How to add Sign in with Apple

What Sign in with Apple does for an iOS app

Sign in with Apple gives users a fast, private way to create an account. They tap one button, approve with Face ID, and can choose to hide their real email behind a private relay address. You receive a stable user identifier you can key your accounts on. If your app offers other social logins, guideline 4.8 requires you to also offer Sign in with Apple or an equivalent, so it is often not optional.

Adding it with AppFlight, and manually

In AppFlight you ask for Apple sign-in, and the AI adds the capability, the button, and the credential handling. If you connect Supabase, AppFlight passes the identity token to Supabase auth so the user is created and verified server-side, with the service-role secret kept out of the app.

Manually, you enable the Sign in with Apple capability, add SignInWithAppleButton, request the full name and email scopes, and on success read the ASAuthorizationAppleIDCredential. Send its identity token to your server to verify it and create or look up the user. Save the user identifier on the first sign-in, since name and email are only returned once.

A SwiftUI example

Add the button and read the returned credential:

import AuthenticationServices
import SwiftUI

struct SignInView: View {
    var body: some View {
        SignInWithAppleButton(.signIn) { request in
            request.requestedScopes = [.fullName, .email]
        } onCompletion: { result in
            switch result {
            case .success(let auth):
                if let cred = auth.credential as? ASAuthorizationAppleIDCredential,
                   let tokenData = cred.identityToken,
                   let token = String(data: tokenData, encoding: .utf8) {
                    // Send token to your backend to verify and create the user.
                    print("user: \(cred.user), token: \(token)")
                }
            case .failure(let error):
                print("Sign in failed: \(error.localizedDescription)")
            }
        }
        .frame(height: 50)
    }
}

Common pitfalls

Expecting the name and email on every sign-in is the most common mistake, since Apple sends them only the first time, so persist them then. Keying accounts on the email instead of the stable user identifier breaks when a user switches to a private relay address. Skipping server-side verification of the identity token means you cannot trust the sign-in. Not handling the private relay email correctly, for example by trying to send marketing mail to it, can fail Apple's relay rules.