Native Sign in with Apple apple-authz-code returns invalid_client, but direct Apple exchange succeeds

Get Help
, , , , ,
1

I’m troubleshooting native Sign in with Apple with Auth0 and have isolated the failure to Auth0’s server-side exchange with Apple.

Auth0 tenant: o---us.auth0.com

Auth0 application client ID: O---f

Apple connection ID: con---JZ

Configuration:

  • Apple Services ID / Auth0 Apple Social Connection Client ID: app.offroadin.auth
  • Native iOS App ID / Bundle ID: app.offroadin.ios
  • Team ID: K---M
  • Native Social Login → Sign in with Apple is enabled
  • Device Settings App ID is app.offroadin.ios

The native iOS app receives a real Apple authorizationCode and sends it to Auth0 /oauth/token using:

grant_type=urn:ietf:params:oauth:grant-type:token-exchange

subject_token_type=http://auth0.com/oauth/token-type/apple-authz-code

Auth0 returns:

Error from apple connection: (no description) (invalid_client)

I independently tested the exact same native Apple authorization code directly against:

https://appleid.apple.com/auth/token

using:

client_id=app.offroadin.ios

and a valid Apple client-secret JWT with:

sub=app.offroadin.ios

Apple successfully returned an access token, refresh token, and ID token.

I also verified that:

  • the Apple .p8 / Key ID are valid;
  • Team ID is valid;
  • direct client-secret generation works;
  • no nonce is being sent in the native Apple request;
  • Auth0 Dashboard → Apple → Try Connection succeeds with the Services ID app.offroadin.auth.

This appears to indicate Auth0 may be using the Apple Social Connection’s Services ID for the back-channel client authentication during apple-authz-code exchange rather than the native App ID from Device Settings.

Can someone from Auth0 confirm what client_id and client-secret JWT sub Auth0 uses for native apple-authz-code exchange?

Latest Auth0 error:

Error from apple connection: (no description) (invalid_client)

I can provide the full Auth0 failed-exchange log ID and request details if helpful.

3

Hi @trevormarr

Welcome to the Auth0 Community!

I understand that you are troubleshooting a native Sign in with Apple integration where Auth0’s server-side token exchange with Apple is failing with invalid_client, even though the same authorization code works when you test it directly against Apple’s token endpoint using the native App ID.

Root Cause:

Based on community reports of identical failures, the issue most likely stems from a mismatch between the Apple identifier Auth0 uses during its backend token exchange and the identifier Apple expects. Your hypothesis—that Auth0 may be using the Service ID (Client ID) instead of the native App ID for the JWT sub claim—aligns with the documented configuration requirements for native Sign in with Apple flows.

Recommended solution:

Verify the following configuration in your Auth0 Apple connection and Apple Developer account:

  1. Confirm the Service ID is correctly linked to your native App ID. In the Apple Developer Portal, navigate to Certificates, Identifiers & Profiles > Identifiers. Select your Service ID (the one you entered as the Client ID in Auth0), then edit it. Verify that the “Primary App ID” field is set to your native application’s Bundle ID (app.offroadin.ios). This link is critical for the native flow; if it is missing or points to a different App ID, Apple will reject Auth0’s token exchange request.

  2. Verify the Client Secret JWT configuration. The .p8 key file and Key ID you uploaded to Auth0 must be valid and not expired. In the Apple Developer Portal, go to Certificates, Identifiers & Profiles > Keys. Locate the key you created for Sign in with Apple and confirm it has not expired. If it has, generate a new private key, download the .p8 file, and update your Auth0 connection with the new key.

  3. Check that the Team ID is correct. In your Auth0 Apple connection settings, verify that the Team ID matches the one shown in your Apple Developer account (visible in the top-right corner of the Apple Developer Portal).

  4. Test the connection in Auth0 Dashboard. Go to Auth0 Dashboard > Authentication > Social > Apple. Click Try Connection and verify that the flow succeeds using the Service ID. If this test passes but your native app flow fails, the issue is specific to how the native authorization code is being exchanged.

Please let us know if the above information helped you overcome the issue and do not hesitate reaching out to us for any other blockers or requests, we will gladly look into it!

Best regards,
Gerald

4

Thanks man, this also helps me.

5

I verified the Service ID app.offroadin.auth is linked to Primary App ID app.offroadin.ios, the Team ID and signing key are valid, and Auth0 Try Connection succeeds. The same native authorization code also succeeds when exchanged directly with Apple using client_id=app.offroadin.ios and a client-secret JWT whose sub is app.offroadin.ios.

Native Auth0 token exchange still fails with invalid_client. Can you confirm specifically what client_id Auth0 sends to Apple for subject_token_type=http://auth0.com/oauth/token-type/apple-authz-code, and what identifier Auth0 uses as the sub when generating the Apple client-secret JWT for that native exchange? Does Auth0 use the Device Settings App ID (app.offroadin.ios) or the Apple Social Connection Client ID / Services ID (app.offroadin.auth)?