How the server can get the user's email reliably through Sign in with Apple?

It looks to be by design, for privacy & security reasons. You have a 600 second window on the identity token to cache it on the device and later push it up. Then subsequently cross-check the token with the identifier thats in that jwt's sub. But the flow is similar to what you'd do with Storekit verifications.

Otherwise, there doesn't look to be an easy way for the user to flush the authorization device-side.

Thanks for the answer.

It does make a lot of sense. But still couldn't solve the following case:

Scenario: What if during the initial authorization, the "client -> apple" request succeeded but "apple -> client" failed, meaning the initial token with email has been issued, but the client didn't get a chance to have it at the first place. Then nothing to cache and send back to our own server.

Any idea?

In advance, many thanks!

This is exactly an issue we're running into as well. Basically subsequent calls would not give you the email anymore and there's no way of retrieving that info if there's a failure on our server end during the callback.

Yes apps can cache that info but what about scenarios like a web browser signing in with incognito mode turned on? We need to be able to retrieve this info again and not just the first time only.

Apple please respond

So from a local perspective with your scenario - client->apple and apple->client are the same. There's no client token exchange to be done, so the auth and token flow occur in a single flow. The logic is fail-close, either the user auths against apple and gets an initial token or the auth fails and no initial token. Because of that aspect, you just need to implemnt logic to store and cache the identity token as soon as the auth flow finishes. I don't see a way for the flow to auth a client and *not* respond with the identity token.

With the identity token cached, have the user do a subsequent auth against your server wherein, presumably you've set up the server-side for Sign in with Apple, you can validate the identity of the user. Afterwards, it's just between your server and apple at that point.

Apple can probably solve this by giving you a 1 hour window after first auth to perform a re-auth to retrieve the email address. At the same time, if all this is intentional then I have to give praise. Way too many people are collecting user PII unnecessarily and abusing the user's right to privacy.