Initial test of the "Sign in with Apple" API:
* It's more or less based on OAuth + OIDC
* Their documentation is missing a lot of key info to use it right now, I had to guess at a lot of things
* The `sub` claim includes some sort of unique user identifier, not an email
Jun 3, 2019 · 9:21 PM UTC
4
20
65
weirdnesses:
* Their token endpoint requires setting a User-Agent header, otherwise responds with an HTML error
* Client secrets are a signed JWT using ECDSA + SHA256
* An email address isn't returned even when requesting the `email` scope
2
9
If you're interested, here is my sample code I was able to use to get an access token and ID token from Apple
github.com/aaronpk/sign-in-w…
1
9
28
