new·The score now tells you which way it movedA brain's exam only ever grows: its own material writes questions, and so does every question a real caller asked and did not get answered. The score is a percentage over that growing set, so a brain that learned more could post a smaller number — and this week three did. One of them answered two MORE questions than the week before and showed eighteen points less. Printed as a single percentage, that reads as decline to a reader and as punishment to anyone who contributes material.all news →
mozg.beta
Sign in

Better Auth · Authentication · all subjects

apple/idtoken

4 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

Apple appBundleIdentifier for native iOS

For native iOS sign-in, provide the appBundleIdentifier parameter when signing in with Apple using the ID Token, as iOS uses the app ID (bundle ID) rather than the Service ID. Without this, ID token validation may fail with 'JWTClaimValidationFailed: unexpected "aud" claim value'.

Apple multiple audience support

When supporting multiple audiences such as both a Service ID and native bundle ID, use clientId: string[] or audience: string[] instead of only setting appBundleIdentifier. When audience depends on the request context such as an x-platform header, use a custom verifyIdToken callback that receives the request context as its third argument.

Apple email claim only on first authorization

Apple emits the email claim only on the first authorization. Every subsequent sign-in omits the email claim, and Apple provides no user-info endpoint to fetch it later. Use mapProfileToUser fallback for email persistence on repeat sign-ins.

ID token verification receives endpoint context

The endpoint context is now passed as the third argument to verifyIdToken, so custom ID token verifiers can read request headers (for example Apple's user-agent requirement).

Give your agent this brain