Proposed Pull Request Change

📄 Document Links

View on GitHub View on Microsoft Learn

--- title: Configure Sign in with Apple (Preview) description: Learn how to configure Sign in with Apple as an identity provider for your App Service or Azure Functions app. ms.topic: how-to ms.date: 03/31/2026 ms.reviewer: mikarmar author: cephalin ms.author: cephalin ms.service: azure-app-service ms.custom: - AppServiceIdentity - sfi-image-nochange # customer intent: As a developer, I want to configure Sign in with Apple so that I can use it as an identity provider for an App Service or Azure Functions app. --- # Configure your App Service or Azure Functions app to sign in using a Sign in with Apple provider (Preview) [!INCLUDE [app-service-mobile-selector-authentication](../../includes/app-service-mobile-selector-authentication.md)] This article shows you how to configure Azure App Service or Azure Functions to use Sign in with Apple as an authentication provider. To complete the procedure in this article, you must enroll in the Apple developer program. To enroll in the Apple developer program, go to [developer.apple.com/programs/enroll](https://developer.apple.com/programs/enroll/). > [!CAUTION] > Enabling Sign in with Apple disables management of the App Service Authentication and Authorization feature for your application through some clients, such as the Azure portal, Azure CLI, and Azure PowerShell. The feature relies on a new API surface, which, during preview, isn't yet accounted for in all management experiences. [comment]: <Remove this caution block when V2 becomes available for use.> ## <a name="createApplication"> </a>Create an application in the Apple Developer portal Create an App ID and a service ID in the Apple Developer portal. 1. On the Apple Developer portal, go to **Certificates, Identifiers, & Profiles**. 1. On the **Identifiers** tab, select the **(+)** button. 1. On the **Register a New Identifier** page, choose **App IDs** and select **Continue**. App IDs include one or more Service IDs. :::image type="content" source="media/configure-authentication-provider-apple/apple-register-app.jpg" alt-text="Screenshot shows the Register a New Identifier page in the Apple Developer Portal with App IDs highlighted." lightbox="media/configure-authentication-provider-apple/apple-register-app.jpg"::: 1. On the **Register an App ID** page, provide a description and a bundle ID. 1. From the capabilities list, select **Sign in with Apple** Then select **Continue**. Take note of your **App ID Prefix (Team ID)** from this step. You need it later. :::image type="content" source="media/configure-authentication-provider-apple/apple-configure-app.jpg" alt-text="Screenshot shows configuring a new app identifier in the Apple Developer Portal." lightbox="media/configure-authentication-provider-apple/apple-configure-app.jpg"::: 1. Review the app registration information and select **Register**. 1. Again, on the **Identifiers** tab, select the **(+)** button. :::image type="content" source="media/configure-authentication-provider-apple/apple-new-app.jpg" alt-text="Screenshot shows the Identifier page with the plus icon highlighted in the Apple Developer Portal."::: 1. On the **Register a New Identifier** page, choose **Services IDs** and select **Continue**. :::image type="content" source="media/configure-authentication-provider-apple/apple-register-service.jpg" alt-text="Screenshot shows the Register a New Identifier page in the Apple Developer Portal with Services IDs highlighted." lightbox="media/configure-authentication-provider-apple/apple-register-service.jpg"::: 1. On the **Register a Services ID** page, provide a description and an identifier. Then select **Configure**. :::image type="content" source="media/configure-authentication-provider-apple/apple-configure-service-1.jpg" alt-text="Screenshot shows providing a description and an identifier." lightbox="media/configure-authentication-provider-apple/apple-configure-service-1.jpg"::: The description is what the user sees on the consent screen. The identifier is your client ID used in configuring the Apple provider with your app service. 1. On the dialog, set the Primary App ID to the App ID you created earlier. Specify your application's domain in the domain section. For the return URL, use the URL `<app-url>/.auth/login/apple/callback`. For example, `https://contoso.azurewebsites.net/.auth/login/apple/callback`. Then select **Add** and **Save**. :::image type="content" source="media/configure-authentication-provider-apple/apple-configure-service-2.jpg" alt-text="Screenshot shows specifying the domain and return URL for the registration."::: 1. Review the service registration information, and then select **Save**. ## <a name="generateClientSecret"> </a>Generate the client secret Apple requires app developers to create and sign a JSON Web Token (JWT) as the client secret value. To generate this secret, first generate and download an elliptic curve private key from the Apple Developer portal. Then, use that key to [sign a JWT](#sign-the-client-secret-jwt) with a [specific payload](#structure-the-client-secret-jwt). ### Create and download the private key 1. On the **Keys** tab in the Apple Developer portal, choose **Create a key** or select the **(+)** button. 1. On the **Register a New Key** page give the key a name, select **Sign in with Apple**, and select **Configure**. 1. On the **Configure Key** page, link the key to the primary app ID you created previously and select **Save**. 1. Finish creating the key by confirming the information and selecting **Continue**. Then review the information and select **Register**. 1. On the **Download Your Key** page, download the key. It downloads as a `.p8` (PKCS#8) file. You use the file contents to sign your client secret JWT. ### Structure the client secret JWT Apple requires the client secret be the base64-encoding of a JWT. The decoded JWT should have a payload structured like this example: ```json { "alg": "ES256", "kid": "URKEYID001", }.{ "sub": "com.yourcompany.app1", "nbf": 1560203207, "exp": 1560289607, "iss": "ABC123DEFG", "aud": "https://appleid.apple.com" }.[Signature] ``` - **sub**: The Apple Client ID, also the service ID - **iss**: Your Apple Developer Team ID - **aud**: Apple is receiving the token, so they're the audience - **exp**: No more than six months after **nbf** The base64-encoded version of this payload looks like this: `eyJhbGciOiJFUzI1NiIsImtpZCI6IlVSS0VZSUQwMDEifQ.eyJzdWIiOiJjb20ueW91cmNvbXBhbnkuYXBwMSIsIm5iZiI6MTU2MDIwMzIwNywiZXhwIjoxNTYwMjg5NjA3LCJpc3MiOiJBQkMxMjNERUZHIiwiYXVkIjoiaHR0cHM6Ly9hcHBsZWlkLmFwcGxlLmNvbSJ9.ABSXELWuTbgqfrIUz7bLi6nXvkXAz5O8vt0jB2dSHTQTib1x1DSP4__4UrlKI-pdzNg1sgeocolPNTmDKazO8-BHAZCsdeeTNlgFEzBytIpMKFfVEQbEtGRkam5IeclUK7S9oOva4EK4jV4VmgDrr-LGWWO3TaAxAvy3_ZoKohvFFkVG` > [!NOTE] > Apple doesn't accept client secret JWTs with an expiration date more than six months after the creation, or *nbf*, date. You need to rotate your client secret, at minimum, every six months. ### Sign the client secret JWT You use the `.p8` file you downloaded previously to sign the client secret JWT. This file is a [PKCS#8 file](https://en.wikipedia.org/wiki/PKCS_8) that contains the private signing key in PEM format. There are many libraries that can create and sign the JWT for you. There are different kinds of open-source libraries available online for creating and signing JWTs. For more information about generating JWTs, see [JSON Web Token (JWT)](../active-directory/develop/security-tokens.md#json-web-tokens-and-claims). For example, one way of generating the client secret is to import the [Microsoft.IdentityModel.Tokens NuGet package](https://www.nuget.org/packages/Microsoft.IdentityModel.Tokens/) and run the C# code shown here: ```csharp using Microsoft.IdentityModel.Tokens; public static string GetAppleClientSecret(string teamId, string clientId, string keyId, string p8key) { string audience = "https://appleid.apple.com"; string issuer = teamId; string subject = clientId; string kid = keyId; IList<Claim> claims = new List<Claim> { new Claim ("sub", subject) }; CngKey cngKey = CngKey.Import(Convert.FromBase64String(p8key), CngKeyBlobFormat.Pkcs8PrivateBlob); SigningCredentials signingCred = new SigningCredentials( new ECDsaSecurityKey(new ECDsaCng(cngKey)), SecurityAlgorithms.EcdsaSha256 ); JwtSecurityToken token = new JwtSecurityToken( issuer, audience, claims, DateTime.Now, DateTime.Now.AddDays(180), signingCred ); token.Header.Add("kid", kid); token.Header.Remove("typ"); JwtSecurityTokenHandler tokenHandler = new JwtSecurityTokenHandler(); return tokenHandler.WriteToken(token); } ``` - **teamId**: Your Apple Developer Team ID - **clientId**: The Apple Client ID, also the service ID - **p8key**: The PEM format key. You can obtain the key by opening the `.p8` file in a text editor, and copying everything between `-----BEGIN PRIVATE KEY-----` and `-----END PRIVATE KEY-----` without line breaks. - **keyId**: The ID of the downloaded key This token returned is the client secret value you use to configure the Apple provider. > [!IMPORTANT] > The client secret is an important security credential. Don't share this secret with anyone or distribute it in a client application. Add the client secret as an [application setting](./configure-common.md#configure-app-settings) for the app, using a setting name of your choice. Make note of this name for later. ## <a name="configure"> </a>Add provider information to your application > [!NOTE] > The required configuration is in a new API format, currently only supported by [file-based configuration (preview)](configure-authentication-file-based.md). You need to follow the steps here to use such a file. This section describes updating the configuration to include your new IDP. An example configuration follows. 1. In the `identityProviders` object, add an `apple` object if one doesn't already exist. 1. Assign an object to that key with a `registration` object within it, and optionally a `login` object: ```json "apple" : { "registration" : { "clientId": "<client ID>", "clientSecretSettingName": "APP_SETTING_CONTAINING_APPLE_CLIENT_SECRET" }, "login": { "scopes": [] } } ``` 1. In the `registration` object, set the `clientId` to the client ID you collected. 1. In the `registration` object, set `clientSecretSettingName` to the name of the application setting where you stored the client secret. 1. In the `login` object, you can choose to set the `scopes` array to include a list of scopes used when authenticating with Apple, such as *name* and *email*. If scopes are configured, they're explicitly requested on the consent screen when users sign in for the first time. After you set this configuration, you're ready to use your Apple provider for authentication in your app. A complete configuration might look like the following example, where the APPLE_GENERATED_CLIENT_SECRET setting points to an application setting containing a generated JWT: ```json { "platform": { "enabled": true }, "globalValidation": { "redirectToProvider": "apple", "unauthenticatedClientAction": "RedirectToLoginPage" }, "identityProviders": { "apple": { "registration": { "clientId": "com.contoso.example.client", "clientSecretSettingName": "APPLE_GENERATED_CLIENT_SECRET" }, "login": { "scopes": [] } } }, "login": { "tokenStore": { "enabled": true } } } ``` ## <a name="related-content"> </a>Related content [!INCLUDE [app-service-mobile-related-content-get-started-users](../../includes/app-service-mobile-related-content-get-started-users.md)]