{"registry_version":"2026.1025.387","generated_at":"2026-10-25T06:27:00Z","content_sha256":"089d16f627d9365e3d0663cc8069203706d7cb23a76c332226e29686968811a5","signed":true,"signature":{"key_id":"ed25519:74ca19268e364242","algorithm":"ed25519","expires_at":"2026-11-24T06:27:09Z","expired":false,"manifest":"/registry/manifest.json"},"id":"apple/sign-in-with-apple","name":"Sign in with Apple (web and non-Apple platforms)","vendor":"Apple","status":"researched","last_verified":null,"last_researched":"2026-10-25","summary":"Set up Sign in with Apple for a website or a non-Apple platform: enable it on a primary App ID, create a Services ID with your domains and return URLs, create a private key, and sign a client secret (JWT) that must be renewed at least every six months. Optionally register email sources so you can email users who hide their address behind Apple's private relay.","account_model":{"summary":"Everything sits inside one Apple Developer Program team: a primary App ID with the Sign in with Apple capability, one Services ID per web service (the OAuth client_id), and up to two private keys tied to the primary App ID. Domains and email sources are registered to the team's Team ID.","accounts":[{"name":"Apple Developer Program membership","kind":"developer","owned_by":"the company (or individual developer)","required":true,"note":"Organisations can register up to 100 website URLs per Services ID, individuals 10."},{"name":"Primary App ID (Sign in with Apple enabled)","kind":"project","parent":"Apple Developer Program membership","required":true},{"name":"Services ID","kind":"project","parent":"Primary App ID (Sign in with Apple enabled)","required":true,"note":"Used as client_id on the web."}],"notes":["Grouping related App IDs under one primary App ID means users consent once per group of apps and websites.","Users who hide their email get a private relay address; you can only email them from registered sources."]},"prerequisites":[{"entry":"apple/developer-program-org","note":"Any paid membership works; an organisation membership gets higher URL and email-source limits."},{"need":"The website domain(s) and exact HTTPS return URL(s) for your OAuth callback."},{"need":"Access to DNS for your sending domain if you will email relay users (SPF/DKIM)."}],"identity_requires":[],"have_ready":[{"kind":"other","description":"Account Holder or Admin access to the Apple Developer account.","why":"Required to create keys and register email sources.","needed_for":["private-key","email-sources"],"auto_check":"none","source_url":"https://developer.apple.com/help/account/keys/create-a-private-key/"},{"kind":"live_website","description":"Your production domain(s) and absolute return URLs, e.g. https://example.com/auth/callback/apple.","why":"Each return URL must include scheme, host and path.","needed_for":["services-id"],"auto_check":"website_live","source_url":"https://developer.apple.com/documentation/signinwithapple/configuring-your-environment-for-sign-in-with-apple"},{"kind":"other","description":"SPF (and ideally DKIM) records on the domain your transactional email is sent from.","why":"Apple's private relay only delivers authenticated mail from registered sources.","needed_for":["email-sources"],"auto_check":"dns_record","source_url":"https://developer.apple.com/help/account/configure-app-capabilities/configure-private-email-relay-service"}],"steps":[{"id":"sign-in","title":"Sign in to Certificates, Identifiers & Profiles","summary":"Sign in to the Apple Developer account as Account Holder or Admin.","route":"guided","gate":"2fa","human_only":true,"gate_label":"You enter a 2-step code","depends_on":[],"optional":false,"url":"https://developer.apple.com/account/resources","lead_time":null,"preflight":[],"captures":null},{"id":"primary-app-id","title":"Enable Sign in with Apple on a primary App ID","summary":"Edit your app's App ID (or enable the capability in Xcode) and switch on Sign in with Apple as a primary App ID, or group it with an existing primary App ID for a related app.","route":"guided","gate":"human_submit","human_only":true,"gate_label":"You press submit","depends_on":["sign-in"],"optional":false,"url":"https://developer.apple.com/account/resources","lead_time":null,"preflight":[],"captures":null},{"id":"services-id","title":"Create and configure a Services ID","summary":"Identifiers > + > Services ID; enter a description and unique identifier (e.g. com.example.web). Select it, tick Sign in with Apple, click Configure, choose the primary App ID, and enter your domains, subdomains and return URLs as a comma-separated list. Save. No verification file upload is needed.","route":"guided","gate":"human_submit","human_only":true,"gate_label":"You press submit","depends_on":["primary-app-id"],"optional":false,"url":"https://developer.apple.com/account/resources","lead_time":null,"preflight":[],"captures":null},{"id":"private-key","title":"Create a Sign in with Apple private key","summary":"Keys > +, name the key, tick Sign in with Apple, click Configure and choose the primary App ID. Confirm, then download the .p8 once and store it in your secret store. Each primary app can have at most two keys.","route":"guided","gate":"human_submit","human_only":true,"gate_label":"You press submit","depends_on":["primary-app-id"],"optional":false,"url":"https://developer.apple.com/account/resources","lead_time":null,"preflight":[],"captures":"APPLE_SIGNIN_PRIVATE_KEY"},{"id":"client-secret","title":"Generate the client secret (JWT) on your server","summary":"Sign an ES256 JWT with kid = Key ID, iss = Team ID, iat = now, exp up to six months ahead, aud = https://appleid.apple.com, sub = the Services ID (case-sensitive). Send it as client_secret. Many auth libraries generate it for you from the key; otherwise put a reminder to regenerate it.","route":"guided","gate":"none","human_only":false,"gate_label":null,"depends_on":["private-key","services-id"],"optional":false,"url":null,"lead_time":null,"preflight":[],"captures":null},{"id":"email-sources","title":"Register outbound email sources for the private relay","summary":"Services > Sign in with Apple for Email Communication > Configure. Add your sending domains or exact addresses; the table shows whether each passed SPF. Make sure the envelope sender domain passes SPF or the mail is DKIM-signed for the From domain.","route":"guided","gate":"human_submit","human_only":true,"gate_label":"You press submit","depends_on":["sign-in"],"optional":true,"url":"https://developer.apple.com/account/resources","lead_time":null,"preflight":["dns_record_resolves"],"captures":null},{"id":"notifications","title":"Register a server-to-server notification endpoint","summary":"Edit the App ID and add one HTTPS (TLS 1.2+) endpoint to hear when users change email forwarding or delete their Apple Account.","route":"guided","gate":"human_submit","human_only":true,"gate_label":"You press submit","depends_on":["primary-app-id"],"optional":true,"url":null,"lead_time":null,"preflight":[],"captures":null}],"gates":[{"step":"sign-in","gate":"2fa","label":"You enter a 2-step code"},{"step":"primary-app-id","gate":"human_submit","label":"You press submit"},{"step":"services-id","gate":"human_submit","label":"You press submit"},{"step":"private-key","gate":"human_submit","label":"You press submit"},{"step":"email-sources","gate":"human_submit","label":"You press submit"},{"step":"notifications","gate":"human_submit","label":"You press submit"}],"lead_times":[],"outputs":[{"name":"APPLE_SIGNIN_CLIENT_ID","description":"The Services ID used as OAuth client_id on the web.","secret":false,"example_format":"com.example.web","environments":null},{"name":"APPLE_SIGNIN_KEY_ID","description":"10-character Key ID of the Sign in with Apple private key (JWT kid).","secret":false,"example_format":"ABC123DEFG","environments":null},{"name":"APPLE_SIGNIN_PRIVATE_KEY","description":"The .p8 private key used to sign client secrets. Secret.","secret":true,"example_format":"contents of AuthKey_<KEY_ID>.p8","environments":null}],"renewals":[{"what":"Client secret JWT (exp no more than six months ahead)","every":"6 months","every_days":180,"source_url":"https://developer.apple.com/documentation/accountorganizationaldatasharing/creating-a-client-secret"}],"estimated_minutes":null,"guide_url":"https://verapli.com/guides/apple/sign-in-with-apple"}