Sign in with Apple

Your app can let people sign in with the Apple Account they already use on their iPhone or Mac. It takes about fifteen minutes, and it is a one-time setup.

You need a paid Apple Developer Program membership. A free Apple Account is not enough — Apple only lets members register the identifiers and keys this needs.

Like Sign in with Google, it is an exchange between two places: Apple needs to know which website is asking and where to send people back to; Sapilon needs the key Apple gives you in return.

Turn it on

Open Explorer → Authentication, choose the Apple tab and tick Sign in with Apple. The setup steps appear right underneath, with two values at the top:

• Domains and Subdomains — your app’s sign-in address, without https://.
• Return URLs — where Apple sends people back to after they approve.

If they are not shown yet, your project does not have a web address so far — publish to a server first, then come back. If you moved sign-in to your own web address, or your project has a Rehearsal Server of its own (which signs people in at its own address), each value lists every address separated by a comma; Apple’s boxes take them that way.

Set it up at Apple

Everything happens in Certificates, Identifiers & Profiles in your Apple Developer account.

1. Note your Team ID. It is the ten-character code at the top right of the page, beside your team’s name.
2. Under Identifiers → App IDs, pick an App ID (or register one) and tick Sign in with Apple. If you also have an iPhone app, use its App ID, so people see one app at Apple.
3. Under Identifiers → Services IDs, register a new one. The identifier is usually your App ID with .web on the end — for example com.yourcompany.yourapp.web. The description is the name people see when they sign in, so use your app’s real name.
4. Open the new Services ID, tick Sign in with Apple and click Configure. Choose the App ID from step 2 as the primary App ID, paste the two values Sapilon showed you into Domains and Subdomains and Return URLs, and save.
5. Under Keys, register a new key, tick Sign in with Apple and configure it with the same App ID. Apple then offers the key as a .p8 file — download it. Apple lets you download it only once, so keep it somewhere safe. The Key ID is shown beside the key.

Give it to Sapilon

Back on the Authentication page, fill in the Services ID, Team ID and Key ID, choose the .p8 file under Private key, and click Save. (If the file still has Apple’s name, AuthKey_<Key ID>.p8, Sapilon fills in the Key ID for you.)

The private key is stored encrypted and is never shown again. Unlike Google, there is no secret that expires: Apple’s sign-in needs a fresh, short-lived secret every time, and your app’s sign-in service makes it from the key on its own. Replace swaps in a new key; Remove deletes all four values.

Publish

Nothing changes on your live app until you publish. The Apple button is added to your sign-in screen as part of publishing. If Sign in with Apple is on but its key is missing, publishing stops and tells you so.

Pressing Apply on the Authentication page only saves the setting. The Publish page then lists it under What’s new for each server that doesn’t have it yet, and lets you publish even if nothing else in your app changed. Publish to Rehearsal and Live separately.

Questions people ask

Some users show up with an address like abc123@privaterelay.appleid.com. That is Apple’s Hide My Email: the person chose not to share their real address, and Apple forwards mail from that relay to them. If your app sends email, register the domain it sends from under Sign in with Apple for Email Communication in your Apple Developer account, or Apple will not pass your messages on.

Their name is missing. Apple shares a person’s name only the very first time they sign in to your app. Sapilon’s sign-in keeps it from then on; if someone removed your app from their Apple Account and came back, they can edit their name in your app.

Do I need a separate setup for the Rehearsal and Live servers? No. One Services ID covers both — the values Sapilon shows already include a Rehearsal Server’s own address.

Someone signed in with Apple — which group are they in? The default group you picked under Groups on the same page, exactly as if they had signed up with an email address.