Better Auth · Authentication · all subjects

apple/setup

10 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

Apple OAuth credentials required

To use Apple sign in with Better Auth, you need a client ID, Team ID, Key ID, and private key from the Apple Developer Portal. These are used to generate the client secret JWT. An active Apple Developer account is required.

Apple App ID bundle ID format

When creating an App ID in the Apple Developer Portal, set a bundle ID using reverse domain name format, such as com.yourcompany.yourapp. You can optionally use a suffix like .ai for organization purposes, for example com.yourcompany.yourapp.ai.

Apple Service ID becomes clientId

The Service ID created in Apple Developer Portal serves as the clientId for Better Auth. It should use a reverse domain format distinct from the App ID, such as com.yourcompany.yourapp.si where .si indicates service identifier.

Apple return URL configuration

When configuring the Service ID in Apple Developer Portal, enter the callback URL under Return URLs as https://yourdomain.com/api/auth/callback/apple. All necessary return URLs must be added.

Apple .p8 key file download

When creating a Client Secret Key in the Apple Developer Portal, immediately download the .p8 key file as it is only available for download once. This file contains the private key needed for JWT generation.

Apple JWT expiration limit

Apple rejects client secret JWTs that expire more than 15,777,000 seconds (six months) in the future. The client secret must be regenerated before it expires to maintain uninterrupted authentication.

Jose package for Apple JWT generation

To generate the Apple client secret JWT in Better Auth, install the jose package using npm install jose.

Apple trustedOrigins configuration

When configuring Better Auth for Apple sign-in, add https://appleid.apple.com to the trustedOrigins array in the auth instance configuration to allow communication with Apple's authentication servers.

Apple sign-in with Better Auth example

This example shows how to configure Apple sign-in in Better Auth using JWT generation with the jose library: ```ts title="auth.ts" import { betterAuth } from "better-auth" import { importPKCS8, SignJWT } from "jose"; // Generate the client secret JWT required for 'Sign in with Apple'. async function generateAppleClientSecret(clientId, teamId, keyId, privateKey) { const key = await importPKCS8(privateKey, "ES256"); const now = Math.floor(Date.now() / 1000); return new SignJWT({}) .setProtectedHeader({ alg: "ES256", kid: keyId }) .setIssuer(teamId) .setSubject(clientId) .setAudience("https://appleid.apple.com") .setIssuedAt(now) .setExpirationTime(now + 180 * 24 * 60 * 60) .sign(key); } export const auth = betterAuth({ socialProviders: { apple: async () => ({ clientId: process.env.APPLE_CLIENT_ID as string, clientSecret: await generateAppleClientSecret( process.env.APPLE_CLIENT_ID!, process.env.APPLE_TEAM_ID!, process.env.APPLE_KEY_ID!, process.env.APPLE_PRIVATE_KEY!, ), appBundleIdentifier: process.env.APPLE_APP_BUNDLE_IDENTIFIER as string, }), }, trustedOrigins: ["https://appleid.apple.com"], }) ```

Apple localhost and HTTPS restriction

Apple Sign In does not support localhost or non-HTTPS URLs. During development, you cannot use http://localhost as a return URL. You must use a domain with a valid HTTPS/TLS certificate. This limitation is enforced by Apple's security requirements and cannot be bypassed.

Give your agent this brain