I want to enable "Sign-in with apple" in my application.

Apple sign-in

As you can see here App sends Token authorization code to the backend, and then backend needs to talk with Apple ID to verify the user.

This is the recommended way from iOS docs, but I noticed when the app calls the "Sign in with Apple" function it gets a JWT which is cryptographically signed by Apple, and it contains user email + user ID. (ASAuthorizationAppleIDCredential-> identityToken)

I can just validate Apple's signature, and decode the JWT and I KNOW the identity of the user handing over the token to me and I know that JWT is valid because apple's signature match.

My question is why do I need to deal with network requests + authorization codes, just to verify user's identity, when I can do it locally on my backend just with algorithms + Apple's public key.

I can see why this flow is good when I need to access apple API About the user later (let's say updating some info about them or adding something to their calendar) but just for sign-in, this feels like an overkill.


a useful link about validating the JWT: https://sarunw.com/posts/sign-in-with-apple-3/

  • wait, either you want to authenticate locally, or you can authenticate against Apples auth service. What you demand is a triangle with four edges. Jul 21, 2020 at 16:39
  • I mean, is there any advantage of either, or it's just preference? @MarcusMüller
    – EralpB
    Jul 21, 2020 at 16:45
  • I don't understand. Surely you have a reason to want to use apple signin in your application. That's literally the first sentence in your post... Jul 21, 2020 at 16:56
  • I agree with your question and I am interested to hear some opinions against this...
    – ceyquem
    Jan 24, 2021 at 4:05


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.