Skip to content

Apple

reauth.factors.oauth2.apple

AppleOAuth2Factor 

AppleOAuth2Factor(
    *,
    identifier: str = "apple",
    client_id: str,
    team_id: str,
    key_id: str,
    key_value: str,
    state_service: OAuth2StateService,
    step: int = 0,
    advance_by: int = 1,
)

Bases: OIDCFactorBase, ABC

Apple OAuth2 factor implementation using OpenID Connect.

Unlike most OAuth providers, Apple requires a dynamic client secret generated as a JWT and signed with your private key for each authorization request. This implementation generates the client secret on-demand using ES256.

Note: Apple does NOT support a userinfo endpoint. Profile data must be extracted from the id_token using get_id_token_claims().

References
  • Apple: https://developer.apple.com/documentation/accountorganizationaldatasharing/creating-a-client-secret

team_id instance-attribute 

team_id = team_id

key_id instance-attribute 

key_id = key_id

key_value instance-attribute 

key_value = key_value

get_authorization_url async 

get_authorization_url(
    *,
    redirect_uri: str,
    scope: list[str] | None = None,
    state: str,
    code_challenge: str | None = None,
    code_challenge_method: CodeChallengeMethod
    | None = None,
    nonce: str | None = None,
    extra: OIDCExtraParams | None = None,
) -> str

get_request_authentication async 

get_request_authentication(
    *, token_endpoint: str
) -> tuple[dict[str, str], dict[str, str]]

Authenticate with a per-request JWT client secret (Apple Sign In).

Apple requires a short-lived ES256-signed JWT as the client secret, sent as a client_secret_post body parameter.

Returns:

Type Description
tuple[dict[str, str], dict[str, str]]

A tuple of (no extra headers, body with the client_id and JWT secret).

get_profile async 

get_profile(access_token: str) -> dict[str, typing.Any]

Apple does not support userinfo endpoint.

Use get_id_token_claims(id_token) instead to extract profile from id_token.

Parameters:

Name Type Description Default
access_token str

The OAuth2 access token (unused for Apple).

 required

Raises:

Type Description
NotImplementedError

Always, since Apple has no userinfo endpoint.