Reply to `invalid_grant` when exchanging authorization code obtained from `ASAuthorizationAppleIDCredential` on the server-side I think authorizationCode is valid for 5 minutes, so make sure you are calling Apple's endpoint to verify it within this period. App & System Services General Jan ’20