type="text/javascript"> var redirectUri = 'https://example.com'; redirectUri = redirectUri + "access_token=" + "${accessToken?no_esc}" + "&token_type=apple"; [#if nickName??] redirectUri = redirectUri + "&nickName=" + "${nickName?no_esc}"; [/#if] redirectUri = redirectUri + "&_eventId=loginFromApple" + "&execution=" + "${execution?no_esc}"; if ( window.opener ) { window.opener.location.replace(redirectUri); self.close(); } </script> ... I'm not sure could it be related to some security update within Webkit https://support.apple.com/en-us/HT213412 but we started to see this issue after the iOS version mentioned in the post. Any help would be much appreciated, thanks.

In many guides (especially my use case at least) from some time ago, I see that when setting up "Sign In With Apple", you must verify the domain by downloading a txt file and hosting it in this path https://example.com/.well-known/apple-developer-domain-association.txt. The question is that I have just configured "Sign In With Apple" and not only I have not found anywhere the button to download this file (neither where theoretically it should be in the Services ID settings nor anywhere), but apparently everything works fine without having done it. This has been a recent change, is it no longer necessary to verify domains in this way? We are going to take this into production so I want to make sure everything is OK.

I have apple authentication with the next auth library. I have done all the configuration and my web app was working perfectly. I later changed the redirect_uri on the apple developer console under service_id configuration. the new redirect_url is not working, instead is the old URI that works. Am I missing something?. Stucked for a month...

Can I use the access token that is received from sign in with Apple to access the Apple music API if I have MusicKit enabled under my app services or is the Music-User-Token a separate token. I cannot use MusicKit as my application is being written in Go.

Here's what's failing -- help! curl --location --request POST 'https://apple-pay-gateway.apple.com/paymentservices/paymentSession' \ --header 'Content-Type: application/json'  --header 'merchantIdentifier: merchant.com.discounttire.prelive'  --header 'displayName: Discount Tire'  --header 'initiative: web'  --header 'initiativeContext: stg.discounttire.com'  --data-raw ''   And   curl --location --request POST 'https://apple-pay-gateway.apple.com/paymentservices/paymentSession' \ --header 'Content-Type: application/json'  --header 'merchantIdentifier: merchant.com.discounttire.prelive'  --header 'displayName: Discount Tire'  --header 'initiative: web'  --header 'domainName: stg.discounttire.com'  --data-raw '' Is this a result of not doing.... Note To access the sandbox environment, use POST https://apple-pay-gateway-cert.apple.com/paymentservices/registerMerchant. first?

Hello: I'm developing a windows Destop App. And want to support sign in with Apple to get the user's email address without a webserver support. Is it possible?

Hey there, We’re implementing sign_in_with_apple package through https://pub.dev › packages › sign_in_with_apple. We’ve been able to follow the link above to configure our application and also set up our apple Service IDs, and redirect url on the apple website Successful use case for login/sign-in: A click on the apple login button should redirect a user to apple’s chrome page on an android phone Here, users should be able to put in their apple email and password in which apple authenticates. After apple authenticates the user, apple sends an authorization code back to the application either as a query or on the json body of the redirect url provided by the application. The authorisation code is then used on our server side to set up a session for the particular user. Our use case: After apples authenticates the user’s email and password after which we don’t get an authorisation code being sent back to our application. We receive “null” instead of an authorisation code. This results in no session being created for the particular user who tries to sign in with Apple What could we be doing wrong?

In the server-side verification link of Sign in Apple ID, we only obtain the public key from the Apple server and verify the JWT validity of the IdentityToken, which is regarded as a successful login. The AuthorizationCode is not further verified and the Token is obtained and saved. However, at present, Apple requires to request the revoke token when deleting the user. We did not hold the Token before. Is there no need to request the revoke token interface when the user deletes the account? Will the APP review fail due to this?

Diagnose errors received by the Sign in with Apple client, or its server infrastructure by identifying the underlying causes of common error codes and explore their potential solutions. View Technote TN3107 &gt;

At the moment I'm busy integrating Sign In with Apple in Zotonic (https://zotonic.com). What I discovered is that access to the REST api end-point can be very unreliable. The development server I use sometimes can't access the end-point for hours because it rejects incoming connections. $ curl https://appleid.apple.com/auth/keys curl: (7) Failed to connect to appleid.apple.com port 443: Connection refused Is this a known issue? How can clients fix this issue? Is there a form they can fill out to unblock their server's ip-address (like microsoft has for delivering mail) Regards, Maas

I cannot find any documentation on this. I would like to know if I should ever worry that my "Sign in with Apple" for my app will stop working due to throttling.

Hello, I am going to make users sign in with apple on my website. This account is my personal account and the real client_id of my company's service is com.ymsco.jangjeon The site url is https://jangjeonhae.bubbleapps.io/ and my redirect uri is https://jangjeonhae.bubbleapps.io/login I have a problem to show the window for sign in with apple. I'm using this https://appleid.apple.com/auth/authorize?response_mode=form_post&response_type=code&client_id=com.ymsco.jangjeon&scope=name%20email&state=[thestate]&redirect_uri=http://jangjeonhae.bubbleapps.io/login/ I got the error "invalid request_ invalid redirect uri" Is there any problem on the link address? Please let me know how to solve the problem.

I am trying to follow the documentation to verify a user in my backend. My App follows the schema that appears in the diagram at the top of the page. I am using npm and: next in frontend (App) express in backend (API Server) Once I receive the token in the API Server from the App, I check it's validity following the steps under the heading Verify the identity token without problem. I have trouble understanding if I am doing enough when I try to follow the stpes in Obtain a refresh token. In this step, I am sent to the page in the documentation to Generate and validate tokens. However, that part of the documentation refers to client tokens, not to user tokens. I can get a new access_token and id_token for the user from my API using the following request: curl -v POST "https://appleid.apple.com/auth/token" \ -H 'content-type: application/x-www-form-urlencoded' \ -d 'client_id=CLIENT_ID' \ -d 'client_secret=CLIENT_SECRET' \ -d 'grant_type=refresh_token' \ -d 'refresh_token=REFRESH_TOKEN' Is this enough to verify the identity? Should I then check that the id_token I receive matches the one I have or is it enough that I have checked the jwt information and validated the refresh_token? Thanks!

Hello, I am working on an OAuth login with Apple for our web applications. We ended up using the npm module "react-apple-signin-auth", which is based off of the apple js library. We are using a popup setup with name and email as requested scopes. This all works perfectly fine on Chrome/Chromium, Mozilla, etc. However, the same code base has issues on Safari browser. We are also having troubles implementing this for our react native Webview. It seems that after the popup is shown (after being manually allowed on the client PC), it frezes after logging in and clicking Continue. It stays with a white screen and does not return back to the origin/redirectURI. I can see someone has a similar issue: https://developer.apple.com/forums/thread/131438 Any clues?

The "Login with Apple" redirects via POST method. I can't store the given token in a session because Symfony resets it if there is a POST request from crossdomains. Is there any way to change the POST method to GET? All other OAuth2 applications are using GET and this works fine with PHP Symfony.

I am sending a post request from my server to get a refresh token after signing in with Apple. https://appleid.apple.com/auth/token The request sometimes succeeds and sometimes times out and I can't figure out why. Specifically, after sending a SYN, there is no SYN/ACK response from the Apple server. What we currently know is that There are cases where it times out and cases where it succeeds. Timeouts do not occur on the local server Why is there no SYN/ACK response? Is there anything else I can try?

Hi Folks, I am bit confused with the auth revoke API behaviour. It will remove Third party app from account or just delete the token so other information is not accessible. Application using apple ID still showing even after revoking using the POST https://appleid.apple.com/auth/revoke. https://appleid.apple.com/account/manage - sign in with Apple, Third party app is still listed. I have used Postman and the after POST Rest API call status was 200. auth revoke API shall remove app from account/manage or not ? Thanks for support.

Does apple sign in private key have expire date

We implemented Sign in with Apple ID in our web app and ServiceId, but The logo is not showing in the “Sign in with Apple” consent screen. Our App is on the store approved. Native Login Can show the App icon but Login with JS and serviceID not working Is there a way to configure this?