Native Sign in with Apple apple-authz-code returns invalid_client, but direct Apple exchange succeeds

Get Help
, , , , ,
3

Hi @trevormarr

Welcome to the Auth0 Community!

I understand that you are troubleshooting a native Sign in with Apple integration where Auth0’s server-side token exchange with Apple is failing with invalid_client, even though the same authorization code works when you test it directly against Apple’s token endpoint using the native App ID.

Root Cause:

Based on community reports of identical failures, the issue most likely stems from a mismatch between the Apple identifier Auth0 uses during its backend token exchange and the identifier Apple expects. Your hypothesis—that Auth0 may be using the Service ID (Client ID) instead of the native App ID for the JWT sub claim—aligns with the documented configuration requirements for native Sign in with Apple flows.

Recommended solution:

Verify the following configuration in your Auth0 Apple connection and Apple Developer account:

  1. Confirm the Service ID is correctly linked to your native App ID. In the Apple Developer Portal, navigate to Certificates, Identifiers & Profiles > Identifiers. Select your Service ID (the one you entered as the Client ID in Auth0), then edit it. Verify that the “Primary App ID” field is set to your native application’s Bundle ID (app.offroadin.ios). This link is critical for the native flow; if it is missing or points to a different App ID, Apple will reject Auth0’s token exchange request.

  2. Verify the Client Secret JWT configuration. The .p8 key file and Key ID you uploaded to Auth0 must be valid and not expired. In the Apple Developer Portal, go to Certificates, Identifiers & Profiles > Keys. Locate the key you created for Sign in with Apple and confirm it has not expired. If it has, generate a new private key, download the .p8 file, and update your Auth0 connection with the new key.

  3. Check that the Team ID is correct. In your Auth0 Apple connection settings, verify that the Team ID matches the one shown in your Apple Developer account (visible in the top-right corner of the Apple Developer Portal).

  4. Test the connection in Auth0 Dashboard. Go to Auth0 Dashboard > Authentication > Social > Apple. Click Try Connection and verify that the flow succeeds using the Service ID. If this test passes but your native app flow fails, the issue is specific to how the native authorization code is being exchanged.

Please let us know if the above information helped you overcome the issue and do not hesitate reaching out to us for any other blockers or requests, we will gladly look into it!

Best regards,
Gerald