i also feel like it‘s not because of apple email configuration. I tried to use a new apple account to login and select hide email address for this account. In this case apple will give me another privaterelay email address to represent me,which is different from the empty email scenario above
The missing email is not a bug in your code or Auth0 configuration. It is a deliberate privacy feature of Apple’s API. Apple only shares the user’s name and email address once: the very first time the user consents to your app.
If you delete the user in Auth0 to “start fresh” but do not revoke the permission in the user’s Apple ID settings, Apple considers the user “already consented.” On subsequent logins, Apple sends only the unique User ID (Subject), resulting in an Auth0 profile with no email address.
Here’s how you can fix it:
1. Fix for Testing (How to get the email again)
To simulate a “true” first login and receive the email payload again, you must manually revoke your app’s access on the user’s Apple device. This way, when you log in again, Apple will treat it as a fresh consent and send the email payload.
2. Production Strategy (How to enforce email presence)
Since you cannot force Apple to resend the email for existing users, you must handle “email-less” logins gracefully in your authentication pipeline. The standard way to do this in Auth0 is using Actions to implement “Progressive Profiling.”
You can create a Post-Login Action that checks if the email is missing and redirects the user to a web form where they must manually enter it.
Example:
exports.onExecutePostLogin = async (event, api) => {
// Check if the email is missing
if (!event.user.email) {
// Option A: Deny access (Simple but harsh)
// api.access.deny('Email is required to use this application.');
// Option B: Redirect to a custom form to collect email (Recommended)
// api.redirect.sendUserTo('https://your-app.com/collect-email', {
// query: { session_token: event.transaction.session_id }
// });
}
};
If you use Option B, when the user submits their email, you would update the Auth0 user profile using the Management API and then resume the authentication flow.
If you have any further questions, please don’t hesitate to reach out.
