Apple

Members sign in with their Apple ID. On iOS the sheet belongs to the operating system; elsewhere it opens the browser and returns.

Apple is also the provider you may have no choice about. Offering any other social sign-in obliges you to offer this one, or the App Store rejects the build — see Choosing providers.

Before you start

Console	Apple Developer
Endpoint group	Social Login
Email	Returned, and verified — Apple can match an existing account
Signs in	Inside the app on iOS, in the browser elsewhere
Needs	A paid Apple Developer account

Apple has no client secret. What other providers call a secret, Apple expects you to sign for yourself at the moment of each sign-in, from a private key. That is why this page asks for four things instead of two.

The four identifiers, and which is which

This is where most of the confusion lives, because three of them are called an ID and two of them look like a reverse domain name.

What Memberside asks for	What it is	Looks like
Services ID	The identifier for signing in on the web	app.yoursite.signin
Team ID	Your developer account’s team	A1B2C3D4E5
Key ID	Which Sign in with Apple key signed the request	X9Y8Z7W6V5
Private key (.p8)	The key itself	A -----BEGIN PRIVATE KEY----- block

There is a fifth identifier you do not put in the Services ID field: your app’s bundle ID, the App ID your iOS app ships under. It also looks like app.yoursite, which is exactly why it gets pasted into the wrong box.

A Services ID equal to your bundle ID fails with a misleading error

Apple answers with “Invalid client id or web redirect url”. Everyone then re-checks the redirect URL, where the fault is not. The Services ID and the bundle ID must be two different identifiers.

Memberside warns about this on the API Keys screen when it sees the two match.

Create the App ID

1. Open Certificates, Identifiers & Profiles → Identifiers.

2. Register an App ID if your app does not have one, using your app’s bundle ID.

3. Enable Sign in with Apple on it, then save.

Create the Services ID

1. Register a new identifier, type Services IDs.

   Give it a description your members will see and an identifier that is not your bundle ID. app.yoursite.signin is a good convention.

2. Enable Sign in with Apple on it, then press Configure.

3. Choose your App ID as the primary App ID.

4. Add your domain under Domains and Subdomains — yoursite.com, with no scheme and no path.

5. Add the return URL under Return URLs: the address from Memberside → API Keys → Social Login → Apple, which looks like https://yoursite.com/wp-json/memberside/v1/social/callback/apple.

6. Download the domain verification file Apple offers, but do not upload it anywhere yet — see below.

Verify your domain without uploading a file

Apple checks for a file at a fixed address on your site before it will accept the domain. You do not have to put it there yourself.

1. Open the downloaded file in a text editor and copy its contents.

2. Paste them into the Domain verification file field under Memberside → API Keys → Social Login → Apple.

3. Save. Your site now serves that content at the address Apple checks, which is shown beside the field with a copy button.

4. Go back to Apple and press Verify.

A real file on disk still wins if you would rather deploy one. The field exists because most people cannot easily drop a file into a .well-known directory on managed hosting.

Create the key

1. Open Keys and register a new key.

2. Enable Sign in with Apple, press Configure, choose your primary App ID, and save.

3. Download the .p8 file. Apple lets you download it exactly once. There is no way to retrieve it later; a lost key is replaced, not recovered.

4. Note the Key ID shown on the key’s page.

What to paste into Memberside

Under Memberside → API Keys → Social Login → Apple:

Field	Value	Required
Services ID	The Services ID, not the bundle ID	Yes
Team ID	From the top right of the developer account	Yes
Key ID	The key’s identifier	Yes
Private key (.p8)	The whole file, BEGIN and END lines included	Yes
iOS bundle ID	Your app’s bundle ID. Only the in-app button uses it	No
Domain verification file	The contents Apple gave you	No

Paste the private key whole. A key pasted without its -----BEGIN----- and -----END----- lines is read as a file path and reported as unreadable.

Set as a constant in wp-config.php, this field holds an absolute path to the file instead of the key itself. In the database it holds the key.

What Apple sends back, once

Apple returns the member’s name on the first sign-in only. Every sign-in after that carries the identifier and the email and nothing else. This is Apple’s design, not a limitation here — an account created through Apple that shows no display name was created before the name could be stored, and re-authorising does not bring it back.

Members may also choose Hide My Email, which gives you a working relay address at privaterelay.appleid.com rather than their real one. Mail sent to it reaches them until they disconnect your app.

When it does not work

Symptom	Cause	Fix
“Invalid client id or web redirect url”	The Services ID is your bundle ID	Use a separate Services ID
The same error, with a correct Services ID	The return URL is not registered on it	Add it under Configure → Return URLs
Apple will not verify the domain	The verification file is not being served	Paste its contents into the Domain verification field, then press Verify
“invalid_client”	The Team ID or Key ID does not match the key	Check all three against the key’s page
The key reports as unreadable	Pasted without its BEGIN and END lines	Paste the whole file
No name on new accounts	Apple sends the name only on the first sign-in	Expected; collect it in your profile form
Sign-in works on the web, not in the app	The iOS bundle ID is empty	Fill it in and run a new build