apple

Sign in with Apple, web flow. Only the email scope is requested; Apple access and refresh tokens are never stored or returned.

Apple differs from the other providers in two ways. The client proves itself with a short-lived ES256 JWT signed by the developer’s key, made afresh for each exchange, instead of a shared secret. And any scope makes Apple answer with a cross-site POST (response_mode=form_post), which the provider routes turn into the ordinary callback GET.

Values

new

</>

pub fn new(
  client_id client_id: String,
  team_id team_id: String,
  key_id key_id: String,
  private_key private_key: String,
) -> provider.Provider

client_id is the Services ID (not the app’s bundle ID), team_id the ten-character Apple developer team, key_id the identifier of a key with Sign in with Apple enabled, and private_key the contents of its .p8 download: a PEM-encoded P-256 key. Keep the key wherever other secrets live.