Skip to content
Enterprise OIDC

Sign in with Apple.
Done right.

Apple is the only social provider that uses a JWT signed with an ES256 elliptic-curve key as its `client_secret`, refreshed every six months. Most libraries get this wrong on the first deploy. Synq mints the JWT correctly on every request, so you ship the sign-in button the App Store requires and never see a token error.

Why it matters

The App Store doesn’t make this optional

Apple's App Review Guideline 4.8 requires Sign in with Apple as an option for any iOS app that ships another social login. Skipping it is the most common reason an otherwise-ready release gets rejected. Synq handles the part most libraries stub or fake — minting a short-lived ES256 JWT as the client_secret on each token exchange, signed with your Apple developer team's private key.

client_secret
ES256 JWT
Minted by Synq, never expires from your code
Key rotation
Apple-required
Every 6 months, swap in the Dashboard
Email relay
Handled
Apple’s hide-my-email forwards transparently

Same SDK call, the hard part hidden

From your code's perspective Apple is no different from Google. Synq does the ES256 JWT minting on every token exchange — you never touch it.

import { SynqProvider, useSynq } from '@synqid/react'
import { SignIn } from '@synqid/react/ui'

export default function App() {
  return (
    <SynqProvider
      issuer="https://api.synq.id"
      clientId={import.meta.env.VITE_SYNQ_CLIENT_ID}
      redirectUri={`${window.location.origin}/auth/callback`}
      theme="dark"
    >
      <Home />
      <SignIn />
    </SynqProvider>
  )
}

function Home() {
  const { signIn } = useSynq()
  return (
    <button onClick={() => signIn({ provider: 'apple' })}>
      Continue with Apple
    </button>
  )
}

Get it live

Most of the work happens in the Apple Developer portal. The Synq side is a single screen.

  1. Register a Services ID

    In Apple’s developer portal, create a Services ID (this is Apple’s name for an OAuth client). Configure Sign in with Apple and add Synq’s callback URL as a return URL.
  2. Create a Sign In with Apple key

    Generate a private key under Keys → Sign in with Apple. Apple gives you a .p8 file once — download and store it safely. You also get a 10-character Key ID.
  3. Note your Team ID and Services ID

    Both are visible in the Apple developer portal. You will need all four: Team ID, Services ID, Key ID, and the .p8 private key file.
  4. Paste into Synq

    In Brand → Connections → Apple, upload the .p8 file and fill the three IDs. Synq encrypts the private key at rest and uses it to mint the ES256 JWT client_secret on every exchange.
  5. Test the sign-in

    Trigger Apple sign-in from your app. Apple shows the consent screen with your brand. After authorization, Synq exchanges the code for tokens — the JWT minting happens server-side, transparently.

How Apple support compares

Every mainstream identity platform claims Apple support. The differences are in how the ES256 secret is minted and how key rotation is handled.

FeatureClerkWorkOSAuth0Synq
Apple sign-in shipped
ES256 JWT minted server-side per request
BYO private key (your Apple team)
Email-relay verification handled
Key rotation UI in dashboardManual
Per-brand isolated Apple credentialsPer appPer tenantPer tenant

Pair it with

Common questions

Pass App Review on the first try.

Apple’s sign-in is the most common reason iOS releases get rejected. Wire it through Synq and the most error-prone part — JWT secret minting — is handled.