Skip to main content

Sign in with Apple

This guide teaches you how to add native Sign in with Apple to your Clerk apps on Apple platforms.

Important

This setup covers the native flow only. Clerk identifies the native app with its exact App ID Prefix and Bundle ID. If your app uses hosted authentication, Account Portal opens in a browser, where Sign in with Apple uses hosted Apple credentials instead. On production instances, configure those through the Apple social connection.

Note

Sign in with Apple works on both iOS Simulators and physical devices. However, physical devices provide full functionality including biometric authentication (Face ID/Touch ID), while simulators have limited support. Always test on a physical device before releasing to production.

From your Xcode project or workspace directory, run the Clerk CLI with npx and choose to enable native Sign in with Apple:

terminal
npx clerk@latest init

The CLI adds the Apple entitlement, registers your native app, and enables Native API and Apple sign-in on the linked development instance. Existing hosted Apple credentials are preserved. To add Apple sign-in after an earlier setup, run npx clerk@latest init --sign-in-with-apple.

The CLI reads your Bundle ID and uses the App ID Prefix from a matching Clerk registration or, otherwise, your project's signing team, which is usually the same. If it asks for a prefix, copy App ID Prefix from your app's identifier in the Apple Developer portal; it's usually your Apple Team ID.

For a customized app, finish any remaining Swift integration with the iOS QuickstartiOS Icon, then build and test sign-in.

Configure manually

Add your native application

On the Native applications page in the Clerk Dashboard, enable the Native API, then add your iOS application. You will need your iOS app's App ID Prefix and Bundle ID.

Enable Apple as a social connection

  1. In the Clerk Dashboard, navigate to the SSO connections page.
  2. Select Add connection and select For all users.
  3. Select Apple from the provider list.
  4. Ensure that Enable for sign-up and sign-in is toggled on.

Note

Apple provides a privacy feature called Hide My Email, allowing users to sign in to your app with Apple without disclosing their actual email addresses. Instead, your instance receives an app-specific email address that forwards any emails to the user's real address. To be able to send emails properly to users with hidden addresses, you must configure an additional setting in the Apple Developer portal. See Configure Email Source for Apple Private Relay for more information.

Add the Sign in with Apple capability to your app

Add the Sign in with Apple capability to your app.

Note

If you are using Clerk's prebuilt components, you don't need to do anything else and can stop here. The SignInWithApple button will appear in your AuthView automatically. If you are building a , continue to follow the steps below.

Build your sign-in flow

Use clerk.auth.signInWithApple() to start the native Sign in with Apple flow:

try await clerk.auth.signInWithApple()

Configure your production instance

clerk init configures only the linked development instance. For production, add the exact App ID Prefix and Bundle ID registration to the production instance, enable the Native API, enable Apple for that Bundle ID, configure the Release build with the production Publishable Key, and add the production associated domain to its entitlements path. A native-only Apple flow still doesn't need hosted Apple credentials.

clerk deploy and clerk deploy status check the Clerk side of this setup. They count native Sign in with Apple as configured once the production instance has the Bundle ID registration, Native API is enabled, and Apple is enabled. Until then, they explain what's missing and link to the production instance's Native applications page. They don't inspect your Xcode project, so check the Release build's Publishable Key and associated domain yourself.

Troubleshooting

I’m not receiving the user’s first and last name from Apple

Apple only provides fullName the very first time a user authorizes your app with Sign in with Apple. On subsequent sign-ins (or if the user already authorized your app in the past), Apple does not resend the name.

If you expected a name and didn’t receive one, check the following:

  • First-time authorization only: If this isn’t the user’s first authorization for this app, Apple will not return fullName. You should store the name the first time you receive it and treat it as optional after that. Deleting the user from Clerk does not reset this on Apple’s side.
  • Requested scopes: Make sure your Sign in with Apple request includes the fullName scope (and email, if you need it). If fullName wasn’t requested, Apple won’t prompt the user to share it.
  • User denied name sharing: If the user chooses not to share their name, Apple won’t provide it. Make sure your UI can collect a name as a fallback.

To test the first-time flow again, delete the user from Clerk, revoke the app’s authorization in iOS (Settings → Apple ID → Sign in with Apple → your app → Delete), and sign in again.

Feedback

What did you think of this content?

Last updated on

GitHubEdit on GitHub