> For the complete documentation index, see [llms.txt](https://docs.thewalletcrew.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.thewalletcrew.io/guides-enrolment/enrolment/enrolment-form/social-sign-in/apple-sign-in.md). # Apple Sign-in configuration Configure Sign in with Apple and connect it to The Wallet Crew social sign-in. Use this page to enable the **Apple** button in an enrolment form. Start with [Social sign-in](/guides-enrolment/enrolment/enrolment-form/social-sign-in.md) to understand the customer flow. Then come back here for the provider setup.

Apple-Social-Sign-In-Example — Connect with Apple in an enrolment form example

### Overview Use this page to configure **Sign in with Apple** (Apple ID login) for **The Wallet Crew** enrolment forms. Apple is configured in two places: 1. **Apple Developer**: App ID + Service ID + domains + return URLs. 2. **The Wallet Crew admin**: paste the Apple **Service ID**. #### Terminology (Apple) These terms are used in Apple Developer and OAuth setups. * **App ID**: identifies the app. Uses a **Bundle ID** like `com.brand.app`. * **Service ID**: identifies a web sign-in integration. This is the value pasted in The Wallet Crew. * **Domains and subdomains**: where the enrolment form is hosted. * **Return URLs**: OAuth / OpenID Connect callback URLs used after Apple login. #### Prerequisites * Access to the brand’s **Apple Developer** account. * Permission to manage **Identifiers** and **Service IDs**. * The list of domains where the enrolment forms will run (prod + staging + dev + custom). #### Apple behavior notes Sign in with Apple has a few behaviors that impact the enrolment journey and the matching rules. On the **first sign-in** with a given Apple account, Apple can provide **first name**, **last name**, and **email**. On **subsequent sign-ins**, Apple typically returns **email only**. Plan forms as if only the email will be available long term. {% hint style="warning" %} Apple customers can enable **Hide My Email**. In that case, Apple returns a relay address instead of the customer’s real email. That relay email can create duplicates if the CRM expects another identifier. When customers are emailed, delivery to Apple relay addresses may also need to be supported. {% endhint %} Apple’s reference: [Communicating Using the Private Email Relay Service](https://developer.apple.com/documentation/signinwithapple/communicating-using-the-private-email-relay-service/). ### Configure Sign in with Apple {% stepper %} {% step %} #### **Open Identifiers** 1. Log in to the Apple Developer account.

2. Go to `Certificates, IDs & Profiles` → `Identifiers`. {% endstep %} {% step %} #### **Create (or reuse) an App ID** 1. Click `+` and select `App IDs`.

Click on + — Click the + button in the identifier list.

> An existing App ID for the same domain or app can sometimes be reused. This can unlock advanced scenarios. When in doubt, ask The Wallet Crew team. 2. Select the `App` type. 3. Fill the form with: 1. **Description**: a meaningful name for the project 2. **Bundle ID**: use the value provided by The Wallet Crew (example: `cloud.neostore.molia.app`) 3. **Capabilities**: enable `Sign In with Apple`

Description and Bundle ID — Check the Bundle ID against the value provided by The Wallet Crew.

Capabilities — Check that Sign In with Apple is enabled in the capabilities list.

4. Validate the form and click `Register`.

Create (or reuse) an App ID — Check that the registered App ID appears in the identifier list.

{% endstep %} {% step %} #### **Create (or reuse) a Service ID** A **Service ID** is required for Sign in with Apple on the web. 1. In the identifier list, switch the filter to `Service IDs`. 2. Click `+` and select `Service IDs`.

3. Fill the form with: 1. **Description**: a meaningful name for the service 2. **Identifier**: use the value provided by The Wallet Crew (example: `cloud.neostore.molia.service`)

4. Validate the form and click `Register`. {% hint style="info" %} The **Service ID identifier** is the value to paste in The Wallet Crew admin. {% endhint %} {% endstep %} {% step %} #### **Configure Sign in with Apple (domains + return URLs)** 1. On the identifier list, select the Service ID just created. 2. Enable `Sign in with Apple` and click `Configure`.

Configure Sign in with Apple (domains + return URLs) — Check that Sign in with Apple is enabled before opening Configure.

3. Fill the form with: 1. **Primary App ID**: the App ID created earlier (example: `cloud.neostore.molia.app`) 2. **Domains and subdomains**: add all domains that will host the enrolment forms (prod + staging + dev + custom) 3. **Return URLs**: add the OAuth callback URL(s) for each environment

Return URLs — Check every return URL for an exact match, including scheme and trailing slash.

4. Validate the form and click **Continue**. {% hint style="warning" %} Apple is strict here. Use the exact values. When the callback URL format is unclear, ask The Wallet Crew team. {% endhint %} {% endstep %} {% step %} #### Configure Email Communication Domains This step is required when the brand app sends emails to customers who selected **Hide My Email** when signing in with Apple. Apple generates a relay address like: > The sending domain must be registered, or Apple will reject those emails. Treat relay addresses like normal email addresses in the backend. {% hint style="info" %} This step is required when email is sent to customers who chose **Hide My Email**. Apple returns a **relay email address**. Treat it like a real mailbox. {% endhint %} **Open the Services section** * In **Certificates, Identifiers & Profiles**, click **Services** in the left menu. * Click **Sign in with Apple for Email Communication**. * Click **Configure**.

Configure — Check that Sign in with Apple for Email Communication is the section being configured.

* Under **Email Sources**, click the **+** button to add a new email source.

**Fill the form with:** * **Domains and Subdomains**:\ Add the domain(s) used to send email.\ Example: ``` myapp.com mail.myapp.com ``` * **Email Addresses**:\ Add the sender email address(es) used by the application.\ Example: ``` noreply@myapp.com support@myapp.com ```

* Click **Next** and complete validation (SPF/DKIM verification if required). {% endstep %} {% endstepper %} ### Configure Apple in The Wallet Crew 1. On The Wallet Crew administration console, open:

Social Login → Apple

The Wallet Crew - Apple Social Sign In configuration

2. Fill the **Service ID** with the identifier used when creating the Service ID (example: `cloud.neostore.molia.service`). 3. Save. {% hint style="info" %} Paste the **Service ID** identifier. Do not paste the App ID name or the Bundle ID. {% endhint %} ### Enable Apple on the enrolment form Enable the provider in the enrolment form settings. Go into `advanced configuration -> Layout`. Open the layout where social sign-in should be activated and add these lines: ```yaml signinOptions: providers: - type: apple displayProps: isMobile: true isIOS: true ``` For more information see [Enrolment form](/guides-enrolment/enrolment/enrolment-form.md). ### FAQ

Which domains do I need to add in Apple Developer?

Add every domain that can host the enrolment form. Include prod, staging, dev, and any custom domain.

What should I put in “Return URLs”?

Add the callback URL for each environment and each form domain. Keep it exact. Scheme, path, and trailing slash must match.

Why is only the customer’s email returned after the first login?

Apple only returns name fields on the first consent. On later logins, Apple typically returns email only.

What is “Hide My Email” and what does it change?

Apple may return a relay email instead of the customer’s real email. That can create duplicates when customers are matched by email only. Apple’s reference: [Communicating Using the Private Email Relay Service](https://developer.apple.com/documentation/signinwithapple/communicating-using-the-private-email-relay-service/){target="\_blank"}.

Which value do I paste in The Wallet Crew admin: Bundle ID, App ID, or Service ID?

Paste the **Service ID**. Example: `cloud.thewalletcrew.molia.service`.

--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.thewalletcrew.io/guides-enrolment/enrolment/enrolment-form/social-sign-in/apple-sign-in.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.