Apple Sign In

Sign in with Apple uses a Services ID (web) and native identity tokens on iOS. Apple private relay addresses (@privaterelay.appleid.com) are valid registration emails. Native iOS tokens are verified against the App ID (APPLE_BUNDLE_ID) as well as the Services ID.

Apple Developer

1. Enable Sign in with Apple on your App ID.
2. Create a Services ID for web OAuth (redirect {APP_URL}/auth/apple/callback).
3. Create a Sign in with Apple key (.p8), note Key ID and Team ID.
4. Register email sending domains with Apple’s private email relay if you send mail to relay addresses.

API environment

APPLE_CLIENT_ID=your.services.id
APPLE_CLIENT_SECRET=... # generated JWT or SocialiteProviders secret
APPLE_BUNDLE_ID=com.garrisonbible.app # iOS App ID / identity token audience
APPLE_TEAM_ID=...
APPLE_KEY_ID=...
APPLE_PRIVATE_KEY="-----BEGIN PRIVATE KEY-----\n..."
APPLE_REDIRECT_URI=https://api.example.com/auth/apple/callback

The API uses socialiteproviders/apple for the web redirect flow.

Web app

When authMethods.apple is true:

• Login uses intent=login — unknown Apple identities are not auto-registered. If Apple returns an email that already belongs to a Garrison account, that account is signed in and Apple is linked; otherwise users see “not connected” and can Register with Apple.
• Register uses intent=register → /register/complete (18+ and terms). Hide My Email relay is accepted as users.email.

Profile → Connected accounts links or unlinks Apple without requiring matching emails.

iOS

Native AuthenticationServices returns an identity token verified by loginWithApple / registerWithApple GraphQL mutations. Set APPLE_BUNDLE_ID to the iOS App ID (bundle ID) so native tokens pass audience checks; web tokens still use the Services ID (APPLE_CLIENT_ID). Enable the Sign in with Apple capability on the iOS target (iosApp.entitlements). Unknown Apple identities do not create accounts on mobile — users must register on the web app first.

Sign in with Apple must appear with equal prominence to other social options on iOS (App Store Guideline 4.8).

Smoke test

1. Register with Apple on web → relay or real email → /register/complete → account created.
2. Login with unknown Apple → not linked message; Register continues the flow.
3. Profile → link/unlink Apple (set password or keep another provider before unlink).