My auth request is https://appleid.apple.com/auth/authorize?client_id=com.***.yyy&redirect_uri=http://xyz.com&response_type=code%20id_token&scope=name%20email&response_mode=form_post but I am still only getting the user information at the first request. From then on, only the code and id_token is getting received.Another thing that confused me, that it seems like th API doesn't send the information as JSON data in the post, instead it is sending it, as if it was the addition to the query, for example: "code=<code>&id_token=<id_token>" usually. But when I request it the first time, so the user gets send with, it is like "code=<code>&id_token=<id_token>&user={"name":{"firstName":<firstName>,"lastName":<lastName>},"email":<strange String what isn't an email>}".As you can see, only the user is send as Json, and the email is not an email (eg: it was "wj92b" one time"), but this could be fixed by receiving it through the JWT in the id_token.I don't know how to fix it, I would really appreciate an answer.

Just as a fitting example: The 3CX-App seems to have its certificate publically available for the custom hosted servers too.