verapli
Sign inJoin free
Menu

Guides · auth · Verification-gated

Sign in with Apple (web and non-Apple platforms)

Set up Sign in with Apple for a website or a non-Apple platform: enable it on a primary App ID, create a Services ID with your domains and return URLs, create a private key, and sign a client secret (JWT) that must be renewed at least every six months. Optionally register email sources so you can email users who hide their address behind Apple's private relay.

Researched · not yet run liveLast researched 25 October 2026 · Apple · provider site

Researched, not yet run live. Built from the provider’s official pages (linked below). A person hasn’t walked this flow end to end yet, so check each step against the source.
Do this with verapliJSON for agents

Who owns what

Everything sits inside one Apple Developer Program team: a primary App ID with the Sign in with Apple capability, one Services ID per web service (the OAuth client_id), and up to two private keys tied to the primary App ID. Domains and email sources are registered to the team's Team ID.

  • Apple Developer Program membership developer owned by the company (or individual developer)Organisations can register up to 100 website URLs per Services ID, individuals 10.
  • Primary App ID (Sign in with Apple enabled) project · under Apple Developer Program membership
  • Services ID project · under Primary App ID (Sign in with Apple enabled)Used as client_id on the web.

Grouping related App IDs under one primary App ID means users consent once per group of apps and websites.

Users who hide their email get a private relay address; you can only email them from registered sources.

Have ready

  • apple/developer-program-org: Any paid membership works; an organisation membership gets higher URL and email-source limits.
  • The website domain(s) and exact HTTPS return URL(s) for your OAuth callback.
  • Access to DNS for your sending domain if you will email relay users (SPF/DKIM).
  • Account Holder or Admin access to the Apple Developer account. · Required to create keys and register email sources. [6]Needed for: Create a Sign in with Apple private key, Register outbound email sources for the private relay
  • Your production domain(s) and absolute return URLs, e.g. https://example.com/auth/callback/apple. · Each return URL must include scheme, host and path. [1]Needed for: Create and configure a Services ID
  • SPF (and ideally DKIM) records on the domain your transactional email is sent from. · Apple's private relay only delivers authenticated mail from registered sources. [5]Needed for: Register outbound email sources for the private relay

Steps

Steps marked “human step” are ones only you can do: verapli never signs in, submits, pays or accepts terms for you.

  1. Sign in to Certificates, Identifiers & Profiles

    Sign in to the Apple Developer account as Account Holder or Admin.

    • Guided by hand
    • Human step: You enter a 2-step code

    Where: https://developer.apple.com/account/resources

  2. Enable Sign in with Apple on a primary App ID

    Edit your app's App ID (or enable the capability in Xcode) and switch on Sign in with Apple as a primary App ID, or group it with an existing primary App ID for a related app.

    • Guided by hand
    • Human step: You press submit
    • After: Sign in to Certificates, Identifiers & Profiles

    Where: https://developer.apple.com/account/resources

  3. Create and configure a Services ID

    Identifiers > + > Services ID; enter a description and unique identifier (e.g. com.example.web). Select it, tick Sign in with Apple, click Configure, choose the primary App ID, and enter your domains, subdomains and return URLs as a comma-separated list. Save. No verification file upload is needed.

    • Guided by hand
    • Human step: You press submit
    • After: Enable Sign in with Apple on a primary App ID
    If something goes wrong (2)
    • Apple rejects the sign-in request with a client or redirect error.: Check the client_id is the Services ID (not the bundle ID unless signing in from the app) and that the return URL matches a registered one exactly, including path. [to verify] exact error strings. [1]
    • You hit the website URL limit.: Individuals can register 10 URLs per Services ID, organisations 100. Enrol as an organisation or consolidate callbacks. [2]

    Where: https://developer.apple.com/account/resources

  4. Create a Sign in with Apple private key

    Keys > +, name the key, tick Sign in with Apple, click Configure and choose the primary App ID. Confirm, then download the .p8 once and store it in your secret store. Each primary app can have at most two keys.

    • Guided by hand
    • Human step: You press submit
    • After: Enable Sign in with Apple on a primary App ID

    verapli captures APPLE_SIGNIN_PRIVATE_KEY here by plain code: encrypted in your browser, never shown to AI.

    If something goes wrong (1)
    • The Download button is disabled and you have lost the file.: Create a second key (two allowed per primary app), move your server to it, then revoke the old key. [1]

    Where: https://developer.apple.com/account/resources

  5. Generate the client secret (JWT) on your server

    Sign an ES256 JWT with kid = Key ID, iss = Team ID, iat = now, exp up to six months ahead, aud = https://appleid.apple.com, sub = the Services ID (case-sensitive). Send it as client_secret. Many auth libraries generate it for you from the key; otherwise put a reminder to regenerate it.

    • Guided by hand
    • After: Create a Sign in with Apple private key, Create and configure a Services ID
    If something goes wrong (2)
    • Token requests start failing after months of working.: The client secret's exp has passed (maximum six months). Generate a new JWT; automate rotation. [3]
    • Client secret rejected immediately.: Check sub exactly matches the Services ID (case-sensitive), iss is the Team ID, kid is the key's ID and exp is not more than 15777000 seconds ahead. [3]

  6. Register outbound email sources for the private relayoptional

    Services > Sign in with Apple for Email Communication > Configure. Add your sending domains or exact addresses; the table shows whether each passed SPF. Make sure the envelope sender domain passes SPF or the mail is DKIM-signed for the From domain.

    • Guided by hand
    • Human step: You press submit
    • After: Sign in to Certificates, Identifiers & Profiles
    If something goes wrong (1)
    • Emails to users' private relay addresses bounce.: Register every sending domain or address and authenticate it with SPF and/or DKIM matching the registered domain exactly. [5]

    Where: https://developer.apple.com/account/resources

  7. Register a server-to-server notification endpointoptional

    Edit the App ID and add one HTTPS (TLS 1.2+) endpoint to hear when users change email forwarding or delete their Apple Account.

    • Guided by hand
    • Human step: You press submit
    • After: Enable Sign in with Apple on a primary App ID

Terms and gotchas

Plain-English summary, not legal advice. Each card links its source.

Can cost moneyThe rules say

Apple's docs say web use needs an App Store app

Apple's configuration guide states that for users to authenticate with your web service you must have an existing app in the App Store that uses Sign in with Apple, and the Services ID must be tied to a primary App ID. "[to verify] whether a published app is enforced for web-only use." [1]

Can cost moneyThe rules say

Third-party login in an iOS app needs an equivalent option

Apps that use Google, Facebook, X or similar login for the primary account must also offer an equivalent login that limits data to name and email, lets users hide their email, and does not track for ads without consent - Sign in with Apple qualifies. Exceptions exist (own accounts only, enterprise/education, eID). [7]

Can cost moneyThe rules say

Account deletion

If your app supports account creation it must offer account deletion within the app. [7]

Can get you bannedThe rules say

Never share the private key

Never share private keys outside your developer team. If one is compromised, create a new key, switch over, then revoke the old one. [1]

What you end up with

Env varSecretFormatWhat it is
APPLE_SIGNIN_CLIENT_IDnot secretcom.example.webThe Services ID used as OAuth client_id on the web.
APPLE_SIGNIN_KEY_IDnot secretABC123DEFG10-character Key ID of the Sign in with Apple private key (JWT kid).
APPLE_SIGNIN_PRIVATE_KEYsecretcontents of AuthKey_<KEY_ID>.p8The .p8 private key used to sign client secrets. Secret.

Renewals

  • Client secret JWT (exp no more than six months ahead): every 6 months [3]

Pricing

  • No separate price stated; requires an Apple Developer Program membership.

Source [1]

For agents

The same entry as JSON: /api/v1/entries/apple/sign-in-with-apple · requirements /api/v1/requirements/apple/sign-in-with-apple · terms /api/v1/terms/apple/sign-in-with-apple.

Remote MCP (read-only, no auth)
claude mcp add --transport http verapli https://verapli.com/mcp

> "What do I need for Sign in with Apple (web and non-Apple platforms), and how long will it take?"
  → tools/call requirements { "provider_id": "apple/sign-in-with-apple" }

Sources

  1. Configuring your environment for Sign in with Apple Associate a Sign in with Apple-enabled primary App ID with a Services ID and private key; "you must have an existing app in the App Store that uses Sign in with Apple" for web authentication; primary vs grouped App IDs; register and verify all domains and subdomains; organisations up to 100 website URLs, individuals 10; return URLs absolute with scheme, host and path; max two private keys per primary app; rotate compromised keys; email sources (100 org / 32 individual) with SPF and/or DKIM; server-to-server notification endpoint (TLS 1.2+, one per app group). · accessed 25 October 2026 · official
  2. Configure Sign in with Apple for the web - Apple Developer Help Services ID creation steps; associate with a primary App ID; at least one domain or subdomain; no file upload needed to register domains; removing the association affects services. · accessed 25 October 2026 · official
  3. Creating a client secret Client secret JWT fields - ES256 (P-256, SHA-256), kid, iss = Team ID, iat, exp no more than 15777000 seconds (six months) ahead, aud https://appleid.apple.com, sub = App ID or Services ID (case-sensitive). · accessed 25 October 2026 · official
  4. Generate and validate tokens - Sign in with Apple REST API client_id is the App ID or Services ID; client_secret is the developer-generated JWT. · accessed 25 October 2026 · official
  5. Configure private email relay service - Apple Developer Help Register email domains or addresses; SPF check shown; SPF and/or DKIM required, envelope sender or DKIM d= must match the registered domain; unregistered sources bounce; required role Account Holder or Admin. · accessed 25 October 2026 · official
  6. Create a private key - Keys - Account - Help - Apple Developer Keys are created under Certificates, Identifiers & Profiles > Keys; saved as .p8; one download only; required role Account Holder or Admin. · accessed 25 October 2026 · official
  7. App Review Guidelines - Apple Developer 4.8 Login Services (apps using third-party login must offer an equivalent privacy-preserving option, with exceptions); 5.1.1(v) apps that support account creation must offer account deletion in the app. · accessed 25 October 2026 · official
  8. Apple Developer Program License Agreement You must safeguard keys and tokens associated with your developer account. · accessed 25 October 2026 · official

Provider rules change. This page is generated from verapli registry version 2026.1025.316; spotted something out of date? Tell us. Apple is not affiliated with verapli.