How do I implement Sign in with Apple on web and mobile?

Here’s the practical way to implement Sign in with Apple for web and mobile.

---

1) What Sign in with Apple gives you

When a user signs in, Apple returns:

• a stable user identifier (sub) for your app/team
• email (sometimes)
• name only on the first authorization
• an identity token (id_token, a JWT)
• an authorization code (code) you can exchange server-side for tokens

You should treat the server as the source of truth and verify Apple’s tokens on your backend.

---

2) Setup in Apple Developer

You need:

• an Apple Developer Program account
• your app IDs / service IDs configured
• a private key for Apple Sign In token exchange
• proper redirect/callback URLs

In the Apple Developer portal

Create/configure:

1. App ID
   Enable Sign in with Apple

2. Service ID (for web)
   This is your OAuth client identifier for the browser flow.

3. Key
   Create a Sign in with Apple key to sign client secrets.

4. Redirect URL
   Add your backend callback URL(s), e.g.:

   • https://yourdomain.com/auth/apple/callback

You will need these values:

• Team ID
• Key ID
• Client ID
  • mobile: your app bundle ID
  • web: your Service ID
• Private key (.p8)

---

3) Recommended architecture

Use this pattern:

• Frontend (web/mobile) starts Apple sign-in
• Apple returns to your backend
• Backend verifies Apple response
• Backend creates/links your local user
• Backend issues your own session/JWT

Do not rely only on client-side parsing of Apple tokens for authentication.

---

4) Web implementation

Typical flow

1. User clicks “Continue with Apple”
2. Redirect to Apple authorization endpoint
3. User authenticates
4. Apple redirects back to your callback URL with code and id_token
5. Backend exchanges code for tokens
6. Backend verifies id_token
7. Backend logs the user in

Authorization endpoint

Your frontend can redirect to Apple’s auth URL like this:

https://appleid.apple.com/auth/authorize

Common query params:

• response_type=code id_token
• response_mode=form_post
• client_id=YOUR_SERVICE_ID
• redirect_uri=https://yourdomain.com/auth/apple/callback
• scope=name email
• state=RANDOM_CSRF_TOKEN
• nonce=RANDOM_NONCE
• response_type=code id_token

Example redirect URL

https://appleid.apple.com/auth/authorize?
response_type=code%20id_token&
response_mode=form_post&
client_id=com.example.web&
redirect_uri=https%3A%2F%2Fyourdomain.com%2Fauth%2Fapple%2Fcallback&
scope=name%20email&
state=xyz123&
nonce=abc456

---

5) Backend: exchange code for tokens

Apple token endpoint:

https://appleid.apple.com/auth/token

You send:

• client_id
• client_secret
• code
• grant_type=authorization_code
• redirect_uri

Client secret

For Apple, your client_secret is a JWT you generate with:

• header:
  • alg: ES256
  • kid: your Key ID
• claims:
  • iss: your Team ID
  • iat: issued-at
  • exp: expiration (max ~6 months is commonly used; keep it shorter)
  • aud: https://appleid.apple.com
  • sub: your client ID (Service ID for web)

Example token request

POST /auth/token HTTP/1.1
Content-Type: application/x-www-form-urlencoded

grant_type=authorization_code&
code=AUTH_CODE_FROM_APPLE&
redirect_uri=https%3A%2F%2Fyourdomain.com%2Fauth%2Fapple%2Fcallback&
client_id=com.example.web&
client_secret=YOUR_SIGNED_JWT

---

6) Verify Apple’s identity token

The id_token is a JWT signed by Apple. Verify:

• signature against Apple’s public keys
• iss is https://appleid.apple.com
• aud matches your client ID
• exp is valid
• nonce matches what you sent
• sub is the Apple user ID you store

Apple JWKS endpoint:

https://appleid.apple.com/auth/keys

---

7) Mobile implementation

iOS / iPadOS

Use Apple’s native framework:

• AuthenticationServices
• ASAuthorizationAppleIDProvider
• ASAuthorizationController

This is the standard native flow.

Swift example

import AuthenticationServices

class AppleSignIn: NSObject, ASAuthorizationControllerDelegate, ASAuthorizationControllerPresentationContextProviding {
    func startSignIn() {
        let provider = ASAuthorizationAppleIDProvider()
        let request = provider.createRequest()
        request.requestedScopes = [.fullName, .email]
        request.nonce = "hashedNonceHere"

        let controller = ASAuthorizationController(authorizationRequests: [request])
        controller.delegate = self
        controller.presentationContextProvider = self
        controller.performRequests()
    }

    func authorizationController(controller: ASAuthorizationController, didCompleteWithAuthorization authorization: ASAuthorization) {
        if let credential = authorization.credential as? ASAuthorizationAppleIDCredential {
            let identityToken = credential.identityToken
            let authorizationCode = credential.authorizationCode
            let userId = credential.user
            let email = credential.email
            let fullName = credential.fullName

            // Send token/code to backend
        }
    }

    func authorizationController(controller: ASAuthorizationController, didCompleteWithError error: Error) {
        print("Apple sign in error: \(error)")
    }

    func presentationAnchor(for controller: ASAuthorizationController) -> ASPresentationAnchor {
        return UIApplication.shared.connectedScenes
            .compactMap { $0 as? UIWindowScene }
            .first?.windows.first { $0.isKeyWindow }!
    }
}

iOS backend handling

Send to your backend:

• identityToken
• authorizationCode
• possibly user and nonce

Then backend:

• verifies id_token
• exchanges authorization_code if needed
• links or creates your local user
• creates session/JWT

---

Android

Apple does not provide a native Android SDK for Apple Sign In. For Android, use the web OAuth flow in a browser/custom tab and handle the redirect back to your app.

Typical approach:

1. Open Apple auth URL in browser/custom tab
2. Use a redirect URI that returns to your app via:
   • app link / universal link
   • custom scheme, if allowed in your design
3. Handle code on backend or via your app and exchange server-side

For most teams, the cleanest Android implementation is:

• start web OAuth in a browser
• redirect to backend callback
• backend issues your app session token
• app receives your app’s auth result

---

8) Cross-platform mobile guidance

If you have both iOS and Android:

• iOS: native Apple auth framework
• Android: web OAuth flow
• Backend unified for both:
  • verify Apple token
  • map Apple sub to your user
  • issue your app session

---

9) Important implementation details

A) Store the Apple user identifier

The key stable identifier is:

• sub from the verified id_token

Use it to link the Apple account to your user record.

B) Email may only be returned once

Apple may provide email only on first sign-in. Save it immediately if you need it.

C) Name is only returned once

Same for fullName on iOS.

D) Use nonce protection

Generate a random nonce on your backend/client, send a hashed version to Apple, and verify it in the returned id_token.

E) Handle private relay emails

Apple may return addresses like:

• user@privaterelay.appleid.com

Treat them as real user emails if your system supports them.

---

10) Example backend verification flow

Pseudo-steps:

1. Receive code and id_token
2. Verify JWT signature using Apple JWKS
3. Check claims:
   • iss
   • aud
   • exp
   • nonce
4. Extract:
   • sub
   • email
5. Look up user by Apple sub
6. If user exists, log in
7. If not, create account and link Apple identity
8. Issue your own session/JWT

---

11) Common mistakes

• Using the wrong client ID:
  • web uses Service ID
  • iOS uses bundle ID
• Not verifying the id_token server-side
• Forgetting to include a valid redirect_uri
• Not handling Apple’s form_post response mode
• Expecting email/name on every login
• Not persisting Apple sub
• Not validating state and nonce

---

12) If you’re using a framework

If you tell me your stack, I can give you exact code. Common setups:

• Web

  • Node/Express
  • Next.js
  • Django
  • Rails
  • Spring Boot

• Mobile

  • Swift/iOS
  • React Native
  • Flutter
  • Kotlin/Android

---

13) Minimal implementation checklist

Web

• Create Service ID
• Add redirect URL
• Generate Apple client secret JWT
• Redirect to Apple auth endpoint
• Handle callback
• Verify JWT and exchange code
• Create local session

Mobile iOS

• Enable Sign in with Apple capability
• Use AuthenticationServices
• Request name/email
• Send token/code to backend
• Verify on backend

Android

• Use web OAuth flow
• Handle redirect back to app/backend
• Verify on backend
• Issue app session

---

If you want, I can provide:

1. a Node.js/Express backend example,
2. a Next.js implementation, or
3. a Swift iOS + backend example.