Apple ID Authentication

Add Sign-in With Apple to Your App

Your app must have the Sign-in with Apple entitlement in order to use this capability.

1. Select your app target in Xcode.

2. Go to the Signing & Capabilities tab, and select + Capability.

3. Search for the Sign in with Apple capability, and select it.

Then, confirm it is enabled in the Apple Developer Portal.

1. Navigate to the Certificates, Identifiers and Profiles page of the Apple Developer Portal.

2. Select the identifier for your app from the dropdown. This takes you to your App ID Configuration pane.

3. Scroll down until you see the checkbox for Sign In with Apple. If that checkbox is not selected, select it. If you've made changes, press the Save button.

Note the Bundle ID of your app. You need the Bundle ID when you create a client secret and when you configure Sign in with Apple in App Services.

Create a Private Key

The client secret for Sign in with Apple is a JSON Web Token that you create and sign with a private key. You need to generate the private key through the Apple Developer Portal.

1. Click Keys in the left navigation menu.

2. Click the blue plus icon next to Keys.

3. On the Register a New Key page, enter a descriptive Key Name and then scroll down to find the Sign in with Apple row. Check the checkbox to enable Sign in with Apple and then click Configure.

4. On the Configure Key page, select the App ID for your app as the Primary App ID and then click Save.

5. Click Continue to review your key configuration. When you're sure that you've configured the key correctly, click Register.

6. Copy the Key ID value somewhere that you can access it later and then click Download to download the key as a .p8 text file. You will use these to generate the client secret.

   Important

   Save the Key

   You can only download the key one time. Make sure that you save the key somewhere safe in case you need it again. If you lose the key, you will need to generate a new one.

Create the Client Secret JWT

You can now create the client secret JWT for the Apple ID authentication provider. Make sure that you have the following information:

• The Bundle ID of your app. You'll use this as the client_id in the script below.

• The Key ID of the key that you created and the .p8 file that contains the key.

• Your Apple Team ID. You can find this in the top right of the Apple Developer Portal.

Once you've confirmed that you have all the required information, you can use a script to generate the JWT. You may define your own script or use the script in this step.

To generate the JWT, we'll use the jwt gem. To install it, run the following:

gem install jwt

Create a new file called generate_client_secret.rb and copy the following code block into the file.

# Source: https://developer.okta.com/blog/2019/06/04/what-the-heck-is-sign-in-with-apple
require 'jwt'
# Update these values with your app's information
team_id = '<Apple Team ID>'
client_id = '<Bundle ID or Services ID>'
key_id = '<Apple Key ID>'
key_file = '<Key File Path>'
# Define the JWT's headers and claims
headers = {
  # The token must be signed with your key
  'kid' => key_id
}
claims = {
  # The token is issued by your Apple team
  'iss' => team_id,
  # The token applies to Apple ID authentication
  'aud' => 'https://appleid.apple.com',
  # The token is scoped to your application
  'sub' => client_id,
  # The token is valid immediately
  'iat' => Time.now.to_i,
  # The token expires in 6 months (maximum allowed)
  'exp' => Time.now.to_i + 86400*180,
}
# Read in the key and generate the JWT
ecdsa_key = OpenSSL::PKey::EC.new IO.read key_file
token = JWT.encode claims, ecdsa_key, 'ES256', headers
# Print the JWT to stdout
puts token

Update the values of team_id, client_id, key_id, and key_file to match your application's information and then save the file. When you're ready to generate the JWT, run the script in your shell:

ruby generate_client_secret.rb >> client_secret.txt

Configure the Provider in App Services

At this point you have configured an Apple application and generated the required OAuth 2.0 credentials. You can now configure the Apple ID authentication provider with the credentials to allow App Services client application users to log in.

{
  "oauth2-apple": {
     "name": "oauth2-apple",
     "type": "oauth2-apple",
     "disabled": <boolean>,
     "config": {
        "clientId": "<Bundle ID>"
     },
     "secret_config": {
        "clientSecret": "<Secret Name>"
     },
     "redirect_uris": ["<string>", ...]
  }
}

appservices push

git add ./auth/providers.json
git commit -m "Configure and Enable Apple ID Authentication"
git push origin <branch name>

Create an App ID

An Apple App ID represents your application and allows you to access services like Sign in with Apple. To configure the Apple ID provider, you must create a new App ID.

1. Navigate to the Certificates, Identifiers and Profiles page of the Apple Developer Portal.

2. Click Identifiers in the left navigation menu.

3. Click the blue plus icon next to Identifiers.

4. On the Register a New Identifier page, select App IDs and then click Continue.

5. On the Register an App ID page, select the Platform that your app runs on and then enter a brief Description and a reverse-dns notation Bundle ID.

6. Scroll down the Register an App ID page until you see the Sign in with Apple capability. Check the checkbox to enable the capability.

7. Press the Continue button at the top of the page. Complete any other setup steps that apply to your app, and then press the Register button.

Create a Services ID

An Apple Services ID represents a single application and allows you to configure an authorization callback URL and define a private key for the application.

1. Click Identifiers in the left navigation menu.

2. Click the blue plus icon next to Identifiers.

3. On the Register a New Identifier page, select Services IDs and then click Continue.

4. On the Register a Services ID page, enter a brief Description and a reverse-dns notation Identifier.

   Important

   Save the Identifier

   The Identifier value of the Services ID is your application's Client ID. You will need this value later to configure the Apple ID provider in Atlas App Services.

   Press the Continue button. Confirm the details, and then press Register.

5. Click into the service you just created. Check the checkbox to enable Sign in with Apple and then click Configure. Select the App ID that you created as the Primary App ID.

6. Enter your domains, subdomains, and return URLs for the Services ID. Press the Next button.

7. Click Continue and then click Save. Confirm that you have correctly configured the Services ID and then click Register.

Create a Private Key

The client secret for Sign in with Apple is a JSON Web Token that you create and sign with a private key. You need to generate the private key through the Apple Developer Portal.

1. Click Keys in the left navigation menu.

2. Click the blue plus icon next to Keys.

3. On the Register a New Key page, enter a descriptive Key Name and then scroll down to find the Sign in with Apple row. Check the checkbox to enable Sign in with Apple and then click Configure.

4. On the Configure Key page, select the App ID that you created as the Primary App ID and then click Save.

   

5. Click Continue to review your key configuration. When you're sure that you've configured the key correctly, click Register.

6. Copy the Key ID value somewhere that you can access it later and then click Download to download the key as a .p8 text file. You will use these to generate the client secret.

   Important

   Save the Key

   You can only download the key one time. Make sure that you save the key somewhere safe in case you need it again. If you lose the key, you will need to generate a new one.

Create the Client Secret JWT

You can now create the client secret JWT for the Apple ID authentication provider. Make sure that you have the following information:

• The Services ID that you created. You'll use this as the client_id in the script below.

• The Key ID of the key that you created and the .p8

  file that contains the key.

• Your Apple Team ID. You can find this in the top right of the Apple

  Developer Portal.

Once you've confirmed that you have all the required information, you can use a script to generate the JWT. You may define your own script or use the script in this step.

To generate the JWT, we'll use the jwt gem. To install it, run the following:

gem install jwt

Create a new file called generate_client_secret.rb and copy the following code block into the file.

# Source: https://developer.okta.com/blog/2019/06/04/what-the-heck-is-sign-in-with-apple
require 'jwt'
# Update these values with your app's information
team_id = '<Apple Team ID>'
client_id = '<Bundle ID or Services ID>'
key_id = '<Apple Key ID>'
key_file = '<Key File Path>'
# Define the JWT's headers and claims
headers = {
  # The token must be signed with your key
  'kid' => key_id
}
claims = {
  # The token is issued by your Apple team
  'iss' => team_id,
  # The token applies to Apple ID authentication
  'aud' => 'https://appleid.apple.com',
  # The token is scoped to your application
  'sub' => client_id,
  # The token is valid immediately
  'iat' => Time.now.to_i,
  # The token expires in 6 months (maximum allowed)
  'exp' => Time.now.to_i + 86400*180,
}
# Read in the key and generate the JWT
ecdsa_key = OpenSSL::PKey::EC.new IO.read key_file
token = JWT.encode claims, ecdsa_key, 'ES256', headers
# Print the JWT to stdout
puts token

Update the values of team_id, client_id, key_id, and key_file to match your application's information and then save the file. When you're ready to generate the JWT, run the script in your shell:

ruby generate_client_secret.rb >> client_secret.txt

Configure the Provider in App Services

At this point you have configured an Apple application and generated the required OAuth 2.0 credentials. You can now configure the Apple ID authentication provider with the credentials to allow App Services client application users to log in.

{
  "oauth2-apple": {
     "name": "oauth2-apple",
     "type": "oauth2-apple",
     "disabled": <boolean>,
     "config": {
        "clientId": "<Apple Services ID>"
     },
     "secret_config": {
        "clientSecret": "<Secret Name>"
     },
     "redirect_uris": ["<string>", ...]
  }
}

appservices push

git add ./auth/providers.json
git commit -m "Configure and Enable Apple ID Authentication"
git push origin <branch name>