Error: Invalid_Client - What?

Hi Apple Developers,


I'm facing a very bad issue because I read so many guides and tutorials and nothing works.

The result is always the same: {"error":"invalid_client"}


I get the code, identityToken and everything I need - except the call to https://appleid.apple.com/auth/token - because of invalid_client.


Here is my url for getting the code.

https://appleid.apple.com/auth/authorize?response_type=code&client_id=org.example.service&redirect_uri=https%3A%2F%2Fexample.org


So then I have the default workflow.

And after accepting / loggin in I will be redirected to my page.

https://example.org/?code=a277243e2ec324fb09ba1c3333a8e6576.0.abcde.u4xiTDP2qHXoNEaxrcrIGx


(When I'm using the JavaScript API I'll get other informations like state, code and id_token. I already tried it with the "code" there, too.)


Back to the main function.


This is my request for Apple.

  'client_id' => 'org.example.service',
  'client_secret' => JWT-Data encoded (OPENSSL_ALGO_SHA256) see below  'grant_type' => 'authorization_code',
  'code' => 'a277243e2ec324fb09ba1c3333a8e6576.0.abcde.u4xiTDP2qHXoNEaxrcrIGx'


JWT Header:

{
  "alg": "ES256",
  "kid": "1ABC2345DE"
}


JWT Payload:

{
  "iss": "1A234BCD56",
  "iat": 1571269964,
  "exp": 1571273564,
  "aud": "https://appleid.apple.com",
  "sub": "org.example.service"
}


Response:

{
  "error": "invalid_client"
}


The useless error message of the world.

I dont know why the client should be invalid.


I have a key in https://developer.apple.com/account/resources/authkeys/list with downloaded file name AuthKey_1ABC2345DE.p8. (means 1ABC2345DE is my key id)

Then I have a native iOS app with identifier "org.example" and a service with identifier "org.example.service".


Its not working with both ids and mixed different things.

Nothing. invalid_client.



Can anyone help me please? I'm sitting here for hours and getting only invalid_client 😭

Post not yet marked as solved Up vote post of Paedy Down vote post of Paedy
42k views

Replies

An incorrect Issuer in the payload of the client_secret can cause an "invalid_client" response. So check your Issuer value, as well. It should be the 10-character Team ID associated with your developer account.