We've had Signin with Apple integrated & working since 2020. Recently we've started seeing invalid_request errors in token validation API when we submitted our app for review. However, we are unable to reproduce this issue when testing it on the TestFlight build (occurring only on the App Review team's device). We've also tested on a device with similar specs and failed to reproduce the issue.
App Review device details:
Device type: iPad Air (5th generation)
OS version: iOS 17.4.1
Here's a sample of the validation request.
url = "https://appleid.apple.com/auth/token"
headers = { "content-type": "application/x-www-form-urlencoded" }
body = {
"client_secret": "generated_jwt_token",
"code": code generated in the app,
"client_id": bundle id of the app,
"grant_type": "authorization_code"
}
We are not adding redirect_uri in body since we don't use Apple signin on web.
We generate the client_secret with the private key from Keys in Apple developer dashboard and use the following header & payload.
header = {
"alg": "ES256",
"typ": "JWT",
"kid": key id
}
payload = {
"iss": team id,
"iat": current timestamp in seconds ,
"exp": current timestamp + 180 days,
"aud": "https://appleid.apple.com",
"sub": bundle id of the app (same as client_id above)
}
The only error description we get is invalid_request which does not help find the root cause of the issue.
We haven't done any changes wrt to Apple sign-in in this build, the only change we have done is update all third-party SDKs and added the Privacy manifest file which I'm sure should not affect the Signin with Apple.