Thank you! I'm actually doing the same exact thing, and getting the same error. Good point on bundle id vs secret id. I firgured that if yo udon't support Sign In with Apple on web or Android, you don't even need service id, since ASAuthorization uses bundle id. You also don't need to worry about whitelisting domains and uploading txt files, am I right? I am still experiencing the same invalid_token error though. My JWK has the right info, my key ID is correct, I am using a file I downloaded from Apple. I wish there was a debugging tool or some more explicit error code 😟

i think here you need to use bundle id, not service id.

Same thing... This is so frustrating! Or do you try to verify using every single key in a loop?