search

capacitor-community / apple-sign-in

Sign in with Apple Support
MIT License
135 stars 58 forks source link

Obtain client_secret in order to revoke the token #74

Closed ikleiman closed 1 year ago

ikleiman commented 2 years ago

I've received the following email from Apple yesterday:

_Starting June 30, 2022, apps submitted to the App Store that support account creation must also include an option to initiate account deletion.

We noticed this app may support account creation. If it does not, you may disregard this message. If it already offers account deletion or you’re working to implement it, we appreciate your efforts to follow the App Store Review Guidelines. Apps submitted after June 30 that do not comply with the account deletion requirements in guideline 5.1.1(v) will not pass review.

Learn more about the account deletion requirements. If your app offers Sign in with Apple, use the Sign in with Apple REST API to revoke user tokens._

Following the instructions on https://developer.apple.com/documentation/sign_in_with_apple/revoke_tokens, it mentions a "client_secret" used in the login flow. I've searched through the code and in other issues, but can't seem to found any relevant information.

Any idea on how to get that value?

Found this SO topic that follows the same subject, but it haven't any concrete answer yet: https://stackoverflow.com/questions/72399534/how-to-make-apple-sign-in-revoke-token-post-request

mesoylu commented 1 year ago

Hello @ikleiman,

Following the instructions on https://developer.apple.com/documentation/sign_in_with_apple/revoke_tokens, it mentions a "client_secret" used in the login flow. I've searched through the code and in other issues, but can't seem to found any relevant information.

Any idea on how to get that value?

I am not sure you still need help but i have used the method below to create the client secret. https://www.mongodb.com/docs/atlas/app-services/authentication/apple/#create-the-client-secret-jwt

ikleiman commented 1 year ago

Thanks @mesoylu , I just did the entire workflow without any troubles. If anyone have the same issue, you just need to:

  1. Follow the steps on https://developer.apple.com/documentation/sign_in_with_apple/generate_and_validate_tokens, under Create the client secret
  2. On that same page, use the "authorizationCode" inside SignInWithAppleResponse, to make a call to https://appleid.apple.com/auth/token
  3. Save the "refresh_token" on the /auth/token response
  4. When you delete a user, use the refresh_token that you previously saved to make a call to https://appleid.apple.com/auth/revoke

And that's all

rdlabo commented 1 year ago

I found this information very helpful. I've summarized it (but in Japanese) and I hope it will be of help to someone next time.

https://zenn.dev/rdlabo/articles/37c9dee03285ea