Laravel Sign In With Apple Laravel Package

Product Decisions This Supports

• Enabling "Sign in with Apple" for iOS/macOS clients. If your product offers any third-party social login on iOS, App Store guideline 4.8 effectively forces this — so the real decision is build vs buy, and this package tips it toward buy.
• Roadmap de-risking: 13.0.0 adds Laravel 13 and PHP 8.5 support, so scheduling your framework upgrade no longer requires forking or hand-maintaining this integration.
• Compliance/account-deletion flows: new handling of Apple access-revocation notifications supports user-initiated revocation and account-deletion requirements without bespoke webhook work.
• Auth reliability decisions: new descriptive exceptions for Apple token errors, invalid_client, and missing authorization codes, plus graceful 5xx handling, change the calculus from "we'll build it and debug blind" to "we get diagnosable failures out of the box."
• Build-vs-buy for the OAuth plumbing: the new PHP client_secret JWT generator removes a small but easy-to-get-wrong crypto task; standardize on the package rather than duplicating ES256 signing logic.
• Route/controller surface ownership: auto-registered Apple Sign In routes and controller make the fast path a true "buy," but the decision now includes whether to use those defaults or supply a custom controller for branded/custom UX.
• Major-version upgrade planning: 13.0.0 is a breaking release (config keys moved under services.apple, plus new auto-routes), which is itself a roadmap item — pin and schedule.

When to Consider This Package

Adopt when:

• You're building on Laravel (13.x now supported) and need server-side Sign in with Apple token exchange.
• You want the client_secret JWT generated for you instead of maintaining an in-house signer.
• You need Apple's failure modes to surface as descriptive exceptions (invalid_client, missing authorization code, Apple 5xx) rather than silent failures.
• You need to react to Apple access-revocation notifications for account deletion or token lifecycle management.
• You can absorb a major-version bump: the config namespace moved to services.apple, so existing config files, env mappings, and any code reading the old keys must be updated. Treat 13.0.0 as breaking and plan an upgrade spike.

Look elsewhere when:

• You're not on Laravel — the package is framework-coupled (routes, config, controller); the underlying exchange logic would need to be reimplemented.
• You need a multi-provider abstraction. Laravel Socialite covers Apple alongside other providers; this package is deliberately Apple-only.
• You can't take a major bump right now — pin 12.x until you can test. The config-key rename and newly auto-registered routes/controller are behavioral changes, not just additive.
• You require a vendor SLA or multi-maintainer support — this is single-maintainer OSS.

How to Pitch It (Stakeholders)

Executives: Apple requires that iOS apps offering third-party login also offer Sign in with Apple. This package lets us ship that with minimal engineering effort instead of building and maintaining Apple's OAuth token exchange and client-secret signing ourselves. The new 13.0.0 release keeps us current with Laravel 13 and PHP 8.5 — protecting our upgrade timeline — and adds the error handling and access-revocation support we need for account-deletion compliance. Cost is low and the risk is contained to a scheduled upgrade.

Engineering: 13.0.0 is a major release. Highlights: Laravel 13 / PHP 8.5 support, a PHP client_secret JWT generator, descriptive exceptions for Apple token errors and invalid_client, redirect-URL validation, graceful Apple 5xx handling, a CSRF-token-mismatch fix on the callback, and auto-registered routes plus a controller. Two things to plan for before upgrading: (1) config keys moved under services.apple — update config, env mappings, and any direct config reads; (2) auto-registered routes mean you should confirm the default endpoints/controller fit our auth flow, or disable them and wire our own. Budget a short spike to verify the callback/CSRF path and the revocation handler in staging.