# Native Sign in with Apple apple-authz-code returns invalid\_client, but direct Apple exchange succeeds

**URL:** <https://community.auth0.com/t/native-sign-in-with-apple-apple-authz-code-returns-invalid-client-but-direct-apple-exchange-succeeds/203876>\
**Category:** Get Help\
**Tags:** apple, sign-in-with-apple, social-connections, ios, native, login\
**Created:** [October 2, 2026, 3:03pm UTC](https://community.auth0.com/t/native-sign-in-with-apple-apple-authz-code-returns-invalid-client-but-direct-apple-exchange-succeeds/203876 "2026-10-02T15:03:25Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![trevormarr](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/trevormarr/32/81045_2.png) [@trevormarr](https://community.auth0.com/u/trevormarr)\
**Post date:** [October 2, 2026, 3:03pm UTC](https://community.auth0.com/t/native-sign-in-with-apple-apple-authz-code-returns-invalid-client-but-direct-apple-exchange-succeeds/203876/1 "2026-10-02T15:03:25Z")

</div>

I’m troubleshooting native Sign in with Apple with Auth0 and have isolated the failure to Auth0’s server-side exchange with Apple.

**Auth0 tenant:** `o---us.auth0.com`

**Auth0 application client ID:** `O---f`

**Apple connection ID:** `con---JZ`

Configuration:

- Apple Services ID / Auth0 Apple Social Connection Client ID: `app.offroadin.auth`
- Native iOS App ID / Bundle ID: `app.offroadin.ios`
- Team ID: `K---M`
- Native Social Login → Sign in with Apple is enabled
- Device Settings App ID is `app.offroadin.ios`

The native iOS app receives a real Apple `authorizationCode` and sends it to Auth0 `/oauth/token` using:

`grant_type=urn:ietf:params:oauth:grant-type:token-exchange`

`subject_token_type=http://auth0.com/oauth/token-type/apple-authz-code`

Auth0 returns:

`Error from apple connection: (no description) (invalid_client)`

I independently tested the exact same native Apple authorization code directly against:

`https://appleid.apple.com/auth/token`

using:

`client_id=app.offroadin.ios`

and a valid Apple client-secret JWT with:

`sub=app.offroadin.ios`

Apple successfully returned an access token, refresh token, and ID token.

I also verified that:

- the Apple `.p8` / Key ID are valid;
- Team ID is valid;
- direct client-secret generation works;
- no nonce is being sent in the native Apple request;
- Auth0 Dashboard → Apple → Try Connection succeeds with the Services ID `app.offroadin.auth`.

This appears to indicate Auth0 may be using the Apple Social Connection’s Services ID for the back-channel client authentication during `apple-authz-code` exchange rather than the native App ID from Device Settings.

Can someone from Auth0 confirm what `client_id` and client-secret JWT `sub` Auth0 uses for native `apple-authz-code` exchange?

Latest Auth0 error:

`Error from apple connection: (no description) (invalid_client)`

I can provide the full Auth0 failed-exchange log ID and request details if helpful.

---

<div class="post-metadata">

**Author:** ![gerald.czifra](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/gerald.czifra/32/75301_2.png) [@gerald.czifra](https://community.auth0.com/u/gerald.czifra)\
**Post date:** [October 3, 2026, 1:30pm UTC](https://community.auth0.com/t/native-sign-in-with-apple-apple-authz-code-returns-invalid-client-but-direct-apple-exchange-succeeds/203876/3 "2026-10-03T13:30:30Z")

</div>

Hi @trevormarr

Welcome to the Auth0 Community!

I understand that you are troubleshooting a [native Sign in with Apple integration](https://auth0.com/docs/authenticate/identity-providers/social-identity-providers/apple-native) where Auth0’s server-side token exchange with Apple is failing with `invalid_client`, even though the same authorization code works when you test it directly against Apple’s token endpoint using the native App ID.

**Root Cause:**

Based on [community reports of identical failures](https://community.auth0.com/t/apple-login-error-invalid-client/56566), the issue most likely stems from a mismatch between the Apple identifier Auth0 uses during its backend token exchange and the identifier Apple expects. Your hypothesis—that Auth0 may be using the Service ID (Client ID) instead of the native App ID for the JWT `sub` claim—aligns with the documented configuration requirements for native Sign in with Apple flows.

**Recommended solution:**

Verify the following configuration in your Auth0 Apple connection and Apple Developer account:

1. **Confirm the Service ID is correctly linked to your native App ID.** In the Apple Developer Portal, navigate to Certificates, Identifiers & Profiles \> Identifiers. Select your Service ID (the one you entered as the Client ID in Auth0), then edit it. Verify that the “Primary App ID” field is set to your native application’s Bundle ID (`app.offroadin.ios`). This link is critical for the native flow; if it is missing or points to a different App ID, Apple will reject Auth0’s token exchange request.

2. **Verify the Client Secret JWT configuration.** The `.p8` key file and Key ID you uploaded to Auth0 must be valid and not expired. In the Apple Developer Portal, go to Certificates, Identifiers & Profiles \> Keys. Locate the key you created for Sign in with Apple and confirm it has not expired. If it has, generate a new private key, download the `.p8` file, and update your Auth0 connection with the new key.

3. **[Check that the Team ID is correct.](https://support.auth0.com/center/s/article/Sign-in-with-Apple-Error-Error-from-apple-connection-no-description-invalid-client)** In your Auth0 Apple connection settings, verify that the Team ID matches the one shown in your Apple Developer account (visible in the top-right corner of the Apple Developer Portal).

4. **Test the connection in Auth0 Dashboard.** Go to Auth0 Dashboard \> Authentication \> Social \> Apple. Click **Try Connection** and verify that the flow succeeds using the Service ID. If this test passes but your native app flow fails, the issue is specific to how the native authorization code is being exchanged.

Please let us know if the above information helped you overcome the issue and do not hesitate reaching out to us for any other blockers or requests, we will gladly look into it!

Best regards,  
Gerald

---

<div class="post-metadata">

**Author:** ![jhonmu491](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/jhonmu491/32/80608_2.png) [@jhonmu491](https://community.auth0.com/u/jhonmu491)\
**Post date:** [October 4, 2026, 5:05am UTC](https://community.auth0.com/t/native-sign-in-with-apple-apple-authz-code-returns-invalid-client-but-direct-apple-exchange-succeeds/203876/4 "2026-10-04T05:05:01Z")

</div>

Thanks man, this also helps me.

---

<div class="post-metadata">

**Author:** ![trevormarr](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/trevormarr/32/81045_2.png) [@trevormarr](https://community.auth0.com/u/trevormarr)\
**Post date:** [October 5, 2026, 11:25pm UTC](https://community.auth0.com/t/native-sign-in-with-apple-apple-authz-code-returns-invalid-client-but-direct-apple-exchange-succeeds/203876/5 "2026-10-05T23:25:28Z")

</div>

I verified the Service ID app.offroadin.auth is linked to Primary App ID app.offroadin.ios, the Team ID and signing key are valid, and Auth0 Try Connection succeeds. The same native authorization code also succeeds when exchanged directly with Apple using client\_id=app.offroadin.ios and a client-secret JWT whose sub is app.offroadin.ios.

Native Auth0 token exchange still fails with invalid\_client. Can you confirm specifically what client\_id Auth0 sends to Apple for subject\_token\_type=[http://auth0.com/oauth/token-type/apple-authz-code](http://auth0.com/oauth/token-type/apple-authz-code), and what identifier Auth0 uses as the sub when generating the Apple client-secret JWT for that native exchange? Does Auth0 use the Device Settings App ID (app.offroadin.ios) or the Apple Social Connection Client ID / Services ID (app.offroadin.auth)?

---

<div class="post-metadata">

**Author:** ![trevormarr](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/trevormarr/32/81045_2.png) [@trevormarr](https://community.auth0.com/u/trevormarr)\
**Post date:** [October 11, 2026, 10:40pm UTC](https://community.auth0.com/t/native-sign-in-with-apple-apple-authz-code-returns-invalid-client-but-direct-apple-exchange-succeeds/203876/6 "2026-10-11T22:40:20Z")

</div>

Hi Auth0 Support,

I have new diagnostic evidence for our existing native Sign in with Apple issue.

I corrected our Apple Services ID configuration. The correct identifiers are:

- Native iOS App ID / Bundle ID: `app.offroadin.ios`

- Apple Services ID used by the Auth0 Apple social connection: `app.offroadin.auth`

The native Sign in with Apple flow is succeeding and Apple is returning both a valid ID token and fresh authorization code.

The decoded Apple ID token contains:

`aud: app.offroadin.ios`

The native plugin then returns a fresh `authorizationCode`, which Offroadin immediately sends to the Auth0 `/oauth/token` token-exchange endpoint using the `apple-authz-code` subject token type.

Auth0 still returns:

`400 invalid_request`

`Error from apple connection: (no description) (invalid_client)`

This confirms the failure occurs after native Apple authentication and after Auth0 receives the valid native authorization code.

We previously tested a native Apple authorization code directly against Apple’s `/auth/token` endpoint using:

`client_id=app.offroadin.ios`

and a client-secret JWT whose:

`sub=app.offroadin.ios`

Apple successfully exchanged that code and returned access, refresh, and ID tokens.

Could you please inspect the Auth0-side downstream Apple token request for this failure and confirm:

1. What `client_id` Auth0 sends to `https://appleid.apple.com/auth/token` for the native `apple-authz-code` exchange.

2. What value Auth0 uses for the `sub` claim in the Apple client-secret JWT.

3. Whether Auth0 uses the Apple Social Connection Services ID (`app.offroadin.auth`) or the native Device Settings App ID (`app.offroadin.ios`) during this native exchange.

4. Whether the native `apple-authz-code` flow supports a Services ID on the Apple connection while using a different native App ID in Device Settings.

The native Apple credential is being issued for:

`app.offroadin.ios`

so if Auth0 performs the exchange using:

`client_id=app.offroadin.auth`

or generates the client-secret JWT with:

`sub=app.offroadin.auth`

that would appear to explain Apple’s `invalid_client` response for the native authorization code.

I can provide the full Auth0 log event / request ID for this specific attempt as well.

Thanks,  
Trevor

---

<div class="post-metadata">

**Author:** ![trevormarr](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/trevormarr/32/81045_2.png) [@trevormarr](https://community.auth0.com/u/trevormarr)\
**Post date:** [October 30, 2026, 7:08pm UTC](https://community.auth0.com/t/native-sign-in-with-apple-apple-authz-code-returns-invalid-client-but-direct-apple-exchange-succeeds/203876/7 "2026-10-30T19:08:34Z")

</div>

any updates on this @gerald.czifra