Apple Social Connection

This guide outlines the steps to configure Sign in with Apple as a social login provider in AuthAction.

Apple does not use the Client ID and Client Secret pattern of the other providers. You will need four values:

• Services ID — acts as the client ID. This is a separate identifier from your App ID.
• Private key (.p8) — used in place of a client secret.
• Team ID and Key ID — identify the key when signing requests.

All four are required.

A paid Apple Developer Program membership is needed. Sign in with Apple is not available on a free account.

Step 1: Create an App ID

1. Go to Certificates, Identifiers & Profiles in the Apple Developer portal.
2. Select Identifiers, then click the + button.
3. Choose App IDs, then App.
4. Enter a Description and an explicit Bundle ID (for example com.example.app).
5. Under Capabilities, enable Sign in with Apple.
6. Click Continue, then Register.

You need an App ID even if you only support web login — the Services ID in the next step groups under it.

Step 2: Create a Services ID

1. In Identifiers, click the + button again.
2. Choose Services IDs, then click Continue.
3. Enter a Description and an Identifier (for example com.example.auth).
4. Click Continue, then Register.

The Identifier you enter here is your client ID in AuthAction. It is a different value from the App ID’s bundle ID.

Step 3: Configure Web Authentication

1. In Identifiers, switch the filter to Services IDs and select the Services ID you just created.
2. Tick Sign In with Apple, then click Configure.
3. Set Primary App ID to the App ID from Step 1.
4. Next to Website URLs, click the + button.
5. Under Domains and Subdomains, enter your AuthAction domain without a scheme:

   <tenant-name>.<region>.authaction.com

6. Under Return URLs, enter the full callback URL:

   https://<tenant-name>.<region>.authaction.com/oauth2/login/callback

7. Click Next, then Done, then Continue, then Save.

If you use a custom domain, register that domain and its callback URL instead — for example auth.example.com and https://auth.example.com/oauth2/login/callback. The return URL must match the domain your users land on.

Return URLs must use https:// and cannot contain query parameters. No domain verification file is required.

Step 4: Create a Sign in with Apple Key

1. In the Apple Developer portal, go to Keys, then click the + button.
2. Enter a Key Name.
3. Tick Sign in with Apple, then click Configure.
4. Select the App ID from Step 1 as the Primary App ID, then click Save.
5. Click Continue, then Register.
6. Click Download to save the .p8 file, and note the Key ID shown on the page.

The .p8 file can only be downloaded once. If you lose it, revoke the key and create a new one.

Step 5: Find Your Team ID

Your 10-character Team ID appears in the top-right of the Apple Developer portal, and under Membership details.

Step 6: Configure Apple in AuthAction

1. Sign in to the AuthAction Dashboard.

2. Navigate to Connections > Social Connections.

3. Select Apple from the available providers.

4. Enter the four values:

   Field	Value
   Services ID (Client ID)	The Services ID identifier from Step 2, for example com.example.auth
   Private key (.p8)	The full contents of the .p8 file, including the BEGIN/END lines
   Team ID	Your 10-character Team ID from Step 5
   Key ID	The Key ID of the .p8 key from Step 4

5. Click Save.

Paste the .p8 contents exactly as they appear in the file, with real line breaks.

Step 7: Enable the Apple Connection for Your Application

1. Navigate to Applications in the AuthAction Dashboard.
2. Select the application you want to enable Apple authentication for.
3. Enable the Apple Social Connection toggle.
4. Save the changes.

Step 8: Verify the Integration

1. Open your application’s login page.
2. Confirm the Sign in with Apple option is available.
3. Click it and authenticate with an Apple Account.
4. Confirm that the user is redirected back to your application successfully.

Things to Know

The user’s name is returned only once. Apple sends it on the first authorization for a given user and never again. AuthAction stores it at that point. To test this path again, remove the app under Apple Account > Sign in with Apple on your device and sign in once more.

Users can hide their email address. Apple’s Private Email Relay lets users sign in with a generated @privaterelay.appleid.com address. AuthAction identifies users by Apple’s stable sub claim, so the account stays the same user either way.

Only name and email are requested. These are the only scopes AuthAction requests from Apple.

Troubleshooting

invalid_client at token exchange. One of the four values is wrong. Most often the Services ID has been set to the App ID’s bundle ID, or the Team ID or Key ID does not match the .p8 key.

Invalid redirect URI. The return URL registered on the Services ID does not match the one AuthAction sends. Check the domain, the exact /oauth2/login/callback path, and that you registered your custom domain if you use one.

The key is rejected. The .p8 contents were altered when pasted — usually escaped \n sequences instead of real line breaks. Paste the file contents verbatim.

Once verified, users can sign in with Apple in both development and production environments.