Log in With Apple

A user can sign in with Apple using a random email ID generated by Apple.

Session Behavior After Users Revoke App Access From their Apple ID

When a user authenticates using Apple Sign-In, Punchh generates its own access token that is independent of Apple's authorization. If the user later revokes the app's access through their Apple ID settings (Settings > Apple ID > Password & Security > Apps Using Apple ID), the active Punchh session is not affected, and the user is not automatically logged out.

This behavior occurs because Apple Sign-In is used only during the initial authentication process. Apple does not provide a callback or notification to Punchh when a user revokes access to the app.

As a result, the user remains signed in until their Punchh session expires or they explicitly log out of the app. If the user logs out and subsequently attempts to sign in again using Apple Sign-In, Apple will prompt the user to reauthorize the app to use the their Apple ID for authentication before the sign-in process can be completed.

Headers

x-pch-digest
Type: string
required

The signature for the API call
Content-Type
Type: string
required

Set this header to application/json.
Accept
Type: string
required

Advertises which content types the client is able to understand
User-Agent
Type: string
required

Used to identify the software, device, and application initiating the request, providing information about the client to the server. For details, see User Agent.

Body

application/json

client
Type: string
required

OAuth client ID provided by the business
user
Type: object

Responses

application/json

post/api2/mobile/apple_registrations

curl https://SERVER_NAME_GOES_HERE.punchh.com/api2/mobile/apple_registrations \
  --request POST \
  --header 'x-pch-digest: {{$$.env.signature}}' \
  --header 'Content-Type: application/json' \
  --header 'Accept: application/json' \
  --header 'User-Agent: AppName/AppVersion/BuildNumber (OS; Model; MANUFACTURER; MODEL; OS Version)' \
  --data '{
  "client": "CLIENT_KEY_GOES_HERE",
  "user": {
    "first_name": "FIRST_NAME_GOES_HERE",
    "last_name": "LAST_NAME_GOES_HERE",
    "gender": "Male",
    "external_source": "SOURCE_GOES_HERE",
    "external_source_id": "SOURCE_ID_GOES_HERE",
    "authorization_code": "AUTHORIZATION_CODE_GOES_HERE",
    "age_verified_status": true
  }
}'

Show Schema

{
  "access_token": {
    "token": "ACCESS_TOKEN_GOES_HERE",
    "seconds_to_expire": null,
    "revoked_at": null,
    "refresh_token": "REFRESH_TOKEN_GOES_HERE",
    "scopes": []
  },
  "user": {
    "address": null,
    "anniversary": null,
    "avatar_remote_url": null,
    "birthday": null,
    "city": null,
    "communicable_email": "test@example.com",
    "created_at": "2019-09-05T03:39:10-07:00",
    "email": "test@example.com",
    "email_verified": false,
    "facebook_signup": null,
    "apple_signup": null,
    "apple_uid": "APPLE_UID_GOES_HERE",
    "favourite_location_ids": "315783",
    "favourite_store_numbers": "",
    "fb_uid": "FB_UID_GOES_HERE",
    "first_name": "FIRST_NAME_GOES_HERE",
    "gender": "Male",
    "has_generated_fb_email": false,
    "last_name": "LAST_NAME_GOES_HERE",
    "marketing_email_subscription": true,
    "marketing_pn_subscription": true,
    "migrate_status": false,
    "passcode_configured_for_giftcards": false,
    "phone": null,
    "profile_field_answers": {},
    "referral_code": "REFERRAL_CODE_GOES_HERE",
    "referral_path": "URL_GOES_HERE",
    "secondary_email": null,
    "state": null,
    "superuser": false,
    "terms_and_conditions": false,
    "title": null,
    "updated_at": "2019-09-17T04:35:56-07:00",
    "user_as_qrcode": "QR_CODE_GOES_HERE",
    "user_code": "P11111111",
    "user_id": 111111111,
    "preferred_locale": "en",
    "user_relations": [],
    "zip_code": null,
    "verification_mode": null,
    "sms_subscription": false,
    "apple_pass_url": "APPLE_PASS_URL_GOES_HERE",
    "google_pass_url": "GOOGLE_PASS_URL_GOES_HERE",
    "age_verified_status": true,
    "user_joined_at": "2019-09-05T03:39:10-07:00"
  }
}

The response returns basic details about the user account, including the access token that you must use to authenticate other API calls on the user's behalf.