Sign in with Apple

1Set it up in the Console#

Open Abrova Auth › Sign-in methods, turn on Apple, and enter your identifiers:

Abrova Auth accepts an Apple ID token only when it was issued to one of these identifiers. A token Apple issued for any other app is refused.

Account deletion key (recommended)

Apple asks apps to revoke a user's Sign in with Apple when the user deletes their account. To let Abrova Auth do that, create a Sign in with Apple key in the Apple Developer portal (Certificates, Identifiers & Profiles › Keys) and enter, in the same Apple section:

Then pass Apple's authorizationCode when the user signs in (the SDKs show where). Abrova Auth redeems the code when the user first signs up with Apple (or links Apple), so add the key before you launch: users who signed up before the key was saved cannot have their Apple sign-in revoked. Without the key or the code, account deletion still deletes the user; only the Apple-side revocation is skipped.

2The nonce#

A nonce ties Apple's ID token to this one sign-in, so a captured token cannot be used again:

1. Create a random raw nonce with the SDK's helper (16 to 256 characters).
2. Give Apple the lowercase hex SHA-256 of it.
3. Give Abrova Auth the raw value.

Abrova Auth checks that they match and accepts each nonce once. Apple's ID token must also be less than 10 minutes old.

3Sign in#

iOS: the SDK runs Apple's sheet

Add the Sign in with Apple capability to your app target, then:

try await AbrovaAuth.shared.signInWithAppleNative()

The SDK creates the nonce, shows Apple's sheet, and passes the ID token, the authorization code and the name Apple shares on the first sign-in. It throws .canceled when the user closes the sheet.

Flutter

With the sign_in_with_apple package:

final raw = AbrovaAuthNonce.generate();

final apple = await SignInWithApple.getAppleIDCredential(
  scopes: [AppleIDAuthorizationScopes.email, AppleIDAuthorizationScopes.fullName],
  nonce: AbrovaAuthNonce.sha256Hex(raw),
);

await AbrovaAuth.instance.signInWithApple(
  idToken: apple.identityToken!,
  rawNonce: raw,
  authorizationCode: apple.authorizationCode, // lets account deletion revoke Apple
  name: [apple.givenName, apple.familyName].whereType<String>().join(' '),
);

Android

Run Apple's web sign-in with your Services ID and AbrovaNonce.sha256(rawNonce) as the nonce, then pass the id_token and code Apple returns:

AbrovaAuth.shared.signInWithApple(idToken, rawNonce, authorizationCode = code)

Web and React Native

Use Sign in with Apple JS (web) or your React Native Apple sign-in library with hashedNonce as the nonce:

const { rawNonce, hashedNonce } = await auth.createNonce();
// ... run Apple's sign-in with nonce: hashedNonce, then:
await auth.signInWithApple({ idToken, rawNonce, authorizationCode, name });

Name and e-mail#

Apple shares the user's name only on the first sign-in, and the e-mail may be a private relay address. Abrova Auth stores them (encrypted) only when Store profile data is on under Abrova Auth › Settings. If your app needs the name, save it in your own data on the first sign-in.

Link Apple to a signed-in user#

To upgrade an anonymous user, use the link call with the same arguments: linkApple(...), or on iOS signInWithAppleNative(link: true). The user keeps their id. If this Apple ID already belongs to another user, the call fails with PROVIDER_ALREADY_LINKED.

Errors#