Weave Code
Socialite Apple Sign In Laravel Package
nerdzlab/socialite-apple-sign-in
A Laravel Socialite provider that adds Sign in with Apple support, handling Apple's client secret generation, token exchange, and user profile parsing so you can drop Apple login into any existing Socialite flow with minimal configuration.
At a glance
Frequently asked questions about Socialite Apple Sign In
- How do I install nerdzlab/socialite-apple-sign-in in a Laravel app?
- Install it with Composer using composer require nerdzlab/socialite-apple-sign-in, then add your Apple credentials to config/services.php and register the Apple provider so Socialite can resolve it. Because it plugs into Socialite's existing driver abstraction, your login and callback controllers stay essentially the same. After registering, redirect users with Socialite::driver('apple')->redirect() and handle the callback like any other Socialite provider.
- Which Laravel and PHP versions does this Apple Sign In provider support?
- The package targets modern Laravel releases, with Laravel 8 through 11 and PHP 8.0+ being the practical baseline reported for it. Always confirm the exact constraints in the composer.json of the tagged release you install, since patch releases like 2.2.2 do not alter dependencies. If you run an older Laravel or PHP 7.x, check compatibility before adding it to your auth stack.
- Is this package compatible with Laravel Socialite v5 and later?
- Yes, it is built as a Socialite provider that extends Laravel's OAuth abstraction rather than replacing it, so it works alongside Socialite v5-style driver registration. Verify Socialite's version constraint in your composer.json and in the package's requirements before upgrading either dependency. Because integration happens at the provider level, existing Socialite controllers and callback routes need minimal or no changes.
- How does the package generate the Apple client secret JWT?
- Apple requires a short-lived client secret signed as a JWT with ES256 using your Apple team ID, key ID, services ID, and .p8 private key. The provider builds this client secret for you and uses it during the token exchange, so you do not have to hand-roll JWT signing or refresh logic. This removes the most error-prone part of a manual Sign in with Apple integration, though you remain responsible for keeping your Apple key valid and not revoked.
- What Apple Developer credentials do I need to configure?
- You need a Services ID used as the OAuth client ID, your Apple Team ID, the Key ID of a Sign in with Apple private key, and the .p8 key file contents, plus a redirect URL registered with Apple. These values go into your services config and are passed to the provider during registration. The redirect URI must exactly match what is configured in the Apple Developer portal, including scheme and trailing slashes, or the callback will fail.
- Why is the user's name or email missing on repeat Apple logins?
- Apple only returns the user's name and email address the first time a user consents to your app; subsequent sign-ins return an identifier without that profile data. Your application must persist the name and email on first login and look them up by the Apple user identifier afterwards. This is an Apple platform behavior, not a limitation of this provider, so plan your users table and onboarding flow accordingly.
- What changed in version 2.2.2 and is it safe to upgrade?
- Version 2.2.2 is a small patch that fixes a pass-by-reference bug affecting the $headers variable in the provider's HTTP layer. There are no API changes, no deprecations, and no new configuration, so it is a drop-in upgrade from 2.2.1 with no data migration required. After upgrading, run your existing authentication tests and check logs for any header-handling warnings if you rely on custom headers.
- How can I test Sign in with Apple locally before going to production?
- Apple requires an HTTPS redirect URL, so use a tunnel such as ngrok or Expose to point a public HTTPS host at your local app and register that URL as the return URL for your Services ID. Test the full callback with a sandbox Apple ID, verify the first-consent flow captures name and email, then repeat a second sign-in to confirm your fallback logic. Running this in a staging environment first is the safest sequencing before promoting to production.
- What happens if my Apple client secret expires or my signing key is revoked?
- An expired client secret or revoked Sign in with Apple key will cause token exchange failures at Apple's endpoint, typically surfacing as invalid_client errors in your logs. Because the provider generates the client secret from your key material, the fix is to confirm your key ID, team ID, and .p8 contents are current and rotate the key in the Apple Developer portal if needed. Monitor authentication error rates and alert on callback failures so an expired credential does not silently break logins.
- Is this package actively maintained, and what are the alternatives?
- It is community-maintained by nerdzlab with no commercial support, so support comes from GitHub issues and the wider Laravel Socialite community. The 2.2.2 patch shows responsive but not high-velocity maintenance, which is typical for a focused provider package. Alternatives include other Socialite Apple providers or a custom OAuth implementation, but those push client secret generation and Apple API tracking onto your own team.
Weaver
How can I help you explore Laravel packages today?