This, Apple Login Error "invalid_client" - #5 by tadpreston
So, we were using an old private key. We needed to revoke the current one because it was lost, then make a new one with the same sub group as the Service ID, following the typical configuration steps outlined in Okta developer documentation, here, What the Heck is Sign In with Apple? | Okta Developer