Sign in with Apple for the web returns invalid_client at the authorization request for every Services ID in our team. The failure occurs before any token exchange, so no client secret is involved.
Team ID: UGZTH42J5G
Primary App ID: UGZTH42J5G.com.nearbuddy.mobile (Sign in with Apple enabled; "Enable as a primary App ID" selected)
Services IDs: com.nearbuddy.mobile.signin com.nearbuddy.mobile.signin2 (created solely as a control)
Both Services IDs are configured with:
Sign in with Apple: enabled Primary App ID: UGZTH42J5G.com.nearbuddy.mobile Domain: dkhtjkcygbpomaummdih.supabase.co
Return URLs: https://dkhtjkcygbpomaummdih.supabase.co/functions/v1/auth-apple-web/callback https://dkhtjkcygbpomaummdih.supabase.co/auth/v1/callback
Failing authorization request:
GET https://appleid.apple.com/auth/authorize client_id=com.nearbuddy.mobile.signin redirect_uri=https://dkhtjkcygbpomaummdih.supabase.co/functions/v1/auth-apple-web/callback response_type=code id_token response_mode=form_post scope=name email state=<opaque> nonce=<opaque>
Apple responds with:
invalid_client Invalid client.
The same failure is reproduced:
- with both Services IDs;
- in Safari;
- in Chrome on Android;
- via curl;
- and using the authorization URL generated by Supabase GoTrue.
The failure occurs before authentication/consent and before any authorization code or ID token is issued.
Membership is active until March 18, 2027. The Account Holder is active and there are no pending membership or agreement banners.
A fresh control Services ID reproduces exactly the same failure.
Feedback Assistant report: FB24549460
Please inspect the Sign in with Apple provisioning/configuration state for Team UGZTH42J5G and determine why the registered Services IDs are not being recognized at the authorization endpoint.