Let users create an account with Apple
Web account registration
Better Auth · Const
apple
apple is the Better Auth social-provider identifier for Sign in with Apple. Configure Apple credentials under socialProviders.apple, allow Apple's trusted origin, and invoke the flow with signIn.social({ provider: "apple" }).
How it works
Apple is selected by registering an apple entry under socialProviders and by passing provider: "apple" to signIn.social. The provider requires Apple credentials, while the authentication flow redirects the user to Apple and then back to Better Auth's callback route.
Syntax
socialProviders: { apple: { clientId, clientSecret } }
await authClient.signIn.social({ provider: "apple", callbackURL })Parameters
| Name | Type | Description |
|---|---|---|
provider | string | The social provider identifier; set it to apple. |
callbackURL | string | The URL to use after successful provider authentication. |
Returns
The page documents initiating social sign-in through the client; it does not specify a separate return type for the Apple identifier.
Key points
- Apple setup requires four pieces of provider information: client ID, Team ID, Key ID, and private key.
- Enable Apple by adding an
appleprovider configuration to the auth instance'ssocialProvidersoption. - The social sign-in provider identifier for Apple is the string
apple. - Start the browser-based Apple login through the client's
signIn.socialfunction. - Apple's Service ID configuration must include the application's Better Auth callback URL as a return URL.
- Create or retrieve the Apple credentials in the Apple Developer Portal before configuring Better Auth.
Common mistakes
- Add Apple's origin to
trustedOrigins; omitting it prevents the required communication with Apple's authentication servers. - The Apple client secret is not a static arbitrary string; generate it dynamically as a JWT using the required Apple key material.
Example: Configure Apple sign-in
import { betterAuth } from "better-auth";
export const auth = betterAuth({
trustedOrigins: ["https://appleid.apple.com"],
socialProviders: {
apple: {
clientId: process.env.APPLE_CLIENT_ID!,
clientSecret: process.env.APPLE_CLIENT_SECRET!,
},
},
});
// In a client module:
await authClient.signIn.social({
provider: "apple",
callbackURL: "/dashboard",
});Configures Apple as a social provider and starts an Apple sign-in flow with a post-login redirect.
When to use it
Offer Apple as a passwordless social login option
Returning-user authentication
Use Apple credentials for applications sharing one Better Auth backend
Cross-platform identity
Interview questions
QHow do you configure Apple sign-in?
Register Apple in the auth instance's socialProviders configuration with a client ID and generated client secret. Also include Apple's origin in trustedOrigins.
Follow-up: How is Apple selected at sign-in time? Call signIn.social with an object whose provider property is "apple".
QWhat credentials does Apple require?
Use the Apple Developer Portal to obtain the client ID, Team ID, Key ID, and private key. Those values are used to create the client-secret JWT required by Apple.
Follow-up: What callback must Apple be configured to accept? Use the Better Auth callback URL in the form /api/auth/callback/apple under the application's domain.
QHow is the Apple provider invoked?
The client sign-in call uses signIn.social({ provider: "apple" }); an optional callback URL can redirect the user after authentication. Better Auth handles the provider flow through its social sign-in API.
Follow-up: Can a social flow avoid redirecting to Apple's site? The documentation also describes authenticating with an ID token or access token from the provider.
Related
socialProviderssignIn.socialtrustedOriginsclientIdclientSecretcallbackURL