Sign In With Apple on IPhone

Hello there, I have been facing an issue with apple sign in on react native app. I have been able to get the authorization and all codes in frontend part.

The issue is on backend that is in php. We are firstly validating our identity token phone generated, and then we are creating a client secret and then trying to fetch the user info the issue relies in the api call of getAppleUser($authorizationCode, $clientId, $clientSecret);: function below where we are recieving error like: {"error":"invalid_grant","error_description":"client_id mismatch. The code was not issued to com.marchup.prod.AppSSO."}

public function appleAuth($identityToken,$authorizationCode)
{

    if (!$identityToken || !$authorizationCode) {
        return $this->returnError(400,'Missing identity token or authorization code');
    }

    try {
        // Validate identity token
        $decodedToken = $this->validateAppleToken($identityToken);

        // Generate client secret
        $teamId = isset(Yii::$app->params['apple-auth']['teamId'])?Yii::$app->params['apple-auth']['teamId']:'';
        $clientId = isset(Yii::$app->params['apple-auth']['clientId'])?Yii::$app->params['apple-auth']['clientId']:'';
        $keyId = isset(Yii::$app->params['apple-auth']['keyId'])?Yii::$app->params['apple-auth']['keyId']:'';
        $privateKey = isset(Yii::$app->params['apple-auth']['privateKey'])?Yii::$app->params['apple-auth']['privateKey']:'';

        $clientSecret = $this->generateClientSecret($teamId, $clientId, $keyId, $privateKey);

        // Get user info from Apple
         $appleUser = $this->getAppleUser($authorizationCode, $clientId, $clientSecret);

        // Verify the authorization code is valid
        if (!isset($appleUser['id_token'])) {
            throw new \Exception('Invalid authorization code');
        }

        // Extract user info from the identity token
        $userId = $decodedToken->sub;
        $email = $decodedToken->email ?? '';

        // login or signup code need to know about object definition to add login and signup logic
        return $this->returnSuccess('Request successful',200,[
            'userId' => $userId, 'email' => $email
        ]);
    } catch (\Exception $e) {
        // Handle errors
        Yii::error('Error on apple login '.$e->getMessage());

        return $this->returnError(500,'Server Error');
    }
}

**This function is where i am creating a clientSecret as per apples guidelines: **

function createClientSecret($teamId, $clientId, $keyId, $privateKey) {
    // $key = file_get_contents($privateKeyPath);

    $key=$privateKey;
    $headers = [
        'kid' => $keyId,
        'alg' => 'ES256'
    ];
    $claims = [
        'iss' => $teamId,
        'iat' => time(),
        'exp' => time() + 86400 * 180,
        'aud' => 'https://appleid.apple.com',
        'sub' => $clientId
    ];
    return JWT::encode($claims, $key, 'ES256', $headers['kid']);
}

**This is the validate Apple Token that is not giving me error: **

function validateAppleToken($identityToken) {
    $client = new Client();
    $response = $client->get('https://appleid.apple.com/auth/keys');
    $keys = json_decode($response->getBody(), true)['keys'];

    $header = JWT::urlsafeB64Decode(explode('.', $identityToken)[0]);
    $headerData = json_decode($header, true);
    $kid = $headerData['kid'];

    $publicKey = null;
    foreach ($keys as $key) {
        if ($key['kid'] === $kid) {

            $publicKey = JWK::parseKey($key);
            break;
        }
    }

    if (!$publicKey) {
        throw new \Exception('Public key not found');
    }

    try {
        $decoded = JWT::decode($identityToken, $publicKey, ['RS256']);
        return $decoded;
    } catch (\Exception $e) {
        throw new \Exception('Token validation failed: ' . $e->getMessage());
    }
}

The response i got was :

{

aud: "com.abc"

auth_time: 1718017883

c_hash: "HSNFJSBdut5vk84QyK0xHA"

exp: 1718104283

iat: 1718017883

iss: "https://appleid.apple.com"

nonce:"2878cd1ac1fa121f75250f453edaac47365f5144f2e605e8b526a29cb62c83da"

nonce_supported: true

sub: "001703.2a52ec72cb874a93986522fa35742bd4.1219"

}

After that we are mainly getting error as

{"error":"invalid_grant","error_description":"client_id mismatch. The code was not issued to com.marchup.prod.AppSSO."} in this function:

function getAppleUser($authorizationCode, $clientId, $clientSecret) { try { $client = new Client();

        $response = $client->post('https://appleid.apple.com/auth/token', [
            'form_params' => [
                'client_id' => $clientId,
                'client_secret' => $clientSecret,
                'code' => $authorizationCode,
                'grant_type' => 'authorization_code'
            ]
        ]);

        if ($response->getStatusCode() !== 200) {
            throw new \Exception('Failed to get user information from Apple. Status code: ' . $response->getStatusCode());
        }

        $data = json_decode($response->getBody(), true);

        // Check if the response contains the expected data
        if (!isset($data['access_token']) || !isset($data['id_token'])) {
            throw new \Exception('Invalid response from Apple. Missing access token or ID token.');
        }

        // Return the decoded data
        return $data;
    } catch (\Exception $e) {
        // Log any other unexpected errors
        Yii::error('Unexpected error: ' . $e->getMessage());

        // Re-throw the exception to propagate it further
        throw $e;
    }
}

Assumptions: bundleId = com.marchup serviceId i created as client_id= com.marchup.prod.AppSSO team ID= as usual keyId= is the id i created in apple developer consonsole. And the private key is the key inside the private key file.

Can anyone please answer. What is mismatched here