Apple login mobile app OAuth

If you want “Sign in with Apple” in a mobile app using OAuth / OpenID Connect, here’s the practical setup.

1) What Apple uses

Apple login is OAuth 2.0 + OpenID Connect.
You typically use:

• Authorization endpoint: https://appleid.apple.com/auth/authorize
• Token endpoint: https://appleid.apple.com/auth/token
• Issuer: https://appleid.apple.com

2) Recommended mobile flow

For iOS/Android mobile apps, use the Authorization Code Flow with PKCE.

Why:

• Safer than implicit flow
• Works well with mobile apps
• Avoids embedding a client secret in the app

3) Apple Developer setup

You need to create/configure:

• App ID / Bundle ID
• Sign In with Apple enabled
• Service ID if you’re doing web-based auth or backend exchange
• Key for generating the Apple client secret on your backend
• Redirect URI registered in Apple Developer portal

4) Typical flow

1. App opens Apple sign-in UI.
2. User authenticates with Apple.
3. Apple returns an authorization code.
4. App sends code to your backend.
5. Backend exchanges code for tokens using:
   • client_id
   • client_secret (JWT signed with your Apple private key)
   • code
   • redirect_uri
6. Backend verifies the id_token.
7. Backend creates your app session / user account.

5) Important Apple-specific notes

• Apple only returns the user’s name/email the first time the user authorizes.
• Use the sub claim in the id_token as the stable Apple user identifier.
• The client secret is a JWT signed with your Apple private key (ES256), not your app secret.
• Refresh tokens may be available depending on flow and scopes.

6) Example token exchange

Backend POST to:

https://appleid.apple.com/auth/token

Form fields:

• client_id
• client_secret
• code
• grant_type=authorization_code
• redirect_uri

7) JWT client secret claims

When creating the Apple client secret JWT:

• iss: Your Apple Team ID
• iat: Issued at time
• exp: Expiration time (Apple allows up to 6 months)
• aud: https://appleid.apple.com
• sub: Your Service ID / client_id

8) Best practice

For mobile apps:

• Use the native Apple Sign In SDK if available
• Or use OAuth2 + PKCE
• Verify the id_token on your backend
• Never trust only the app-side response

---

If you want, I can give you:

1. a full Apple OAuth flow diagram,
2. iOS Swift example,
3. Android/Kotlin example, or
4. backend token exchange code in Node/Python/Java.