Expand description
§Backend for Sign In With Apple
Provides verification of identityToken from Apple’s docs at: https://developer.apple.com/documentation/signinwithapplerestapi/verifying_a_user
To verify the identity token, your app server must:
-
Fetch Apple’s public key to verify the ID token signature.
-
Verify the
JWS E256
signature using the server’s public key -
Verify the nonce for the authentication
-
Verify that the
iss
field contains https://appleid.apple.com -
Verify that the
aud
field is the developer’s client_id -
Verify that the time is earlier than the
exp
value of the token