Download the PHP package currencyfair/apple-sign-in-php-client without Composer

Apple Sign-In PHP Client

Features Include:

• Generating an Apple authorisation link to use with your Sign-In button
• Verifying and decoding Apple JWTs
• Verifying Apple Authorisation Codes and exchanging them with Apple's API for access/refresh tokens
• Automatic fetching of Apple's public keys and generating of client secrets.

Contents

• Installation
• Configuration
• Usage & Examples
  • Verify Auth Code & Fetching Access/Refresh Tokens
  • Verifying & Decoding Apple's JWTs
  • Generating an Authorisation URL for your Sign-In button
  • End-to-End Sign-In page & Return Page
• FAQ & Troubleshooting
• Useful Links

• License

  Installation

  Configuration

  Config Key	Description
  clientId	Also referred to as Service ID. This can be found here.
  privateKey	The is required to generate the Client Secret which is used to verify Authorisation Codes. You can pass a string or the path to the key file. The key can be created and downloaded here.
  keyId	The ID associated with the above privateKey. This should be available on the page where you downloaded your private key.
  teamId	This is usually found in the top right corner under your name in the Apple Developer area.
  redirectUri	This is the web page users will be redirect to after (un)successful sign-in. This address must be HTTPS and cannot be localhost. See FAQ for localhost workaround.
  defaultScopes	These are the scopes you would like returned from Apple. Apple only supports name and email.
  apiKeysEndpoint (optional)	URL containing Apple's public key in JWK format. Unless you have a reason to change this the default should be fine.
  apiTokenEndpoint (optional)	The endpoint used to verify Authorisation Codes. Unless you have a reason to change this the default should be fine.
  apiAuthEndpoint (optional)	The authorisation URL used to build the URL users will sign in on. Unless you have a reason to change this the default should be fine.

  See below for examples of passing config values.

Usage & Examples

Verifying an Authorisation Code and retrieving the access/refresh tokens

See AuthCodeVerifyResponse for all available methods.

Verifying and Decoding Apple JWTs

See JwtVerifyResponse for all available methods.

Example Decoded JWT

Generating an Authorisation URL for your Sign-In button

You can also use Apple's JS SDK to show Apple's pre-styled button. Using the above method is for when you would like more control over the style of the button.

End-to-End Sign-In page & Return Page

your-sign-in-page.php

your-return-page.php

FAQ & Troubleshooting

I'm developing on localhost, how do I get the redirect URI to work correctly?

Unfortunately even during testing Apple doesn't allow using localhost or non-HTTPS redirect URLs. To get around this you can use a browser extension like Requestly to intercept the redirect and direct it to your localhost URL. You can also use a secure tunneling tool like Ngrok.

I'm getting an invalid_request - Invalid redirect_uri error

This usually occurs if your Redirect URI isn't configured for use in the Apple Developer area. Or the URI may be localhost or non-HTTPS.

I'm getting an Invalid Grant error when verifying my Authorisation Code

This usually means your token is expired or malformed. Apple's tokens have a 10 minute expiry, after this you will need to generate a new token.

How do I get the user's name from Apple?

Apple will only send the user's name the first time the user registers on your app. The payload is POSTed to the Redirect URI along with the authorisation code and the JWT token. The format will look like this:

I would like the Sign-In to happen in a pop-up window

You can use Apple's JS SDK to achieve this.

I'm getting an Error processing private key error?

If you're passing the key as a string ensure the formatting is correct. An example of the correct way to pass the key:

Can the request to fetch Apple's public key be cached?

Yes, you can use Guzzle Middleware to handle caching. You can also inject your own cache enabled client which implements ClientInterface.

Useful links

https://developer.apple.com/documentation/sign_in_with_apple/sign_in_with_apple_js/configuring_your_webpage_for_sign_in_with_apple

https://developer.okta.com/blog/2019/06/04/what-the-heck-is-sign-in-with-apple

https://sarunw.com/posts/sign-in-with-apple-3

License

Developed by CurrencyFair (https://currencyfair.com) and licensed under the terms of the Apache License, Version 2.0.