No results
Search failed
No results
Narrow your search with type:list, type:token, #tag…↑↓ to move · Enter to open · Esc to close

Set up "Sign in with Apple"

This is the full version of the wizard in the dashboard. It takes longer than the other providers, and it isn't free: Apple only offers Sign in with Apple to members of the Apple Developer Program, which costs $99 a year.

You'll copy four things from Apple into JSONPad — a Services ID, your team ID, a key ID and a .p8 private key file — and one URL from JSONPad into Apple.

If you haven't read it yet, signing in with Google, GitHub and others explains how the whole flow works.

Apple sends its result as a form post, which a page in your app can't read, so Apple sign-ins always come back through JSONPad's callback URL. That's the only mode the dashboard offers for Apple, and it means there's just one URL to register.

1. Create an App ID

  1. Sign in to the Apple Developer site and open Certificates, Identifiers & Profiles → Identifiers.
  2. Add an identifier of type App IDs, with a description and a bundle ID (e.g. com.example.app).
  3. Tick Sign in with Apple in its capabilities, and save.

An App ID is needed even for a website: it's what the Services ID in the next step is grouped under.

2. Create a Services ID

  1. Add another identifier, this time of type Services IDs, e.g. com.example.app.service. This is your client ID.
  2. Tick Sign in with Apple, then click Configure.
  3. Choose the App ID from step 1 as the primary, add your app's domain under Domains and Subdomains, and add this as a Return URL:

https://api.jsonpad.io/identities/oauth/callback

Apple won't accept localhost as a domain or a return URL, and it verifies every domain you add. Because sign-ins come back through JSONPad's callback URL, you don't need to add your own return pages here: add them as the identity group's redirect URLs instead, where localhost is fine.

3. Create a key

  1. Go to Keys and add a key with Sign in with Apple enabled, configured for the App ID from step 1.
  2. Download the .p8 file. Apple only lets you download it once, so keep it somewhere safe; if you lose it, revoke the key and make a new one.
  3. Note the Key ID shown next to the key, and your Team ID, in the top right of the developer site.

JSONPad uses the key to sign a short-lived client secret for each exchange with Apple (Apple doesn't issue a fixed client secret). The key is encrypted before it's stored, and is never returned by the API.

4. Paste everything into JSONPad

  1. Open your identity group in the dashboard, find Apple under Sign-in providers, and click Set up.
  2. Add the pages in your app that sign-ins return to, as the group's redirect URLs.
  3. Enter the Services ID, team ID and key ID, and choose the .p8 file (or paste its contents), then click Save and check. JSONPad checks that the key can sign a client secret. Unlike Google and GitHub, Apple only reports a wrong Services ID, team ID or key during a real sign-in, so the next step matters more here.
  4. Run a test sign-in with your own Apple account. It shows what Apple sent back, and creates nothing.
  5. Turn Apple on for the group with Enable.

5. Names and email addresses

Apple sends someone's name only the first time they agree to share it, and never again. JSONPad stores it as the identity's display name then. If you need a name later, ask for one in your app: it won't come from Apple.

People can hide their email address, and Apple gives you a private relay address (…@privaterelay.appleid.com) that forwards to them. JSONPad treats relay addresses as verified, because Apple has checked the address behind them. To send email to one, register your sending domain with Apple under Sign in with Apple for Email Communication, or your messages will bounce.

6. Going live

  • Add your production return page to the group's redirect URLs.
  • Keep the Apple Developer Program membership current. If it lapses, sign-ins stop working.
  • Apple's guidelines require apps that offer other third-party sign-ins to offer Sign in with Apple too, if they're distributed on the App Store.

Troubleshooting

  • invalid_clientApple rejected the Services ID, team ID, key ID or key. Check that the Services ID is the identifier (not the description), that the key has Sign in with Apple enabled, and that the key hasn't been revoked.
  • invalid_grantThe code expired or was already used (they last five minutes), or the return URL didn't match the one registered on the Services ID.
  • invalid_request: redirect_uriThe Return URL on your Services ID isn't https://api.jsonpad.io/identities/oauth/callback, exactly. Apple also refuses http and localhost.
  • The private key couldn't be usedThe .p8 file wasn't uploaded as it was. Paste the whole file, including the -----BEGIN PRIVATE KEY----- lines.
  • No name on the identityExpected on every sign-in after the first. To see it again for your own account, remove the app under Apple ID → Sign in with Apple and sign in again.
2026-09-17