Native Sign in with Apple apple-authz-code returns invalid_client, but direct Apple exchange succeeds

Get Help
, , , , ,
1

I’m troubleshooting native Sign in with Apple with Auth0 and have isolated the failure to Auth0’s server-side exchange with Apple.

Auth0 tenant: o---us.auth0.com

Auth0 application client ID: O---f

Apple connection ID: con---JZ

Configuration:

  • Apple Services ID / Auth0 Apple Social Connection Client ID: app.offroadin.auth
  • Native iOS App ID / Bundle ID: app.offroadin.ios
  • Team ID: K---M
  • Native Social Login → Sign in with Apple is enabled
  • Device Settings App ID is app.offroadin.ios

The native iOS app receives a real Apple authorizationCode and sends it to Auth0 /oauth/token using:

grant_type=urn:ietf:params:oauth:grant-type:token-exchange

subject_token_type=http://auth0.com/oauth/token-type/apple-authz-code

Auth0 returns:

Error from apple connection: (no description) (invalid_client)

I independently tested the exact same native Apple authorization code directly against:

https://appleid.apple.com/auth/token

using:

client_id=app.offroadin.ios

and a valid Apple client-secret JWT with:

sub=app.offroadin.ios

Apple successfully returned an access token, refresh token, and ID token.

I also verified that:

  • the Apple .p8 / Key ID are valid;
  • Team ID is valid;
  • direct client-secret generation works;
  • no nonce is being sent in the native Apple request;
  • Auth0 Dashboard → Apple → Try Connection succeeds with the Services ID app.offroadin.auth.

This appears to indicate Auth0 may be using the Apple Social Connection’s Services ID for the back-channel client authentication during apple-authz-code exchange rather than the native App ID from Device Settings.

Can someone from Auth0 confirm what client_id and client-secret JWT sub Auth0 uses for native apple-authz-code exchange?

Latest Auth0 error:

Error from apple connection: (no description) (invalid_client)

I can provide the full Auth0 failed-exchange log ID and request details if helpful.

3

Hi @trevormarr

Welcome to the Auth0 Community!

I understand that you are troubleshooting a native Sign in with Apple integration where Auth0’s server-side token exchange with Apple is failing with invalid_client, even though the same authorization code works when you test it directly against Apple’s token endpoint using the native App ID.

Root Cause:

Based on community reports of identical failures, the issue most likely stems from a mismatch between the Apple identifier Auth0 uses during its backend token exchange and the identifier Apple expects. Your hypothesis—that Auth0 may be using the Service ID (Client ID) instead of the native App ID for the JWT sub claim—aligns with the documented configuration requirements for native Sign in with Apple flows.

Recommended solution:

Verify the following configuration in your Auth0 Apple connection and Apple Developer account:

  1. Confirm the Service ID is correctly linked to your native App ID. In the Apple Developer Portal, navigate to Certificates, Identifiers & Profiles > Identifiers. Select your Service ID (the one you entered as the Client ID in Auth0), then edit it. Verify that the “Primary App ID” field is set to your native application’s Bundle ID (app.offroadin.ios). This link is critical for the native flow; if it is missing or points to a different App ID, Apple will reject Auth0’s token exchange request.

  2. Verify the Client Secret JWT configuration. The .p8 key file and Key ID you uploaded to Auth0 must be valid and not expired. In the Apple Developer Portal, go to Certificates, Identifiers & Profiles > Keys. Locate the key you created for Sign in with Apple and confirm it has not expired. If it has, generate a new private key, download the .p8 file, and update your Auth0 connection with the new key.

  3. Check that the Team ID is correct. In your Auth0 Apple connection settings, verify that the Team ID matches the one shown in your Apple Developer account (visible in the top-right corner of the Apple Developer Portal).

  4. Test the connection in Auth0 Dashboard. Go to Auth0 Dashboard > Authentication > Social > Apple. Click Try Connection and verify that the flow succeeds using the Service ID. If this test passes but your native app flow fails, the issue is specific to how the native authorization code is being exchanged.

Please let us know if the above information helped you overcome the issue and do not hesitate reaching out to us for any other blockers or requests, we will gladly look into it!

Best regards,
Gerald

4

Thanks man, this also helps me.

5

I verified the Service ID app.offroadin.auth is linked to Primary App ID app.offroadin.ios, the Team ID and signing key are valid, and Auth0 Try Connection succeeds. The same native authorization code also succeeds when exchanged directly with Apple using client_id=app.offroadin.ios and a client-secret JWT whose sub is app.offroadin.ios.

Native Auth0 token exchange still fails with invalid_client. Can you confirm specifically what client_id Auth0 sends to Apple for subject_token_type=http://auth0.com/oauth/token-type/apple-authz-code, and what identifier Auth0 uses as the sub when generating the Apple client-secret JWT for that native exchange? Does Auth0 use the Device Settings App ID (app.offroadin.ios) or the Apple Social Connection Client ID / Services ID (app.offroadin.auth)?

6

Hi Auth0 Support,

I have new diagnostic evidence for our existing native Sign in with Apple issue.

I corrected our Apple Services ID configuration. The correct identifiers are:

  • Native iOS App ID / Bundle ID: app.offroadin.ios

  • Apple Services ID used by the Auth0 Apple social connection: app.offroadin.auth

The native Sign in with Apple flow is succeeding and Apple is returning both a valid ID token and fresh authorization code.

The decoded Apple ID token contains:

aud: app.offroadin.ios

The native plugin then returns a fresh authorizationCode, which Offroadin immediately sends to the Auth0 /oauth/token token-exchange endpoint using the apple-authz-code subject token type.

Auth0 still returns:

400 invalid_request

Error from apple connection: (no description) (invalid_client)

This confirms the failure occurs after native Apple authentication and after Auth0 receives the valid native authorization code.

We previously tested a native Apple authorization code directly against Apple’s /auth/token endpoint using:

client_id=app.offroadin.ios

and a client-secret JWT whose:

sub=app.offroadin.ios

Apple successfully exchanged that code and returned access, refresh, and ID tokens.

Could you please inspect the Auth0-side downstream Apple token request for this failure and confirm:

  1. What client_id Auth0 sends to https://appleid.apple.com/auth/token for the native apple-authz-code exchange.

  2. What value Auth0 uses for the sub claim in the Apple client-secret JWT.

  3. Whether Auth0 uses the Apple Social Connection Services ID (app.offroadin.auth) or the native Device Settings App ID (app.offroadin.ios) during this native exchange.

  4. Whether the native apple-authz-code flow supports a Services ID on the Apple connection while using a different native App ID in Device Settings.

The native Apple credential is being issued for:

app.offroadin.ios

so if Auth0 performs the exchange using:

client_id=app.offroadin.auth

or generates the client-secret JWT with:

sub=app.offroadin.auth

that would appear to explain Apple’s invalid_client response for the native authorization code.

I can provide the full Auth0 log event / request ID for this specific attempt as well.

Thanks,
Trevor