Apple Sign-in configuration

Configure Sign in with Apple and connect it to The Wallet Crew social sign-in.

Use this page to enable the Apple button in an enrolment form.

Start with Social sign-in to understand the customer flow. Then come back here for the provider setup.

Connect with Apple in an enrolment form example

Overview

Use this page to configure Sign in with Apple (Apple ID login) for The Wallet Crew enrolment forms.

Apple is configured in two places:

1. Apple Developer: App ID + Service ID + domains + return URLs.
2. The Wallet Crew admin: paste the Apple Service ID.

Terminology (Apple)

These terms are used in Apple Developer and OAuth setups.

• App ID: identifies the app. Uses a Bundle ID like com.brand.app.
• Service ID: identifies a web sign-in integration. This is the value pasted in The Wallet Crew.
• Domains and subdomains: where the enrolment form is hosted.
• Return URLs: OAuth / OpenID Connect callback URLs used after Apple login.

Prerequisites

• Access to the brand’s Apple Developer account.
• Permission to manage Identifiers and Service IDs.
• The list of domains where the enrolment forms will run (prod + staging + dev + custom).

Apple behavior notes

Sign in with Apple has a few behaviors that impact the enrolment journey and the matching rules.

On the first sign-in with a given Apple account, Apple can provide first name, last name, and email. On subsequent sign-ins, Apple typically returns email only. Plan forms as if only the email will be available long term.

Apple customers can enable Hide My Email. In that case, Apple returns a relay address instead of the customer’s real email.

That relay email can create duplicates if the CRM expects another identifier. When customers are emailed, delivery to Apple relay addresses may also need to be supported.

Apple’s reference: Communicating Using the Private Email Relay Service.

Configure Sign in with Apple

1

Open Identifiers

1. Log in to the Apple Developer account.

Developer Account

1. Go to Certificates, IDs & Profiles → Identifiers.

2

Create (or reuse) an App ID

1. Click + and select App IDs.

Click the + button in the identifier list.

Check that App IDs is the selected identifier type.

An existing App ID for the same domain or app can sometimes be reused. This can unlock advanced scenarios. When in doubt, ask The Wallet Crew team.

1. Select the App type.
2. Fill the form with:

   1. Description: a meaningful name for the project
   2. Bundle ID: use the value provided by The Wallet Crew (example: cloud.neostore.molia.app)
   3. Capabilities: enable Sign In with Apple

Check the Bundle ID against the value provided by The Wallet Crew.

Check that Sign In with Apple is enabled in the capabilities list.

1. Validate the form and click Register.

Check that the registered App ID appears in the identifier list.

3

Create (or reuse) a Service ID

A Service ID is required for Sign in with Apple on the web.

1. In the identifier list, switch the filter to Service IDs.
2. Click + and select Service IDs.

Click on +

Service ID

1. Fill the form with:

   1. Description: a meaningful name for the service
   2. Identifier: use the value provided by The Wallet Crew (example: cloud.neostore.molia.service)

Check the Service ID identifier against the value provided by The Wallet Crew.

1. Validate the form and click Register.

The Service ID identifier is the value to paste in The Wallet Crew admin.

4

Configure Sign in with Apple (domains + return URLs)

1. On the identifier list, select the Service ID just created.
2. Enable Sign in with Apple and click Configure.

Check that Sign in with Apple is enabled before opening Configure.

1. Fill the form with:

   1. Primary App ID: the App ID created earlier (example: cloud.neostore.molia.app)
   2. Domains and subdomains: add all domains that will host the enrolment forms (prod + staging + dev + custom)
   3. Return URLs: add the OAuth callback URL(s) for each environment

Check every return URL for an exact match, including scheme and trailing slash.

1. Validate the form and click Continue.

Apple is strict here. Use the exact values.

When the callback URL format is unclear, ask The Wallet Crew team.

5

Configure Email Communication Domains

This step is required when the brand app sends emails to customers who selected Hide My Email when signing in with Apple.

Apple generates a relay address like:

[email protected]

The sending domain must be registered, or Apple will reject those emails. Treat relay addresses like normal email addresses in the backend.

This step is required when email is sent to customers who chose Hide My Email.

Apple returns a relay email address. Treat it like a real mailbox.

Open the Services section

• In Certificates, Identifiers & Profiles, click Services in the left menu.
• Click Sign in with Apple for Email Communication.
• Click Configure.

Check that Sign in with Apple for Email Communication is the section being configured.

• Under Email Sources, click the + button to add a new email source.

Check that every sending domain and address appears under Email Sources.

Fill the form with:

• Domains and Subdomains: Add the domain(s) used to send email. Example:

  myapp.com
  mail.myapp.com

• Email Addresses: Add the sender email address(es) used by the application. Example:

[email protected]
[email protected]

Check the domains and sender addresses before submitting the form.

• Click Next and complete validation (SPF/DKIM verification if required).

Configure Apple in The Wallet Crew

1. On The Wallet Crew administration console, open:

Social Login → Apple

The Wallet Crew - Apple Social Sign In configuration

1. Fill the Service ID with the identifier used when creating the Service ID (example: cloud.neostore.molia.service).
2. Save.

Paste the Service ID identifier.

Do not paste the App ID name or the Bundle ID.

Enable Apple on the enrolment form

Enable the provider in the enrolment form settings.

Go into advanced configuration -> Layout. Open the layout where social sign-in should be activated and add these lines:

signinOptions:
  providers:
    - type: apple
      displayProps:
        isMobile: true
        isIOS: true

For more information see Enrolment form.

FAQ

Which domains do I need to add in Apple Developer?

Add every domain that can host the enrolment form.

Include prod, staging, dev, and any custom domain.

What should I put in “Return URLs”?

Add the callback URL for each environment and each form domain.

Keep it exact. Scheme, path, and trailing slash must match.

Why is only the customer’s email returned after the first login?

Apple only returns name fields on the first consent.

On later logins, Apple typically returns email only.

What is “Hide My Email” and what does it change?

Apple may return a relay email instead of the customer’s real email.

That can create duplicates when customers are matched by email only.

Apple’s reference: Communicating Using the Private Email Relay Service{target="_blank"}.

Which value do I paste in The Wallet Crew admin: Bundle ID, App ID, or Service ID?

Paste the Service ID.

Example: cloud.thewalletcrew.molia.service.