I’m trying to update the Domains and Redirects section for my Services ID configuration in Apple Developer (for Sign in with Apple).
When I add new domains and click Save, nothing happens. In the browser console, I see a network request that fails with:
PATCH not supported
What I’ve tried so far:
Logging out/in and refreshing the page
Clearing browser cache and cookies
Trying in Safari, Chrome, and incognito mode
Verifying domain formatting (HTTPS, no trailing slash, domain is live)
The issue persists in all browsers I’ve tested.
Request:
Is this a known issue with the Developer portal, or is there an alternative method to update my Services ID domains? Any guidance would be appreciated.
Thanks,
Sign in with Apple
RSS for tagDiscuss how to provide users the ability to sign in to your apps and websites using their Apple ID.
Selecting any option will automatically load the page
Post
Replies
Boosts
Views
Activity
We have been sending emails through Sparkpost via Braze inc. to the Apple Private Relay users with "@privaterelay.appleid.com" starting from around June 20th or so.
Upon August 9th 06:00 UTC, we have noticed a sudden increase of "Hard Bounce" for nearly 20,000 users using the Apple's private relay email address, rendering the email sending useless for these customers.
We have been constantly been able to send them emails, including just before this timeframe (e.g. August 9th 03:00 UTC), so it was a very sudden purge of the user data that has been done without our consent.
From a business perspective, this hurts a lot for the un-sendable users since we have no way of contacting them if not for the private address.
We are desperate to know what has happened for these customers that has been "hard bounced". We are suspecting that it should be tied to the private email and the users primary email (or user data's) tie in the Apple server being gone, but not sure enough since there is no such documentation nor any way to acknowledge what has happened anywhere.
We will provide any information possible for resolving.
Thank you.
Migrating APP and users, obtaining the user's transfer_sub, an exception occurred: {"error":"invalid_request"}
`POST /auth/usermigrationinfo HTTP/1.1
Host: appleid.apple.com
Content-Type: application/x-www-form-urlencoded
Authorization: Bearer {access_token}
sub={sub}&target={recipient_team_id}&client_id={client_id}&client_secret={client_secret}
The specific request is as follows:
15:56:20.858 AppleService - --> POST https://appleid.apple.com/auth/usermigrationinfo
15:56:20.858 AppleService - Content-Type: application/x-www-form-urlencoded
15:56:20.858 AppleService - Content-Length: 395
15:56:20.858 AppleService - Authorization: Bearer a56a8828048af48c0871e73b55d8910aa.0.rzvs.96uUcy1KBqo34Kj8qrPb4w
15:56:20.858 AppleService -
15:56:20.858 AppleService - sub=001315.1535dbadc15b472987acdf634719a06a.0600&target=WLN67KBBV8&client_id=com.hawatalk.live&client_secret=eyJraWQiOiIzODg5U1ZXNDM5IiwiYWxnIjoiRVMyNTYifQ.eyJpc3MiOiJRMzlUU1BHMjk3IiwiaWF0IjoxNzU1MDcxNzc5LCJleHAiOjE3NTUwNzUzNzksImF1ZCI6Imh0dHBzOi8vYXBwbGVpZC5hcHBsZS5jb20iLCJzdWIiOiJjb20uaGF3YXRhbGsubGl2ZSJ9.8i9RYIcepuIiEqOMu1OOAlmmjnB84AJueel21gNapiNa9pr3498Zkj8J5MUIzvvnvsvUJkKQjp_VvnsG_IIrTA
15:56:20.859 AppleService - --> END POST (395-byte body)
15:56:21.675 AppleService - <-- 400 Bad Request https://appleid.apple.com/auth/usermigrationinfo(816ms)
15:56:21.675 AppleService - Server: Apple
15:56:21.675 AppleService - Date: Wed, 13 Aug 2025 07:56:22 GMT
15:56:21.675 AppleService - Content-Type: application/json;charset=UTF-8
15:56:21.675 AppleService - Content-Length: 27
15:56:21.675 AppleService - Connection: keep-alive
15:56:21.675 AppleService - Pragma: no-cache
15:56:21.675 AppleService - Cache-Control: no-store
15:56:21.676 AppleService -
15:56:21.676 AppleService - {"error":"invalid_request"}
15:56:21.676 AppleService - <-- END HTTP (27-byte body)
`
Current Team ID: Q39TSPG297
Recipient Team ID: WLN67KBBV8
CLIENT_ID: com.hawatalk.live
Hello,
I’m trying to set up Sign In with Apple for my Firebase Authentication integration.
Steps I followed:
Created a Service ID in Apple Developer, e.g. com.example.myapp.signin.
Tried to enable Sign In with Apple and configure the Web Authentication Configuration.
Web Domain: myapp.firebaseapp.com
Return URL: https://myapp.firebaseapp.com/__/auth/handler
When I click Save, I get the following error in the browser console and a blank response page:
Unsupported Request
PATCH to http://developer.apple.com/services-account/v1/bundleIds/XXXXXXXX not supported.
Reference #...
What I have verified so far:
My Apple Developer Program membership is active (paid).
My App ID (e.g. com.example.myapp) exists in Identifiers.
The App ID has Sign In with Apple capability checked.
I need to link the Service ID with this App ID for Firebase web-based auth.
Goal:
Complete setup of Apple as a sign-in provider in Firebase Authentication. To do this, Apple requires me to add the Firebase return URL above, but the Developer Portal prevents saving with the 501 error.
Has anyone else run into this, and is there a workaround (e.g. enabling via Xcode, App Store Connect, or other methods)? Is this a known bug with the Apple Developer Portal?
Here is the screenshot of the error:
And Response part:
Thanks in advance!
We are implementing authentication login in our iOS mobile application, and during the sign-in/sign-out process, a native system popup appears with the following message:
"This allows the app and website to share information about you."
This popup interrupts the user experience, and we are concerned it may cause confusion for end users and negatively impact the adoption of our login flow.
We would like clarification on the following points:
What triggers this popup during the authentication process?
Are there any recommended configurations or approaches to suppress or avoid this dialog?
If the popup cannot be avoided, what best practices are suggested to ensure a clear and seamless user experience?
Our objective is to provide a smooth, user-friendly authentication flow without unexpected system interruptions.
Topic:
Privacy & Security
SubTopic:
Sign in with Apple
Confirmation on "Sign in with Apple JS" Web Implementation Compatibility
Hello Developers
We are trying to implement "Sign in with Apple JS" on our e-commerce website, which is built on a SaaS platform called Ticimax in Turkey.
Our platform provider (Ticimax) claims that a web-based implementation of "Sign in with Apple" is not currently possible. They state this is due to "Apple's browser security policies" that prevent consistent and secure support across all major browsers, particularly Safari with its privacy features.
Could you please confirm if there are any fundamental security policies or technical restrictions imposed by Apple that would prevent a standard, secure implementation of "Sign in with Apple JS" on a typical e-commerce website?
We know many global websites use this feature successfully. We need to know if our provider's claim has a technical basis from Apple's perspective, or if this is a standard implementation challenge that developers are expected to handle (e.g., using pop-ups instead of redirects to comply with ITP).
Any official clarification or documentation you can provide on this matter would be greatly appreciated.
Thank you.
Topic:
Privacy & Security
SubTopic:
Sign in with Apple
Tags:
Sign in with Apple
Sign in with Apple JS
I set up "Sign in with Apple" via REST API according to the documentation.
I can log in on my website and everything looks fine for the user.
But I receive an email, that my "Sign in with Apple" account has been rejected by my own website. It states, I will have to re-submit my name and email address the next time I log in to this website.
I don't see any error messages, no log entries, no HTTP errors anywhere.
I also can't find anything in the docs, the emails seem to not be mentioned there, searching for anything with "rejected" in the forum did not yield any helpful result, because they are always about App entries being rejected etc.
Did someone experience something similar yet? What's the reason, I'm getting these emails? I get them every time I go through the "Sign in with Apple" flow on my website again.
Topic:
Privacy & Security
SubTopic:
Sign in with Apple
Tags:
Sign in with Apple REST API
Sign in with Apple
Hey folks,
I'm seeing an issue where my iOS app is getting an "unknown" error when US users try to sign in with Apple.
It works fine for users in other countries like the UK, Singapore, and Taiwan.
Could it be related to my developer account not being based in the US? Or have I missed something in my settings?
Thanks in advance!
Topic:
Privacy & Security
SubTopic:
Sign in with Apple
Hello,
I am unable to configure Sign in with Apple on my developer account.
Whenever I try to:
Enable/disable the Sign in with Apple capability in my App ID, or
Configure a Service ID for web authentication,
the portal does not save my changes.
In the browser developer console, I consistently see this error:
Request URL: https://developer.apple.com/services-account/v1/bundleIds/XXXXXXXX
Request Method: PATCH
Status Code: 501 Not Implemented
This happens across all browsers (Safari, Chrome, Incognito) and even after clearing cache. It affects my entire account, not just one App ID.
I have already tried:
Creating a new Service ID → still fails.
Creating a new App ID → still fails.
Re-enabling the capability → save does not work.
Different browsers and devices → same result.
Has anyone else experienced this issue, and is there a known fix?
Or is this something that Apple Developer Support needs to resolve at the account level?
Private relay emails are not being delivered, even though we've followed the guidance here,
https://developer.apple.com/help/account/capabilities/configure-private-email-relay-service/
iCloud, gmail etc. get delivered fine but as soon as its a private relay email address they get bounced as unauthorized sender.
We've tried a couple of domains but here I'll document test.x.domain.com
We have registered domains (test.x.domain.com), also the sender communication emails just to be safe (noreply at test.x.domain.com).
Passed SPF Authentication, DKIM Authentication.
ESP account shows as all green checks in mailgun.
Is there any way to track down what the actual rejection reason is?
{
"@timestamp": "2025-08-20T14:30:59.801Z",
"account": {
"id": "6425b45fb2fd1e28f4e0110a"
},
"delivery-status": {
"attempt-no": 1,
"bounce-type": "soft",
"certificate-verified": true,
"code": 550,
"enhanced-code": "5.1.1",
"first-delivery-attempt-seconds": 0.014,
"message": "5.1.1 <bounce+b53c9e.27949-6qj4xaisn4k=privaterelay.appleid.com@test.x.domain.com>: unauthorized sender",
"mx-host": "smtp3.privaterelay.appleid.com",
"session-seconds": 1.7229999999999999,
"tls": true
},
"domain": {
"name": "test.x.domain.com"
},
"envelope": {
"sender": "noreply@test.x.domain.com",
"sending-ip": "111.22.101.215",
"targets": "6qj4xaisn4k@privaterelay.appleid.com",
"transport": "smtp"
},
"event": "failed",
"flags": {
"is-authenticated": true,
"is-delayed-bounce": false,
"is-routed": false,
"is-system-test": false,
"is-test-mode": false
},
"id": "1gtVBeZYQ0yO1SzipVP99Q",
"log-level": "error",
"message": {
"headers": {
"from": "\"Test Mail\" <noreply@test.x.domain.com>",
"message-id": "20250820143058.7cac292cf03993f2@test.x.domain.com",
"subject": "Test Mail",
"to": "6qj4xaisn4k@privaterelay.appleid.com"
},
"size": 22854
},
"primary-dkim": "s1._domainkey.test.x.domain.com",
"reason": "generic",
"recipient": "6qj4xaisn4k@privaterelay.appleid.com",
"recipient-domain": "privaterelay.appleid.com",
"recipient-provider": "Apple",
"severity": "permanent",
"storage": {
"env": "production",
"key": "BAABAgFDX5nmZ7fqxxxxxxZNzEVxPmZ8_YQ",
"region": "europe-west1",
"url": [
"https://storage-europe-west1.api.mailgun.net/v3/domains/test.x.domain.com/messages/BAABAgFDXxxxxxxxxxxxxxNzEVxPmZ8_YQ"
]
},
"user-variables": {}
}
Hi,
I followed step by step documentation to implement SignIn with Apple in iOS/Android application.
I created an AppId com.nhp.queenergy, a related ServiceId com.nhp.queenergy.apple, and a KeyId.
Authorization request is correctly performed by using ServiceId as client_id and my backend redirect_uri
I receive code on my backend
Token request is performed by using ServiceId as client_id, same redirect_uri, the code I have just received and the client_secret as JWT signed with my .p8 certificate with the following decoded structure
Header
{
"kid": ,
"typ": "JWT",
"alg": "ES256"
}
Payload
{
"iss": ,
"sub": "com.nhp.queenergy.apple",
"aud": "https://appleid.apple.com",
"exp": 1756113744,
"iat": 1756111944
}
I always receive "invalid_grant" error without any further error description.
Moreover the error is always the same even though I use any fake string as client secret.
If the code expires, as expected the error changes by adding "The code has expired or has been revoked."
I really don't know how to solve this issue
Best regards
Topic:
Privacy & Security
SubTopic:
Sign in with Apple
Hello everyone,
I'm encountering a persistent 503 Server Temporarily Not Available error when trying to implement "Sign in with Apple" for my web application. I've already performed a full review of my configuration and I'm confident it's set up correctly, which makes this server-side error particularly confusing.
Problem Description:
Our web application uses Firebase Authentication to handle the "Sign in with Apple" flow. When a user clicks the sign-in button, they are correctly redirected to the appleid.apple.com authorization page. However, instead of seeing the login prompt, the page immediately displays a 503 Server Temporarily Not Available error.
This is the redirect URL being generated (with the state parameter truncated for security):
https://appleid.apple.com/auth/authorize?response_type=code&client_id=XXXXXX&redirect_uri=https%3A%2F%2FXXXXXX.firebaseapp.com%2F__%2Fauth%2Fhandler&state=AMbdmDk...&scope=email%20name&response_mode=form_post
Troubleshooting Steps Performed:
Initially, I was receiving an invalid_client error, which prompted me to meticulously verify every part of my setup. I have confirmed the following:
App ID Configuration: The "Sign in with Apple" capability is enabled for our primary App ID.
Services ID Configuration:
We have a Services ID configured specifically for this.
The "Sign in with Apple" feature is enabled on this Services ID.
The domain is registered and verified under "Domains and Subdomains".
Firebase Settings Match Apple Settings:
The Services ID from Apple is used as the Client ID in our Firebase configuration.
The Team ID is correct.
We have generated a private key, and both the Key ID and the .p8 file have been correctly uploaded to Firebase.
The key is not revoked in the Apple Developer portal.
Since the redirect to Apple is happening with the correct client_id and redirect_uri, and the error is a 5xx server error (not a 4xx client error like invalid_client), I believe our configuration is correct and the issue might be on Apple's end. This has been happening consistently for some time.
My Questions:
What could be causing a persistent 503 Server Temporarily Not Available error on the /auth/authorize endpoint when all client-side configurations appear to be correct?
What is the formal process for opening a technical support ticket (TSI) directly with Apple Developer Support for an issue like this?
Thank you for any insights or help you can provide.
Topic:
Privacy & Security
SubTopic:
Sign in with Apple
Tags:
Sign in with Apple REST API
Sign in with Apple
Sign in with Apple JS
Hello Developers,
I have ran into a problem while sending mail to apple private relay email. We have built a mobile application where user can sign up through apple and they can sign up using hide-my-email feature. Which provides private relay address for us. Now we want to communicate with them using private relay mail address. The technology we are using to send emails are amazon SES, have done SPF, DMIK, DMARC and added domains in apple identity services for mail communication, passed an SPF check as well. But still mail is not getting delivered
what am i doing wrong or apple doesn't support third party apps for sending emails to private relay? Is there any other way to achieve this please let me know
Using the same body as attached in image is working fine for rest emails.
Topic:
Privacy & Security
SubTopic:
Sign in with Apple
Tags:
Sign in with Apple REST API
Privacy
Sign in with Apple
Would really appreciate support with this invalid_client issue:
I have a web app and have aligned the JWT Header and Payload
JWT Header
{
"alg": "ES256",
"kid": "ABC123DEFG"
}
JWT Payload
{
"iss": "DEF123GHIJ",
"iat": 1234567890,
"exp": 1234567890,
"aud": "https://appleid.apple.com",
"sub": "com.yourapp.service"
The domains and callback are aligned and correct
I've even created a new p8 and updated the Key_ID
Sending Credentials to Apple (Token Request) Content-Type: application/x-www-form-urlencoded
However, still no luck. Can anyone assist with identifying the possible error?
Many thanks
Topic:
Privacy & Security
SubTopic:
Sign in with Apple
Tags:
Sign in with Apple REST API
Sign in with Apple
Sign in with Apple JS
Hi,
Before I begin my investigation, I want to explain our code-level support process for issues related to Sign in with Apple—as the issue you’re reporting may be the result of any of the following:
An error in your app or web service request.
A configuration issue in your Developer Account.
An internal issue in the operation system or Apple ID servers.
To ensure the issue is not caused by an error within your app or web service request, please review TN3107: Resolving Sign in with Apple response errors to learn more about common error causes and potential solutions when performing requests.
If the technote does not help identify the cause of the error, I need more information about your app or web services to get started. To prevent sending sensitive JSON Web Tokens (JWTs) in plain text, you should create a report in Feedback Assistant to share the details requested below. Additionally, if I determine the error is caused by an internal issue in the operating system or Apple ID servers, the appropriate engineering teams have access to the same information and can communicate with you directly for more information, if needed. Please follow the instructions below to submit your feedback.
Gathering required information for troubleshooting Sign in with Apple authorization and token requests
For issues occurring with your native app, perform the following steps:
Install the Accounts/AuthKit profile on your iOS, macOS, tvOS, watchOS, or visionOS device.
Reproduce the issue and make a note of the timestamp when the issue occurred, while optionally capturing screenshots or video.
Gather a sysdiagnose on the same iOS, macOS, tvOS, watchOS, or visionOS device.
Create a report in Feedback Assistant, and ensure your feedback contains the following information:
the primary App ID or Bundle ID
the user’s Apple ID, email address, and/or identity token
the sysdiagnose gathered after reproducing the issue
the timestamp of when the issue was reproduced
screenshots or videos of errors and unexpected behaviors (optional)
For issues occurring with your web service, ensure your feedback contains the following information:
the primary App ID and Services ID
the user’s Apple ID, email address, and/or identity token
the failing request, including all parameter values, and error responses (if applicable)
the timestamp of when the issue was reproduced (optional)
screenshots or videos of errors and unexpected behaviors (optional)
Important: If providing a web service request, please ensure the client secret (JWT) has an extended expiration time (exp) of at least ten (10) business days, so I have enough time to diagnose the issue. Additionally, if your request requires access token or refresh tokens, please provide refresh tokens as they do not have a time-based expiration time; most access tokens have a maximum lifetime of one (1) hour, and will expire before I have a chance to look at the issue.
Submitting your feedback
Before you submit to Feedback Assistant, please confirm the requested information above (for your native app or web service) is included in your feedback. Failure to provide the requested information will only delay my investigation into the reported issue within your Sign in with Apple client.
After your submission to Feedback Assistant is complete, please respond in your existing Developer Forums post with the Feedback ID. Once received, I can begin my investigation and determine if this issue is caused by an error within your client, a configuration issue within your developer account, or an underlying system bug.
Cheers,
Paris X Pinkney | WWDR | DTS Engineer
Topic:
Privacy & Security
SubTopic:
Sign in with Apple
Tags:
Sign in with Apple REST API
Sign in with Apple
Sign in with Apple JS
Hello,
We’ve resumed the migration process after a break. Since my colleague is no longer with us, I had to go through the steps again myself.
As before, we’re trying to migrate "Sign In with Apple" users from tenant TENANT_A with client_id=CLIENT_ID_A to tenant TENANT_B with client_id=CLIENT_ID_B
I followed the procedure described here: [Apple Developer Documentation](https://developer.apple.com/documentation/technotes/tn3159-migrating-sign-in-with-apple-users-for-an-app-transfer – Migrating Sign In with Apple Users, essentially repeating what my coworker previously attempted in coordination with your employee Stephanie.
Here’s a summary of the steps and the issue we’re facing:
STEP 1 - get authcode for TEAM A
curl --location 'https://appleid.apple.com/auth/token'
--header 'Content-Type: application/x-www-form-urlencoded'
--data-urlencode 'grant_type=client_credentials'
--data-urlencode 'scope=user.migration'
--data-urlencode 'client_id=pl.CLIEND_ID_A'
--data-urlencode 'client_secret=<TEAM_A_SECRET>'
I receive response:
{
"access_token": "<ACCESS_TOKEN_TEAM_A>",
"token_type": "Bearer",
"expires_in": 3600
}
STEP 2 - get authcode for TEAB B
curl --location 'https://appleid.apple.com/auth/token'
--header 'Content-Type: application/x-www-form-urlencoded'
--data-urlencode 'grant_type=client_credentials'
--data-urlencode 'scope=user.migration'
--data-urlencode 'client_id=CLIENT_ID_B'
--data-urlencode 'client_secret=<TEAB_B_SECRET>'
I receive response:
{
"access_token":"<ACCESS_TOKEN_TEAB_B>",
"token_type": "Bearer",
"expires_in": 3600
}
STEP 3 - get transfer_sub from TEAM A
curl --location 'https://appleid.apple.com/auth/usermigrationinfo'
--header 'Authorization: Bearer <ACCESS_TOKEN_TEAM_A>'
--header 'Content-Type: application/x-www-form-urlencoded'
--data-urlencode 'client_id=CLIENT_ID_A'
--data-urlencode 'client_secret=<TEAM_A_SECRET>'
--data-urlencode 'sub=USER_SUB_FROM_TEAM_A'
--data-urlencode 'target=TENANT_B'
I receive response:
{
"transfer_sub": "USER_SUB_FROM_TEAM_B"
}
STEP 4 - Team B exchanges transfer identifers
curl --location 'https://appleid.apple.com/auth/usermigrationinfo'
--header 'Authorization: Bearer <ACCESS_TOKEN_TEAM_B'
--header 'Content-Type: application/x-www-form-urlencoded'
--data-urlencode 'client_id=CLIENT_ID_B'
--data-urlencode 'client_secret=<TEAM_B_SECRET>'
I receive response:
{
"error": "invalid_request"
}
We’ve created a new client_id under tenant B and want to migrate users there. However, we skipped the step described in Step 3 of the documentation(https://developer.apple.com/documentation/technotes/tn3159-migrating-sign-in-with-apple-users-for-an-app-transfer#3-Team-A-initiates-app-transfer-to-Team-B), which involves initiating an app transfer. The reason is that this client_id is used solely for web authentication, not for a mobile app, so we don’t have an app to transfer.
Based on our analysis and your documentation, it seems this flow only works if the client_id matches across both tenants, which can only be achieved through an app transfer, something we cannot proceed with.
Apple previously insisted that we migrate these users, but as shown above, we’re stuck. Is there any alternative flow available, or can you assist us in completing this migration?
Topic:
Privacy & Security
SubTopic:
Sign in with Apple
Hi,
Before I begin my investigation, I want to explain our code-level support process for issues related to Sign in with Apple—as the issue you’re reporting may be the result of any of the following:
An error in your app or web service request.
A configuration issue in your Developer Account.
An internal issue in the operation system or Apple ID servers.
To ensure the issue is not caused by an error within your Private Email Replay configuration, please review Configuring your environment for Sign in with Apple to learn more about registering your email sources and authenticated domains.
To prevent sending sensitive message details in plain text, you should create a report in Feedback Assistant to share the details requested below. Additionally, if I determine the error is caused by an internal issue in the operating system or Apple ID servers, the appropriate engineering teams have access to the same information and can communicate with you directly for more information, if needed. Please follow the instructions below to submit your feedback.
Gathering required information for troubleshooting Private Email Relay with Sign in with Apple
For issues occurring with your email delivery, ensure your feedback contains the following information:
the primary App ID and Services ID
the user’s Apple ID and/or email address
the email message headers
the Private Email Relay Service or Hide My Email message delivery failure, and SMTP error codes
Submitting your feedback
Before you submit to Feedback Assistant, please confirm the requested information above is included in your feedback. Failure to provide the requested information will only delay my investigation into the reported issue within your Sign in with Apple client.
After your submission to Feedback Assistant is complete, please respond in your existing Developer Forums post with the Feedback ID. Once received, I can begin my investigation and determine if this issue is caused by an error within your client, a configuration issue within your developer account, or an underlying system bug.
Cheers,
Paris X Pinkney | WWDR | DTS Engineer
Topic:
Privacy & Security
SubTopic:
Sign in with Apple
Tags:
Sign in with Apple REST API
Sign in with Apple
Sign in with Apple JS
"Our app has absolutely no integration with DiDi login. We only integrate WeChat, QQ, carrier, and Apple ID login, and all related login entry icons are local resources. On an iPhone 16 Pro Max device with iOS system version 18.7, there was one isolated incident where the Apple ID login entry icon mysteriously changed to the DiDi app icon. What could be the possible iOS system-level causes for this?"
Topic:
Privacy & Security
SubTopic:
Sign in with Apple
We are working on a PoC iOS App to use "Sign in with Apple" on iOS. The app needs to authenticate the current user on MDM managed corporate iPads (with Shared iPad enabled) and each user having a Managed Apple ID (created in Apple Business Manager).
We have started with Apple's example app:
https://developer.apple.com/documentation/authenticationservices/implementing-user-authentication-with-sign-in-with-apple
When we run it on a normal iPad (without MDM supervision) it works fine.
When we run the same code on a managed iPad with Shared iPad enabled and Managed Apple ID's the app errors out when a user taps the "Sign in with Apple" button.
A User-facing error message is displayed:
“Your Apple Account cannot be used to create accounts for other apps.”
And when we run the app from Xcode we see the following logs:
Authorization failed: Error Domain=AKAuthenticationError Code=-7027 "(null)" UserInfo={AKClientBundleID=com.sampleapp.test2}
LaunchServices: store (null) or url (null) was nil: Error Domain=NSOSStatusErrorDomain Code=-54 "process may not map database" UserInfo={NSDebugDescription=process may not map database, _LSLine=72, _LSFunction=_LSServer_GetServerStoreForConnectionWithCompletionHandler}
Attempt to map database failed: permission was denied. This attempt will not be retried.
Failed to initialize client context with error Error Domain=NSOSStatusErrorDomain Code=-54 "process may not map database" UserInfo={NSDebugDescription=process may not map database, _LSLine=72, _LSFunction=_LSServer_GetServerStoreForConnectionWithCompletionHandler}
Failed to get application extension record: Error Domain=NSOSStatusErrorDomain Code=-54 "(null)"
ASAuthorizationController credential request failed with error: Error Domain=com.apple.AuthenticationServices.AuthorizationError Code=1000 "(null)"
Could not authenticate: The operation couldn’t be completed. (com.apple.AuthenticationServices.AuthorizationError error 1000.)
We have confirmed that in ABM "Sign in with Apple" feature is enabled with "Allowed apps": "All apps".
We have also confirmed that the Managed AppleIDs created in ABM have no field to provide the birthday of the user and therefore ruling out age restrictions for "Sign in with Apple".
Is "Sign in with Apple" supported in MDM managed iPADs with
Shared iPad enabled and managed AppleIDs?
If it is supported, do we know what other configurations we need to get it to work?
Do we know why "Sign in with Apple" would error out with
Authorization failed: Error Domain=AKAuthenticationError Code=-7027 "(null)" UserInfo={AKClientBundleID=com.sampleapp.test2} LaunchServices: store (null) or url (null) was nil: Error Domain=NSOSStatusErrorDomain Code=-54 "process may not map database" UserInfo={NSDebugDescription=process may not map database, _LSLine=72,
Environment:
• iPadOS version: IPadOS Version 18.7
• Xcode version: Version 26.0 (17A324)
• Device type: iPad Air 11-inch (M3) in Shared iPad mode
• Account type: Managed Apple ID created in ABM enrolled with Intune MDM)
Thank you