expo: [expo-apple-authentication] Sign In With Apple won't work on Expo Go and Firebase due to wrong audience (aud) in identityToken JWT as `"aud": "host.exp.Exponent"` returned by Apple after signInAsync()

One workaround in a development environment is to do this:

The only thing that helped was setting optional Services ID to host.exp.Exponent in Firebase Console -> Authentication -> Sign-in method -> Apple.

From: https://martinliptak.medium.com/thanks-for-the-article-ec172f979048

@charlestbell It’s done under Firebase’s “project settings”. I only use Expo Go during development and for that purpose adding the additional “app” with Expo Go’s bundle ID worked for me.

Another option is to simply add another iOS app to the Firebase project with Bundle ID host.exp.Exponent. That way Firebase will accept the bundle ID as a valid audience. I don’t know if this solution has any downsides.

I’ve also been able to make it work with Supabase only by adding host.exp.Exponent to the allowed client ID’s. I imagine for dev and prod environments, I’ll just have two separate Supabase projects to handle that, even tho it would be annoying to have all configurations duplicated…

I did neither of them. I just sucked it up and didn’t do anything.

On Sun, Apr 24, 2022 at 3:59 PM, Pedro Netto < @.*** > wrote:

Thanks for letting me know @ ansh ( https://github.com/ansh ) 🤝 Which route did you go? Could you maybe provide any details on how you made it happen? Thanks!

— Reply to this email directly, view it on GitHub ( https://github.com/expo/expo/issues/16162#issuecomment-1107917241 ) , or unsubscribe ( https://github.com/notifications/unsubscribe-auth/AB6T25KPUEVNQZTXMCAZYI3VGWY2DANCNFSM5NLNYGOQ ). You are receiving this because you were mentioned. Message ID: <expo/expo/issues/16162/1107917241 @ github. com>

Right now, expo-apple-authentication’s signInAsync() function returns an object that contains the identityToken which is what we really need to authenticate using Firebase. This identityToken is just a simple JWT with the payload data for the "aud": "host.exp.Exponent". This is the problem. There is no way to change the data sent to signInAsync() or any option to customize what aud (audience) is received by Apple. So when Apple gets our sign in request, they just return the same aud (audience) back to us in the identityToken. However, one fix from Expo’s side could be is to help us define the aud or Service ID in app.json and that way signInAsync() can use that instead of using “host.exp.Exponent”. This is a good fix since using “host.exp.Exponent” does not seem like a good idea anyway since user data will be going through Expo’s Service ID and Expo’s account on Apple Developer.

That’s what I did. Didn’t realize that’s what you are asking for. But essentially you will have to change that each time you want to run dev mode or prod. … On Mon, Apr 25 2022 at 05:29, Pedro Netto < @.*** > wrote: One workaround in development environment is to do this: > > > The only thing that helped was setting optional Services ID to > host.exp.Exponent in Firebase Console -> Authentication -> Sign-in method > -> Apple. > > From: https://martinliptak.medium.com/thanks-for-the-article-ec172f979048 — Reply to this email directly, view it on GitHub ( #16162 (comment) ) , or unsubscribe ( https://github.com/notifications/unsubscribe-auth/AB6T25KFID6VAQOXYBLP73TVGZXY5ANCNFSM5NLNYGOQ ). You are receiving this because you were mentioned. Message ID: <expo/expo/issues/16162/1108388415 @ github. com>

Worked for me too. Also you shouldn’t have to change it if you use a different firebase project for prod vs test.

this is documented here: https://docs.expo.dev/versions/latest/sdk/apple-authentication/#development-and-testing

you may want to use expo-dev-client instead to customize this further: https://docs.expo.dev/versions/latest/sdk/apple-authentication/#configuration

Regarding dev and prod with Supabase, for local development apparently you need to put host.expo.Exponent for allowed client ID’s, but when on TestFlight you need to put your App bundle ID ( for example com.app.myapp ), you can comma separate them.

Like below 👇

I’ve also been able to make it work with Supabase only by adding host.exp.Exponent to the allowed client ID’s. I imagine for dev and prod environments, I’ll just have two separate Supabase projects to handle that, even tho it would be annoying to have all configurations duplicated…

Thank you! I was missing this part by adding host.exp.Exponent to the allowed client ID's.

Hello, My apple sign in work fine on Expo Go and Simulator but when i want to connect with TestFlight, nothing happens. So Apple send me a review that : " We discovered one or more bugs in your app. Specifically, the app stays on the login screen when attempting to log in using Sign in with Apple. ". I don’t know why this happen. My code : const loginWithApple = () => { const nonce = Math.random().toString(36).substring(2, 10);

    return Crypto.digestStringAsync(Crypto.CryptoDigestAlgorithm.SHA256, nonce)
        .then((hashedNonce) =>
            AppleAuthentication.signInAsync({
                requestedScopes: [
                    AppleAuthentication.AppleAuthenticationScope.FULL_NAME,
                    AppleAuthentication.AppleAuthenticationScope.EMAIL
                ],
                nonce: hashedNonce
            })
        )
        .then(async (appleCredential) => {
            const { identityToken } = appleCredential;
            const provider = new firebase.auth.OAuthProvider('apple.com');
            const credential = await provider.credential({
                idToken: identityToken,
                rawNonce: nonce
            });
            await firebase.auth().signInWithCredential(credential).then((res) => {
                const profileInfo = res.user.providerData[0];
                const uid = res.user.uid;
                let action = addUserOnFirestore(
                    uid,
                    profileInfo.email,
                    profileInfo.displayName?.split(" ")[0],
                    profileInfo.displayName?.split(" ")[2],
                    profileInfo.photoURL,
                    res,
                    props.navigation
                );

                setIsLoading(true);
                try {
                    dispatch(action);
                } catch (err) {
                    setError(err.message);
                }
                setIsLoading(false);
            });
            // Successful sign in is handled by firebase.auth().onAuthStateChanged
        })
        .catch((error) => {
            console.log('Error : ', error);
        });
}

Did I missing something ? Thanks to all in advance.

That’s what I did. Didn’t realize that’s what you are asking for. But essentially you will have to change that each time you want to run dev mode or prod.

On Mon, Apr 25 2022 at 05:29, Pedro Netto < @.*** > wrote:

One workaround in development environment is to do this:

The only thing that helped was setting optional Services ID to host.exp.Exponent in Firebase Console -> Authentication -> Sign-in method -> Apple.

From: https://martinliptak.medium.com/thanks-for-the-article-ec172f979048

— Reply to this email directly, view it on GitHub ( https://github.com/expo/expo/issues/16162#issuecomment-1108388415 ) , or unsubscribe ( https://github.com/notifications/unsubscribe-auth/AB6T25KFID6VAQOXYBLP73TVGZXY5ANCNFSM5NLNYGOQ ). You are receiving this because you were mentioned. Message ID: <expo/expo/issues/16162/1108388415 @ github. com>