Apple Sign In

Authenticates a user using an Apple authorization_code obtained from the client-side Apple Sign-In flow. The code is exchanged server-side with Apple for identity verification. On success, GIS issues its own access_token and refresh_token, which are managed independently of Apple's authorization. If the user does not exist, a new account is created automatically.

When a user authenticates using Apple Sign-In, GIS generates its own access_token that is independent of Apple's authorization. If the user later revokes the app's access through their Apple ID settings (Settings > Apple ID > Password & Security > Apps Using Apple ID), the active GIS session is not affected, and the user is not automatically logged out.

This behavior occurs because Apple Sign-In is used only during the initial authentication process. Apple does not provide a callback or notification to GIS when a user revokes access to the app.

As a result, the user remains signed in until their GIS session expires or they explicitly log out of the app. If the user logs out and subsequently attempts to sign in again using Apple Sign-In, Apple will prompt the user to reauthorize the app to use the their Apple ID for authentication before the sign-in process can be completed.

Headers

X-Correlation-Id
Type: string

Optional caller-provided correlation ID; echoed in responses when present.

Body

required

application/json

authorization_code
Type: string
required

Apple authorization code obtained from Apple Sign In flow.
client
Type: string
required

OAuth client ID provided by the business. Required to identify the client application for authentication. The OAuth application must have the Advance Auth scope enabled.
external_source_id
Type: string
required

Apple user identifier (sub claim from Apple ID token).
privacy_policy
Type: boolean
required

Must be true to allow signup.
terms_and_conditions
Type: boolean
required

Must be true to allow signup.
redirect_uri
Type: string

Redirect URI used in Apple Sign In flow (optional).
signup_channel
Type: string enum

Signup channel identifier (optional, defaults to WebApple).
values
- WebApple
- MobileApple

Responses

application/json
application/json
application/json
application/json
application/json
application/json
application/json

post/api2/social/apple/signin

curl https://SERVER_NAME_GOES_HERE/api2/social/apple/signin \
  --request POST \
  --header 'Content-Type: application/json' \
  --data '{
  "client": "CLIENT_GOES_HERE",
  "authorization_code": "AUTHORIZATION_CODE_GOES_HERE",
  "external_source_id": "EXTERNAL_SOURCE_ID_GOES_HERE",
  "signup_channel": "WebApple",
  "privacy_policy": true,
  "terms_and_conditions": true
}'

Show Schema

{
  "data": {
    "access_token": "ACCESS_TOKEN_GOES_HERE",
    "token_type": "Bearer",
    "refresh_token": "REFRESH_TOKEN_GOES_HERE",
    "expires_in": 86400
  }
}

Authentication successful; tokens issued

Apple Sign In

Session Behavior After Users Revoke App Access From their Apple ID