Expand description
Sign in with Apple, for the iOS app.
The app asks Apple to sign the player in and sends what it gets back: an identity token (a JWT Apple signs with RS256), a one-time authorization code, and the nonce it gave Apple. Here the token is checked against Apple’s published keys (issuer, audience = one of our client ids, expiry, and the nonce’s SHA-256), then the code is traded with Apple for a refresh token. That trade is what makes a sign-in single-use (a code works once, for a few minutes) and gives the token needed to revoke the link when the player unlinks or closes their account, as Apple requires.
The client secret for those calls is a short ES256 JWT signed with the
team’s Sign in with Apple key (CHESS_APPLE_KEY).
Structs§
- Apple
- AppleId
- What a checked identity token says.
- Notice
- What Apple tells us about an Apple ID, unasked.
Functions§
- nonce_
hash - SHA-256 of the raw nonce, hex: what the app gives Apple.