Hello,
We’ve resumed the migration process after a break. Since my colleague is no longer with us, I had to go through the steps again myself.
As before, we’re trying to migrate "Sign In with Apple" users from tenant TENANT_A with client_id=CLIENT_ID_A to tenant TENANT_B with client_id=CLIENT_ID_B
I followed the procedure described here: [Apple Developer Documentation](https://developer.apple.com/documentation/technotes/tn3159-migrating-sign-in-with-apple-users-for-an-app-transfer – Migrating Sign In with Apple Users, essentially repeating what my coworker previously attempted in coordination with your employee Stephanie.
Here’s a summary of the steps and the issue we’re facing:
STEP 1 - get authcode for TEAM A
curl --location 'https://appleid.apple.com/auth/token'
--header 'Content-Type: application/x-www-form-urlencoded'
--data-urlencode 'grant_type=client_credentials'
--data-urlencode 'scope=user.migration'
--data-urlencode 'client_id=pl.CLIEND_ID_A'
--data-urlencode 'client_secret=<TEAM_A_SECRET>'
I receive response:
{ "access_token": "<ACCESS_TOKEN_TEAM_A>", "token_type": "Bearer", "expires_in": 3600 }
STEP 2 - get authcode for TEAB B
curl --location 'https://appleid.apple.com/auth/token'
--header 'Content-Type: application/x-www-form-urlencoded'
--data-urlencode 'grant_type=client_credentials'
--data-urlencode 'scope=user.migration'
--data-urlencode 'client_id=CLIENT_ID_B'
--data-urlencode 'client_secret=<TEAB_B_SECRET>'
I receive response:
{ "access_token":"<ACCESS_TOKEN_TEAB_B>", "token_type": "Bearer", "expires_in": 3600 }
STEP 3 - get transfer_sub from TEAM A
curl --location 'https://appleid.apple.com/auth/usermigrationinfo'
--header 'Authorization: Bearer <ACCESS_TOKEN_TEAM_A>'
--header 'Content-Type: application/x-www-form-urlencoded'
--data-urlencode 'client_id=CLIENT_ID_A'
--data-urlencode 'client_secret=<TEAM_A_SECRET>'
--data-urlencode 'sub=USER_SUB_FROM_TEAM_A'
--data-urlencode 'target=TENANT_B'
I receive response:
{ "transfer_sub": "USER_SUB_FROM_TEAM_B" }
STEP 4 - Team B exchanges transfer identifers
curl --location 'https://appleid.apple.com/auth/usermigrationinfo'
--header 'Authorization: Bearer <ACCESS_TOKEN_TEAM_B'
--header 'Content-Type: application/x-www-form-urlencoded'
--data-urlencode 'client_id=CLIENT_ID_B'
--data-urlencode 'client_secret=<TEAM_B_SECRET>'
I receive response:
{ "error": "invalid_request" }
We’ve created a new client_id under tenant B and want to migrate users there. However, we skipped the step described in Step 3 of the documentation(https://developer.apple.com/documentation/technotes/tn3159-migrating-sign-in-with-apple-users-for-an-app-transfer#3-Team-A-initiates-app-transfer-to-Team-B), which involves initiating an app transfer. The reason is that this client_id is used solely for web authentication, not for a mobile app, so we don’t have an app to transfer.
Based on our analysis and your documentation, it seems this flow only works if the client_id matches across both tenants, which can only be achieved through an app transfer, something we cannot proceed with.
Apple previously insisted that we migrate these users, but as shown above, we’re stuck. Is there any alternative flow available, or can you assist us in completing this migration?