Apple

This guide walks you through configuring Apple as a social login provider for your application.

Prerequisites

An Apple Developer account
An App ID registered for your application

Configure Apple OAuth

If you don’t already have an App ID for your application:

Go to the Apple Developer Portal
Click Identifiers > + to register a new identifier
Select App IDs and click Continue
Select App as the type and click Continue
Enter a description and a Bundle ID (e.g. com.yourapp)
Under Capabilities, enable Sign in with Apple
Click Register

Create a Services ID

The Services ID is used as the client_id when configuring the OAuth provider.

Go to the Apple Developer Portal
Click Identifiers > + to register a new identifier
Select Services IDs and click Continue
Enter a description (e.g. “Prelude Auth”) and an identifier (e.g. com.yourapp.session) — this identifier will be your client_id
Click Register

Configure Sign in with Apple

Click on the newly created Services ID
Enable Sign in with Apple and click Configure
Select the App ID you created in the first step as the Primary App ID
Under Domains and Subdomains, add your custom domain (e.g. session.yourapp.com)
Under Return URLs, add:

https://${YOUR_CUSTOM_DOMAIN}/v1/session/login/oauth/apple/callback

Replace ${YOUR_CUSTOM_DOMAIN} with your custom domain.

Click Save and then Continue > Register

The return URL must match exactly. Make sure there is no trailing slash and that you are using https.

Create a private key

Apple does not provide a client secret directly. Instead, you create a private key that Prelude uses to generate the client secret automatically.

Go to Keys in the Apple Developer Portal
Click + to create a new key
Give it a name and enable Sign in with Apple
Click Configure and select the App ID you created in the first step
Click Save, then Continue, then Register
Download the .p8 private key file — you can only download it once
Note the Key ID displayed on the page — you will need it in the next step

Create the Apple OAuth configuration

curl -X POST https://api.prelude.dev/v2/session/apps/${APP_ID}/config/login/oauth/apple \
  -H "Authorization: Bearer ${MANAGEMENT_API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{
    "client_id": "com.yourapp.session",
    "enabled": true,
    "options": {
      "use_email_as_identifier": true,
      "allow_email_account_merge": true
    },
    "apple": {
      "team_id": "YOUR_TEAM_ID",
      "key_id": "YOUR_KEY_ID",
      "p8_key": "-----BEGIN PRIVATE KEY-----\n...\n-----END PRIVATE KEY-----"
    }
  }'

Field	Description
`client_id`	The identifier of your Services ID (e.g. `com.yourapp.session`). This is the identifier you chose when creating the Services ID, not the App ID.
`enabled`	Set to `true` to enable Apple login.
`apple.team_id`	Your Apple Developer Team ID (found in the top-right of the Apple Developer Portal).
`apple.key_id`	The Key ID of the private key you created.
`apple.p8_key`	The contents of the `.p8` private key file. Each line break must be replaced by `\n` so the entire key is a single-line string (e.g. `"-----BEGIN PRIVATE KEY-----\nMIGT....\n-----END PRIVATE KEY-----"`). Prelude uses this to generate the client secret automatically.
`options.use_email_as_identifier`	When `true`, the user’s Apple email is stored as an email identifier.
`options.allow_email_account_merge`	When `true`, if a user with the same email already exists, the Apple account is linked to the existing user.

Update the configuration

To update an existing Apple OAuth configuration:

curl -X PUT https://api.prelude.dev/v2/session/apps/${APP_ID}/config/login/oauth/apple \
  -H "Authorization: Bearer ${MANAGEMENT_API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{
    "client_id": "com.yourapp.session",
    "enabled": true,
    "options": {
      "use_email_as_identifier": true,
      "allow_email_account_merge": true
    },
    "apple": {
      "team_id": "YOUR_TEAM_ID",
      "key_id": "YOUR_KEY_ID",
      "p8_key": "-----BEGIN PRIVATE KEY-----\n...\n-----END PRIVATE KEY-----"
    }
  }'

Delete the configuration

To remove Apple OAuth from your application:

curl -X DELETE https://api.prelude.dev/v2/session/apps/${APP_ID}/config/login/oauth/apple \
  -H "Authorization: Bearer ${MANAGEMENT_API_KEY}"

What’s next?

Now that Apple OAuth is configured on your backend, integrate the frontend using the Web Integration guide.

Documentation

API Reference

Prerequisites

Configure Apple OAuth

Update the configuration

Delete the configuration

What’s next?

​Prerequisites

​Configure Apple OAuth

​Update the configuration

​Delete the configuration

​What’s next?

Prerequisites

Configure Apple OAuth

Update the configuration

Delete the configuration

What’s next?