Apple

The Apple factor requires a client ID and client secret, which is specific to your Apple developer account and application within the Apple Developer Portal.

How to register the application with Apple, retrieve client ID and create the client secret (JWT) is documented here:

• https://developer.apple.com/sign-in-with-apple/get-started/

• https://developer.apple.com/documentation/sign_in_with_apple/generate_and_validate_tokens

In order to set up Sign In With Apple for your users, you need to be a member of Apple's Developer Program. Once you have access to the platform:

Create an App ID Identifier: the identifier can be freely chosen, the io.quasr.app (as visible in the screenshot) is only an example and actually cannot be used by anybody else anymore.

In the detail settings of this App ID identifier, make note of the "App ID Prefix" (Team ID), which you will need later.

In the list of Capabilities, enable Push Notifications and Sign In With Apple. Make "Sign in with Apple" the primary App ID.

Back in the Identifiers overview, select "Service IDs" in the drop down in the top-right, then create a new one. The identifier can be freely chosen, the io.quasr.login (as visible in the screenshot) is only an example and actually cannot be used by anybody else anymore.

Going into the detail settings of this identifier, make sure that "Sign In With Apple" is enabled. Then click "Configure".

In the upcoming dialog, click the "+" icon to add a website URL (redirect URL):

Enter the following (make sure to replace {tenant_id} with your own tenant ID):

• Domains and Subdomains: {tenant_id}.api.quasr.io

• Return URLs: https://{tenant_id}.api.quasr.io/factors/oauth2/callback

Back in the Apple Developer main menu, go to the "Keys" section. Create a new key.

Provide a Key Name, make sure that "APNs" and "Sign in With Apple" is enabled.

Once the key is created, make note of the Key ID (kid), and download the key.

The Apple Developer docs describe how to create the client secret, however it's a bit cumbersome to find the detailed instructions if you are new to this. The following Node.js script creates a client secret JWT based on the previously downloaded key.

const fs = require('fs')
const jwt = require('jsonwebtoken')

function createClientSecret() {
  const privateKey = fs.readFileSync('./AuthKey_<kid>.p8').toString()
  const jwtToken = jwt.sign(
    {},
    privateKey,
    {
      algorithm: 'ES256',
      expiresIn: '180d', // 180d is maximum possible, otherwise token endpoint fails with 400 error
      issuer: '<your_team_id>', // your Team ID
      audience: 'https://appleid.apple.com',
      subject: '<your_client_id>', // your Client ID
      header: {
        alg: 'ES256',
        kid: '<kid>', // the Key ID (kid)
        typ: 'JWT',
      },
    }
  )
  console.log(jwtToken)
}

createClientSecret()

Finally you can configure the client ID and secret for the Apple factor as follows:

• Client ID = service ID (in our case it is io.quasr.login)

• Client Secret = JWT as generated above