Sign in with Apple

RSS for tag

Sign in with Apple enables users to sign into apps and websites using their Apple ID.

Posts under Sign in with Apple tag

200 Posts

Post

Replies

Boosts

Views

Activity

Transferring multiple apps that use Sign in with Apple
Hello, These questions are in regard to transferring Sign in With Apple users as part of an app transfer to another developer team. We’ve already read and absorbed the following documents from Apple, but we still have questions that aren’t covered in these documents, due to the unique nature of our use case. Transferring Your Apps and Users to Another Team Bringing New Apps and Users Into Your Team Resolving Sign in with Apple Response Errors Background: We have a suite of three apps that we are tranferring to another developer team. Each app supports Sign In With Apple. Our accounts/users are shared among all three apps. We have all three apps currently grouped together for SIWA. We’re aware that we will need to un-group them before doing the SIWA user transfer. Questions: The API for generating and exchanging transferIDs for users (endpoint /auth/usermigrationinfo) requires a parameter client_id which is described in the docs as "The identifier (App ID or Services ID) for the transferring app." Since we are transferring a set of three apps which share users, we aren’t sure which AppID to use, or whether it matters? We’re assuming we only need to transfer the users once in total (not once-per-app), is this correct? Does it matter which of the three apps’ AppID we use for this? To give more specific context to this question, here’s a more detailed example: For simplicity’s sake, let’s say we have 10 user accounts total, and any of them could sign into any of our three apps. Users 1-7 have signed into all three apps previously User8 has only signed into AppA User9 has only signed into AppB User10 has only signed into AppC Ideally we want to transfer all 10 users all at once. Does it matter which AppID we use for client_id? For example, if we use AppA as the client_id, will we still be able to transfer all 10 users (including User9 and User10)? We’ve tested this on the sender team side, and we’re able to successfully create transferIDs for all 10 users using AppA as client_id. But we’re not sure if this will still work on the recipient side, that we’ll be able to exchange the transferID for all 10 users. . To add another wrinkle, there is a possibility that we won’t be able to transfer one of our three apps (due to one of Apple’s limitations for app transfer). In that case we’ll have to create a new app on the recipient team and shut down the old one on the sender team. But the other two apps in the suite would still be transferred normally. We’d still want all 10 users to be transferred, as the intention is still that all our users can sign into any of their existing accounts in any of the three apps. Would this scenario change the answer to question 1? For example, say we aren’t able to transfer AppC over to the new development team, but instead had to create a new app, AppCNew on the new development team. But we still are able to transfer AppA and AppB. Would we still be able to transfer all 10 users using AppA as the client_id? Including User10 who only ever signed in to AppC (which isn’t being transferred)? We'd really appreciate any answers or guidance that anyone can provide. Thank you, Adam
4
6
810
Dec ’24
`user` not returned from Sign in with Apple REST API
I have tried everything to get the user field returned with Sign in flow and it never does, not for new users, not even if i create a new app! Working with Apple is so frustrating and you have to pay for it!! Referencing this page, I am using scope=name email. I have tried using + and %20 as the spacer and neither makes a difference. I have also tried setting response_type = code and code id_token (again with + and %20 as the spacer) which also doesn't make a difference. Always the id_token is returned and always the email, but never the user. https://developer.apple.com/documentation/sign_in_with_apple/sign_in_with_apple_js/incorporating_sign_in_with_apple_into_other_platforms#3332115 AUTHORIZE REQUEST https://appleid.apple.com/auth/authorize? { "response_type": "code", "client_id": "com.example.service", "scope": "name email", "state": "77264297-813c-4738-83ef-f1b77daea04c", "redirect_uri": "https://example.com/auth/apple/callback", "code_challenge_method": "S256", "code_challenge": "2SJCneEpjKcN.....xIIHnpqcvjK_Y0s", "access_type": "offline", "nonce": "1734523662", "response_mode": "form_post" } TOKEN REQUEST https://appleid.apple.com/auth/token? { "grant_type": "authorization_code", "code": "c870aaec987a14.....dqakaGP4Yn1nH3dnPgww", "client_id": "com.hikesync.service", "client_secret": "eyJhbGciOiJFUzI....3izij6dojYfdV6JMdbQPx3sOA", "redirect_uri": "https://hikesync.com/auth/apple/callback", "code_verifier": "38hHUC....mYuE0zfYVNTycg" } RESPONSE { "access_token": "a2b70e12d38b446....4hA7-RLNj0ifU5Q", "token_type": "Bearer", "expires_in": 3600, "refresh_token": "rb4ed9be2b4024......w5RWjVFUQ", "id_token": "eyJraWQiOiJyQlJmV.......0Df0ihEJiA" } JWT { "iss": "https://appleid.apple.com", "aud": "SERVICE_ID", "exp": 1734606699, "iat": 1734520299, "sub": "000000.f7f7c0ac.....db9fad7e19.1111", "nonce": "NONCE", "at_hash": "NAfjmciTi2NtmPYIMAgjig", "email": "abc123@privaterelay.appleid.com", "email_verified": true, "is_private_email": true, "auth_time": 1734520297, "nonce_supported": true }
2
1
811
Dec ’24
[Questions regarding App Store Review Guidelines 4.8 Login Services]
The app comes with its own login/signup service and several other social login services. Even though our app has its own login/sign-up service, if we provide at least one social login service, should we provide Apple Login or another login service with a privacy policy as an equivalent option? Can you please answer whether I should include the sign in with apple service or the login service with privacy protection in my app?
0
0
557
Dec ’24
App Review - 4.8.0 Design: Login Services
Our e-learning app has been rejected in App Review regarding compliance with guideline 4.8.0: Login Services. The following were Apple Support's feedback: The app uses a third-party login service like Google or Facebook, but does not appear to offer an equivalent login option with Sign in with Apple. Next Steps: Revise the app to offer an equivalent login option that meets all of the above requirements. If the app already includes a login option that meets the above requirements, reply to App Review in App Store Connect, identify which login option meets the requirements, and explain why it meets the requirements. Additionally, it would be appropriate to update the screenshots in the app's metadata to accurately reflect the revised app once another login service has been implemented. Note that Sign in with Apple meets the requirements specified in guideline 4.8. Now, regarding their instructions, the following are our queries: Our mobile app for iOS already has SSO login options for Google and Facebook. Could you clarify what is meant by "an equivalent login option"? Are there any specific third-party login services other than "Sign in with Apple" that already comply with the requirements in Guideline 4.8? We are using “Manual sign up/sign in”, “Continue with Google” and “Continue with Facebook” to let users sign up and sign in to our platform. As per the parameters involved with the third-party login, will using sign in with Apple solve the problem related to Guideline 4.8? So is it mandatory under Apple’s Guidelines to include "Sign in with Apple" now, in addition to other SSO options? If it is mandatory, how is it that many iOS apps do not include the "Sign in with Apple" option? From a technical perspective, what options are available to satisfy Apple’s guidelines in this regard? Could manual sign-in/sign-out features of the app cause any conflicts with compliance in this area? Looking forward to anyone's kind response that can help us resolve this issue. Thanks!
2
2
1.5k
Dec ’24
Migrating SiwA users after app transfer
We recently transferred our app from one developer account to a new one, internally. We're trying to transfer our sign in with apple users, but have hit a snag on the first step. I'm following the instructions here to "Obtain the user access token": https://developer.apple.com/documentation/sign_in_with_apple/transferring_your_apps_and_users_to_another_team This is my request as created in postman: curl --location 'https://appleid.apple.com/auth/token/' --form 'grant_type="client_credentials"' --form 'scope="user.migration"' --form 'client_id="com.XXXXX"' --form 'client_secret="XXXXX"' No matter what I try, I always receive invalid_client. I've uploaded example JWTs in FB15648650.
1
0
571
Dec ’24
Sign in with Apple.
Hey, There are two apps, App A and App B. Both apps do not have Sign in with Apple configured currently, so there are no Sign in with Apple users to transfer. I want to configure this for both apps. App A is on developer team A. App B is on developer team B. They are not on the same developer accounts. It is my understanding that both accounts need to be on the same developer team/account to get the same unique identifiers (e.g. sub id and private relay email address) for privacy reasons. Desired Behavior: When a single user logs into either app A or app B with the newly exposed Sign in with Apple functionality, I need apple to return me the same unique identifiers (e.g. sub and email), so that I can uniquely identify the same user across app A and app B. How can I do this without ANY customer impact.
1
0
721
Dec ’24
Issues related to “Sign in with Apple” in App transfers
Our product uses the “Sign in with Apple” feature, and now we need to transfer it to Apple. After reading the documentation, I still have questions and would like to get answers. Q1:Transfer App: After the receiving team receives the App, is the unique identifier obtained by the client App program login the original one? Or is it newly generated? If it is newly generated, from what point in time will it be newly generated? Q2:Transfer App: Is there any validity period for the transfer identifier? About how long? What will happen after the transfer identifier is expired? Q3:When does the transfer identifier (transfer identifier) start to be generated, when the transfer request is initiated or when the transfer is completed, and when I get the transfer identifier, can I directly exchange it for the receiving team's unique identifier? Looking forward to a reply, thanks!
1
0
712
Dec ’24
Repeated "Invalid Client" Error with Sign In with Apple
Hi everyone, I'm having a recurring issue with the "Sign in with Apple" integration in my web app, and I’m hoping someone here can help or share insights. Here’s the situation: I implemented "Sign in with Apple" following the official documentation, and it worked perfectly at first. After about two weeks, I started getting the "invalid_client" error when redirecting to the authentication page. I reviewed everything and discovered I hadn’t set up the email configuration properly in the Apple Developer Console. Once I fixed that, it worked fine again. Now, the same error ("invalid_client") has returned, and I’ve triple-checked every part of my configuration: The service ID, redirect URIs, and domain settings match exactly. The client_secret is generated correctly with all required fields (iss, iat, exp, aud, and sub) and signed with ES256. My server time is synchronized. Nothing has changed in my code or configuration since it last worked. This seems to be an issue on Apple’s end because everything was functioning perfectly before, and I’ve already resolved this once by updating settings in the Developer Console. Has anyone else faced this issue? Is there something I might be missing, or could this be a problem with Apple’s service? Any advice or guidance would be greatly appreciated!
1
0
606
Dec ’24
sending to Private Relay Email using amazon ses not working
Hello Developers, I have ran into a problem while sending mail to apple private relay email. We have built a mobile application where user can sign up through apple and they can sign up using hide-my-email feature. Which provides private relay address for us. Now we want to communicate with them using private relay mail address. The technology we are using to send emails are amazon SES, have done SPF, DMIK, DMARC and added domains in apple identity services for mail communication, passed an SPF check as well. But still mail is not getting delivered what am i doing wrong or apple doesn't support third party apps for sending emails to private relay? Is there any other way to achieve this please let me know Using the same body as attached in image is working fine for rest emails.
1
0
1k
Dec ’24
revoke api is not working.
https://developer.apple.com/documentation/sign_in_with_apple/revoke_tokens/ As shown in the documentation, when I tested via curl, I received a response with status 200, but when I logged in to account.apple.com with the linked account, it shows that it is still connected. I would like to know if there is any additional way to verify that the revoke api is working properly.
1
0
838
Dec ’24
Invalid_request Error When Remapping User Identifiers After App Transfer
Hello, We recently transferred our iOS app from an individual developer account to a corporate account. By following this guide (link), we successfully obtained the transfer identifiers for all our current users and have stored the data fetched from Apple. Now that the transfer has been completed for about 10 hours, we're attempting to remap the old identifiers to the new ones using this guide (link). Unfortunately, all our requests are returning an 'invalid_request' error. I've noticed others have faced the same problem, but I haven't found a solution yet. Can anyone help me resolve this issue?
1
0
786
Dec ’24
How to get user's email? Login with apple id
Hi We use login using apple id feature in our website. However when it comes to apple id, it is possible for user to hide the original email and show a relay email. We have found that this relay email doesn't work Hence looking for a possible solution to acquire the real email from the user. Is there a possibility in doing that? any help would be greatly appreciated. Best Regards Hasintha
3
0
727
Dec ’24
Apple Login Not working.
I was referred to here, #102484182418 I'm trying to setup apple login on my community site but I'm having a hard time getting it to work. I keep getting "invalid_request​ Invalid client id or web redirect url." The last tech said she thanks its setup right but we could not get it to work. Here are my steps https://xenforo.com/docs/xf2/connected-account-apple/ I just someone to look at my Certificates, Identifiers & Profiles and make sure I have them setup right.
3
0
605
Dec ’24
Sign in with Apple: domains to whitelist
We are developing a captive portal for a community Wi-Fi service that will be deployed to thousands of locations around the world. The service is a paid service that sells Wi-Fi connectivity by data volume rather than time. We want to enable our customers to Sign in with Apple without giving them full internet access until they have made a purchase. This requires us to whitelist domains and URLs to make this work. Where can I find a complete list of domains that are required for Sign in with Apple to function correctly? It’s not possible for us to whitelist *.apple.com because that results in significant (free) background network traffic during the sign in process. So far we have whitelisted: account.apple.com appleid.apple.com appleid.apple-cdn.com idmsa.apple.com gsa.apple.com mzstatic.com Our customers are still having issues with Sign in with Apple while interacting with our captive portal in the iOS pseudo browser. How can we debug this because we cannot use the Safari developer tools with the pseudo browser. Are there any logs when doing this on a Mac that we can check in the Console? If we kick the user out to Safari then they are able to complete the Sign in with Apple process, but that is not the user experience we want.
1
0
1k
Dec ’24
Help with implementing "Sign in with Apple" in Safari Web Extension popup for MacOS
Hi everyone, I'm developing a minimal Safari web extension for macOS and trying to implement "Sign in with Apple" directly from the extension popup, as per Apple's guidelines it's prohibited to open a new tab/window: Guideline 4.0 - Design: The user is taken to a new Safari window or tab to sign in or register for an account, which provides a poor user experience. What I've Done So Far Created an App ID with "Sign in with Apple" enabled and configured. Created a Service ID with the "Sign in" feature enabled. Enabled "Sign in with Apple" for native targets in Xcode Added the following JavaScript code in my popup.html file to initialize the Apple JS API and handle authentication via a popup: <script type="text/javascript" src="https://appleid.cdn-apple.com/appleauth/static/jsapi/appleid/1/en_US/appleid.auth.js"></script> <script> // have tried many different configurations here - nothing works! AppleID.auth.init({ clientId: '<valid client ID>', redirectURI: '<valid URL>', usePopup: true, }); document.getElementById('sign-in-button-apple') .addEventListener('click', () => { AppleID.auth.signIn().then((response) => { console.log('Success', response) }).catch((error) => { console.error('Error', error) }); }); </script> I also added event listeners for AppleID events: document.addEventListener('AppleIDSignInOnSuccess', (event) => { console.log('Success', event); }); document.addEventListener('AppleIDSignInOnFailure', (event) => { console.log('Error', event); }); Issue When I click the "Sign in" button in the popup, a native macOS dialog appears for authorization. However, after confirming sign-in, the modal just closes and no response (success or error) is logged in the console. Expected behavior To receive a success message or an error in the console about the authorization process result. Questions Service ID Configuration: Since the popup's location URL is safari-web-extension://<random-url>, I can't add it to the supported redirect URLs in the Service ID settings. Is there a way to work around this? Safari Web Extension Setup: Are there specific configurations required in Xcode to enable "Sign in with Apple" within a Safari web extension? Sign-In Method: Am I correctly implementing the signIn method in the JavaScript code? Could there be any constraints or special considerations for running it within an extension popup? I would greatly appreciate any guidance, examples, or documentation that can help resolve this issue. Thank you in advance!
1
0
743
Dec ’24
Can't send email to Apple Private Relay
I am trying to send email from our internal server. We are using gmail as smtp client. Gmail is bound to a domain hosted on squarespace. I have all the required DNS records - DKIM, DMARC, SPF configured in squarespace. In the Apple Developer Portal, I have also added allowed domains and email addresses in the Sign In with Apple settings. SPF verification passed. The problem is that emails sent to @privaterelay.appleid.com are not reaching the final recipient. On our end, the emails are sent and there are no errors. In the email signature the DKIM domain and the domain in the From: address match completely. Domain on tools like mxtoolbox passes all checks. Also, there is no response from the gmail server that the email was not delivered. To all other emails the emails are being sent with no problems. Please help me figure this out, maybe I am missing something.
1
0
1k
Dec ’24
Sign in with Apple credential always revoked on iOS18/18.1 Simulator
Hi there - I maintain the react-native-apple-authentication module which allows react native developers to implement sign in with Apple When testing we noticed that code working perfectly in iOS17 Simulators now fails on iOS18/18.1 Simulators. Specifically, the credential status is always revoked when testing on an iOS18+ Simulator. The same code works perfectly on a real device running iOS18 or 18.1 so this appears to be a Simulator bug. This is problematic because App review is frequently performed on a Simulator, so there are false-negative test results for Sign In With Apple from reviewers when they use iOS18 emulators, resulting in App submission rejections. We're tracking this here, with some results posted and an example app in-repo that demonstrates the issue: https://github.com/invertase/react-native-apple-authentication/issues/356 It would be great to see the Simulator fixed so that it works correctly with Sign In With Apple again. Thanks
6
1
1.1k
Nov ’24
Transferring multiple apps that use Sign in with Apple
Hello, These questions are in regard to transferring Sign in With Apple users as part of an app transfer to another developer team. We’ve already read and absorbed the following documents from Apple, but we still have questions that aren’t covered in these documents, due to the unique nature of our use case. Transferring Your Apps and Users to Another Team Bringing New Apps and Users Into Your Team Resolving Sign in with Apple Response Errors Background: We have a suite of three apps that we are tranferring to another developer team. Each app supports Sign In With Apple. Our accounts/users are shared among all three apps. We have all three apps currently grouped together for SIWA. We’re aware that we will need to un-group them before doing the SIWA user transfer. Questions: The API for generating and exchanging transferIDs for users (endpoint /auth/usermigrationinfo) requires a parameter client_id which is described in the docs as "The identifier (App ID or Services ID) for the transferring app." Since we are transferring a set of three apps which share users, we aren’t sure which AppID to use, or whether it matters? We’re assuming we only need to transfer the users once in total (not once-per-app), is this correct? Does it matter which of the three apps’ AppID we use for this? To give more specific context to this question, here’s a more detailed example: For simplicity’s sake, let’s say we have 10 user accounts total, and any of them could sign into any of our three apps. Users 1-7 have signed into all three apps previously User8 has only signed into AppA User9 has only signed into AppB User10 has only signed into AppC Ideally we want to transfer all 10 users all at once. Does it matter which AppID we use for client_id? For example, if we use AppA as the client_id, will we still be able to transfer all 10 users (including User9 and User10)? We’ve tested this on the sender team side, and we’re able to successfully create transferIDs for all 10 users using AppA as client_id. But we’re not sure if this will still work on the recipient side, that we’ll be able to exchange the transferID for all 10 users. . To add another wrinkle, there is a possibility that we won’t be able to transfer one of our three apps (due to one of Apple’s limitations for app transfer). In that case we’ll have to create a new app on the recipient team and shut down the old one on the sender team. But the other two apps in the suite would still be transferred normally. We’d still want all 10 users to be transferred, as the intention is still that all our users can sign into any of their existing accounts in any of the three apps. Would this scenario change the answer to question 1? For example, say we aren’t able to transfer AppC over to the new development team, but instead had to create a new app, AppCNew on the new development team. But we still are able to transfer AppA and AppB. Would we still be able to transfer all 10 users using AppA as the client_id? Including User10 who only ever signed in to AppC (which isn’t being transferred)? We'd really appreciate any answers or guidance that anyone can provide. Thank you, Adam
Replies
4
Boosts
6
Views
810
Activity
Dec ’24
`user` not returned from Sign in with Apple REST API
I have tried everything to get the user field returned with Sign in flow and it never does, not for new users, not even if i create a new app! Working with Apple is so frustrating and you have to pay for it!! Referencing this page, I am using scope=name email. I have tried using + and %20 as the spacer and neither makes a difference. I have also tried setting response_type = code and code id_token (again with + and %20 as the spacer) which also doesn't make a difference. Always the id_token is returned and always the email, but never the user. https://developer.apple.com/documentation/sign_in_with_apple/sign_in_with_apple_js/incorporating_sign_in_with_apple_into_other_platforms#3332115 AUTHORIZE REQUEST https://appleid.apple.com/auth/authorize? { "response_type": "code", "client_id": "com.example.service", "scope": "name email", "state": "77264297-813c-4738-83ef-f1b77daea04c", "redirect_uri": "https://example.com/auth/apple/callback", "code_challenge_method": "S256", "code_challenge": "2SJCneEpjKcN.....xIIHnpqcvjK_Y0s", "access_type": "offline", "nonce": "1734523662", "response_mode": "form_post" } TOKEN REQUEST https://appleid.apple.com/auth/token? { "grant_type": "authorization_code", "code": "c870aaec987a14.....dqakaGP4Yn1nH3dnPgww", "client_id": "com.hikesync.service", "client_secret": "eyJhbGciOiJFUzI....3izij6dojYfdV6JMdbQPx3sOA", "redirect_uri": "https://hikesync.com/auth/apple/callback", "code_verifier": "38hHUC....mYuE0zfYVNTycg" } RESPONSE { "access_token": "a2b70e12d38b446....4hA7-RLNj0ifU5Q", "token_type": "Bearer", "expires_in": 3600, "refresh_token": "rb4ed9be2b4024......w5RWjVFUQ", "id_token": "eyJraWQiOiJyQlJmV.......0Df0ihEJiA" } JWT { "iss": "https://appleid.apple.com", "aud": "SERVICE_ID", "exp": 1734606699, "iat": 1734520299, "sub": "000000.f7f7c0ac.....db9fad7e19.1111", "nonce": "NONCE", "at_hash": "NAfjmciTi2NtmPYIMAgjig", "email": "abc123@privaterelay.appleid.com", "email_verified": true, "is_private_email": true, "auth_time": 1734520297, "nonce_supported": true }
Replies
2
Boosts
1
Views
811
Activity
Dec ’24
Unable to add Capability in Vision OS
I am trying add Sign in with Apple but when I attempt to capability in my app nothing happens in the list does apple not able to provide this feature yet in Vision OS or is there any bug or may be ami missing something which does not seems?
Replies
2
Boosts
0
Views
819
Activity
Dec ’24
[Questions regarding App Store Review Guidelines 4.8 Login Services]
The app comes with its own login/signup service and several other social login services. Even though our app has its own login/sign-up service, if we provide at least one social login service, should we provide Apple Login or another login service with a privacy policy as an equivalent option? Can you please answer whether I should include the sign in with apple service or the login service with privacy protection in my app?
Replies
0
Boosts
0
Views
557
Activity
Dec ’24
App Review - 4.8.0 Design: Login Services
Our e-learning app has been rejected in App Review regarding compliance with guideline 4.8.0: Login Services. The following were Apple Support's feedback: The app uses a third-party login service like Google or Facebook, but does not appear to offer an equivalent login option with Sign in with Apple. Next Steps: Revise the app to offer an equivalent login option that meets all of the above requirements. If the app already includes a login option that meets the above requirements, reply to App Review in App Store Connect, identify which login option meets the requirements, and explain why it meets the requirements. Additionally, it would be appropriate to update the screenshots in the app's metadata to accurately reflect the revised app once another login service has been implemented. Note that Sign in with Apple meets the requirements specified in guideline 4.8. Now, regarding their instructions, the following are our queries: Our mobile app for iOS already has SSO login options for Google and Facebook. Could you clarify what is meant by "an equivalent login option"? Are there any specific third-party login services other than "Sign in with Apple" that already comply with the requirements in Guideline 4.8? We are using “Manual sign up/sign in”, “Continue with Google” and “Continue with Facebook” to let users sign up and sign in to our platform. As per the parameters involved with the third-party login, will using sign in with Apple solve the problem related to Guideline 4.8? So is it mandatory under Apple’s Guidelines to include "Sign in with Apple" now, in addition to other SSO options? If it is mandatory, how is it that many iOS apps do not include the "Sign in with Apple" option? From a technical perspective, what options are available to satisfy Apple’s guidelines in this regard? Could manual sign-in/sign-out features of the app cause any conflicts with compliance in this area? Looking forward to anyone's kind response that can help us resolve this issue. Thanks!
Replies
2
Boosts
2
Views
1.5k
Activity
Dec ’24
Migrating SiwA users after app transfer
We recently transferred our app from one developer account to a new one, internally. We're trying to transfer our sign in with apple users, but have hit a snag on the first step. I'm following the instructions here to "Obtain the user access token": https://developer.apple.com/documentation/sign_in_with_apple/transferring_your_apps_and_users_to_another_team This is my request as created in postman: curl --location 'https://appleid.apple.com/auth/token/' --form 'grant_type="client_credentials"' --form 'scope="user.migration"' --form 'client_id="com.XXXXX"' --form 'client_secret="XXXXX"' No matter what I try, I always receive invalid_client. I've uploaded example JWTs in FB15648650.
Replies
1
Boosts
0
Views
571
Activity
Dec ’24
Sign in with Apple.
Hey, There are two apps, App A and App B. Both apps do not have Sign in with Apple configured currently, so there are no Sign in with Apple users to transfer. I want to configure this for both apps. App A is on developer team A. App B is on developer team B. They are not on the same developer accounts. It is my understanding that both accounts need to be on the same developer team/account to get the same unique identifiers (e.g. sub id and private relay email address) for privacy reasons. Desired Behavior: When a single user logs into either app A or app B with the newly exposed Sign in with Apple functionality, I need apple to return me the same unique identifiers (e.g. sub and email), so that I can uniquely identify the same user across app A and app B. How can I do this without ANY customer impact.
Replies
1
Boosts
0
Views
721
Activity
Dec ’24
Issues related to “Sign in with Apple” in App transfers
Our product uses the “Sign in with Apple” feature, and now we need to transfer it to Apple. After reading the documentation, I still have questions and would like to get answers. Q1:Transfer App: After the receiving team receives the App, is the unique identifier obtained by the client App program login the original one? Or is it newly generated? If it is newly generated, from what point in time will it be newly generated? Q2:Transfer App: Is there any validity period for the transfer identifier? About how long? What will happen after the transfer identifier is expired? Q3:When does the transfer identifier (transfer identifier) start to be generated, when the transfer request is initiated or when the transfer is completed, and when I get the transfer identifier, can I directly exchange it for the receiving team's unique identifier? Looking forward to a reply, thanks!
Replies
1
Boosts
0
Views
712
Activity
Dec ’24
Apple Private Relay Emails Sent to Junk or Spam Folder
Private relay emails are ending up in the spam folder, even though SPF and DKIM are set up correctly.
Replies
1
Boosts
1
Views
661
Activity
Dec ’24
Repeated "Invalid Client" Error with Sign In with Apple
Hi everyone, I'm having a recurring issue with the "Sign in with Apple" integration in my web app, and I’m hoping someone here can help or share insights. Here’s the situation: I implemented "Sign in with Apple" following the official documentation, and it worked perfectly at first. After about two weeks, I started getting the "invalid_client" error when redirecting to the authentication page. I reviewed everything and discovered I hadn’t set up the email configuration properly in the Apple Developer Console. Once I fixed that, it worked fine again. Now, the same error ("invalid_client") has returned, and I’ve triple-checked every part of my configuration: The service ID, redirect URIs, and domain settings match exactly. The client_secret is generated correctly with all required fields (iss, iat, exp, aud, and sub) and signed with ES256. My server time is synchronized. Nothing has changed in my code or configuration since it last worked. This seems to be an issue on Apple’s end because everything was functioning perfectly before, and I’ve already resolved this once by updating settings in the Developer Console. Has anyone else faced this issue? Is there something I might be missing, or could this be a problem with Apple’s service? Any advice or guidance would be greatly appreciated!
Replies
1
Boosts
0
Views
606
Activity
Dec ’24
sending to Private Relay Email using amazon ses not working
Hello Developers, I have ran into a problem while sending mail to apple private relay email. We have built a mobile application where user can sign up through apple and they can sign up using hide-my-email feature. Which provides private relay address for us. Now we want to communicate with them using private relay mail address. The technology we are using to send emails are amazon SES, have done SPF, DMIK, DMARC and added domains in apple identity services for mail communication, passed an SPF check as well. But still mail is not getting delivered what am i doing wrong or apple doesn't support third party apps for sending emails to private relay? Is there any other way to achieve this please let me know Using the same body as attached in image is working fine for rest emails.
Replies
1
Boosts
0
Views
1k
Activity
Dec ’24
revoke api is not working.
https://developer.apple.com/documentation/sign_in_with_apple/revoke_tokens/ As shown in the documentation, when I tested via curl, I received a response with status 200, but when I logged in to account.apple.com with the linked account, it shows that it is still connected. I would like to know if there is any additional way to verify that the revoke api is working properly.
Replies
1
Boosts
0
Views
838
Activity
Dec ’24
Invalid_request Error When Remapping User Identifiers After App Transfer
Hello, We recently transferred our iOS app from an individual developer account to a corporate account. By following this guide (link), we successfully obtained the transfer identifiers for all our current users and have stored the data fetched from Apple. Now that the transfer has been completed for about 10 hours, we're attempting to remap the old identifiers to the new ones using this guide (link). Unfortunately, all our requests are returning an 'invalid_request' error. I've noticed others have faced the same problem, but I haven't found a solution yet. Can anyone help me resolve this issue?
Replies
1
Boosts
0
Views
786
Activity
Dec ’24
How to get user's email? Login with apple id
Hi We use login using apple id feature in our website. However when it comes to apple id, it is possible for user to hide the original email and show a relay email. We have found that this relay email doesn't work Hence looking for a possible solution to acquire the real email from the user. Is there a possibility in doing that? any help would be greatly appreciated. Best Regards Hasintha
Replies
3
Boosts
0
Views
727
Activity
Dec ’24
Apple Login Not working.
I was referred to here, #102484182418 I'm trying to setup apple login on my community site but I'm having a hard time getting it to work. I keep getting "invalid_request​ Invalid client id or web redirect url." The last tech said she thanks its setup right but we could not get it to work. Here are my steps https://xenforo.com/docs/xf2/connected-account-apple/ I just someone to look at my Certificates, Identifiers & Profiles and make sure I have them setup right.
Replies
3
Boosts
0
Views
605
Activity
Dec ’24
You can only transfer apps that are not using Sign in with Apple
We have confirmed that our app is not grouped for SIWA. And all other transfer criteria are met. Why do we still get this error? I did not see anything about you cannot transfer an app with SIWA enabled in the doc.
Replies
1
Boosts
0
Views
371
Activity
Dec ’24
Sign in with Apple: domains to whitelist
We are developing a captive portal for a community Wi-Fi service that will be deployed to thousands of locations around the world. The service is a paid service that sells Wi-Fi connectivity by data volume rather than time. We want to enable our customers to Sign in with Apple without giving them full internet access until they have made a purchase. This requires us to whitelist domains and URLs to make this work. Where can I find a complete list of domains that are required for Sign in with Apple to function correctly? It’s not possible for us to whitelist *.apple.com because that results in significant (free) background network traffic during the sign in process. So far we have whitelisted: account.apple.com appleid.apple.com appleid.apple-cdn.com idmsa.apple.com gsa.apple.com mzstatic.com Our customers are still having issues with Sign in with Apple while interacting with our captive portal in the iOS pseudo browser. How can we debug this because we cannot use the Safari developer tools with the pseudo browser. Are there any logs when doing this on a Mac that we can check in the Console? If we kick the user out to Safari then they are able to complete the Sign in with Apple process, but that is not the user experience we want.
Replies
1
Boosts
0
Views
1k
Activity
Dec ’24
Help with implementing "Sign in with Apple" in Safari Web Extension popup for MacOS
Hi everyone, I'm developing a minimal Safari web extension for macOS and trying to implement "Sign in with Apple" directly from the extension popup, as per Apple's guidelines it's prohibited to open a new tab/window: Guideline 4.0 - Design: The user is taken to a new Safari window or tab to sign in or register for an account, which provides a poor user experience. What I've Done So Far Created an App ID with "Sign in with Apple" enabled and configured. Created a Service ID with the "Sign in" feature enabled. Enabled "Sign in with Apple" for native targets in Xcode Added the following JavaScript code in my popup.html file to initialize the Apple JS API and handle authentication via a popup: <script type="text/javascript" src="https://appleid.cdn-apple.com/appleauth/static/jsapi/appleid/1/en_US/appleid.auth.js"></script> <script> // have tried many different configurations here - nothing works! AppleID.auth.init({ clientId: '<valid client ID>', redirectURI: '<valid URL>', usePopup: true, }); document.getElementById('sign-in-button-apple') .addEventListener('click', () => { AppleID.auth.signIn().then((response) => { console.log('Success', response) }).catch((error) => { console.error('Error', error) }); }); </script> I also added event listeners for AppleID events: document.addEventListener('AppleIDSignInOnSuccess', (event) => { console.log('Success', event); }); document.addEventListener('AppleIDSignInOnFailure', (event) => { console.log('Error', event); }); Issue When I click the "Sign in" button in the popup, a native macOS dialog appears for authorization. However, after confirming sign-in, the modal just closes and no response (success or error) is logged in the console. Expected behavior To receive a success message or an error in the console about the authorization process result. Questions Service ID Configuration: Since the popup's location URL is safari-web-extension://<random-url>, I can't add it to the supported redirect URLs in the Service ID settings. Is there a way to work around this? Safari Web Extension Setup: Are there specific configurations required in Xcode to enable "Sign in with Apple" within a Safari web extension? Sign-In Method: Am I correctly implementing the signIn method in the JavaScript code? Could there be any constraints or special considerations for running it within an extension popup? I would greatly appreciate any guidance, examples, or documentation that can help resolve this issue. Thank you in advance!
Replies
1
Boosts
0
Views
743
Activity
Dec ’24
Can't send email to Apple Private Relay
I am trying to send email from our internal server. We are using gmail as smtp client. Gmail is bound to a domain hosted on squarespace. I have all the required DNS records - DKIM, DMARC, SPF configured in squarespace. In the Apple Developer Portal, I have also added allowed domains and email addresses in the Sign In with Apple settings. SPF verification passed. The problem is that emails sent to @privaterelay.appleid.com are not reaching the final recipient. On our end, the emails are sent and there are no errors. In the email signature the DKIM domain and the domain in the From: address match completely. Domain on tools like mxtoolbox passes all checks. Also, there is no response from the gmail server that the email was not delivered. To all other emails the emails are being sent with no problems. Please help me figure this out, maybe I am missing something.
Replies
1
Boosts
0
Views
1k
Activity
Dec ’24
Sign in with Apple credential always revoked on iOS18/18.1 Simulator
Hi there - I maintain the react-native-apple-authentication module which allows react native developers to implement sign in with Apple When testing we noticed that code working perfectly in iOS17 Simulators now fails on iOS18/18.1 Simulators. Specifically, the credential status is always revoked when testing on an iOS18+ Simulator. The same code works perfectly on a real device running iOS18 or 18.1 so this appears to be a Simulator bug. This is problematic because App review is frequently performed on a Simulator, so there are false-negative test results for Sign In With Apple from reviewers when they use iOS18 emulators, resulting in App submission rejections. We're tracking this here, with some results posted and an example app in-repo that demonstrates the issue: https://github.com/invertase/react-native-apple-authentication/issues/356 It would be great to see the Simulator fixed so that it works correctly with Sign In With Apple again. Thanks
Replies
6
Boosts
1
Views
1.1k
Activity
Nov ’24