Skip to content
Migrating from NextAuth.js v4? Read our migration guide.
API reference


Built-in sign in with Apple integration.


The returned user profile from Apple when using the profile callback.


  • Record<string, any>



at_hash: string;


aud: string;

The audience registered claim identifies the recipient for which the identity token is intended. Since the token is meant for your application, the value is the client_id from your developer account.


auth_time: number;


email: string;

A String value representing the user’s email address. The email address is either the user’s real email address or the proxy address, depending on their status private email relay service.


email_verified: true | "true";

A String or Boolean value that indicates whether the service has verified the email. The value of this claim is always true, because the servers only return verified email addresses. The value can either be a String ("true") or a Boolean (true).


exp: number;

The expiration time registered identifies the time on or after which the identity token expires, in terms of number of seconds since Epoch, in UTC. The value must be greater than the current date/time when verifying the token.


iat: number;

The issued at registered claim indicates the time at which Apple issued the identity token, in terms of the number of seconds since Epoch, in UTC.


is_private_email: boolean | "true" | "false";

A String or Boolean value that indicates whether the email shared by the user is the proxy address. The value can either be a String ("true" or "false") or a Boolean (true or false).


iss: "";

The issuer registered claim identifies the principal that issued the identity token. Since Apple generates the token, the value is


nonce: string;

A String value used to associate a client session and the identity token. This value mitigates replay attacks and is present only if passed during the authorization request.


nonce_supported: boolean;

A Boolean value that indicates whether the transaction is on a nonce-supported platform. If you sent a nonce in the authorization request but don’t see the nonce claim in the identity token, check this claim to determine how to proceed. If this claim returns true, you should treat nonce as mandatory and fail the transaction; otherwise, you can proceed treating the nonce as options.


real_user_status: 0 | 1 | 2;

An Integer value that indicates whether the user appears to be a real person. Use the value of this claim to mitigate fraud. The possible values are: 0 (or Unsupported), 1 (or Unknown), 2 (or LikelyReal). For more information, see ASUserDetectionStatus. This claim is present only on iOS 14 and later, macOS 11 and later, watchOS 7 and later, tvOS 14 and later; the claim isn’t present or supported for web-based apps.


sub: string;

The subject registered claim identifies the principal that’s the subject of the identity token. Since this token is meant for your application, the value is the unique identifier for the user.


transfer_sub: string;

A String value representing the transfer identifier used to migrate users to your team. This claim is present only during the 60-day transfer period after an you transfer an app. For more information, see Bringing New Apps and Users into Your Team.


default<P>(options): OAuthConfig<P>


Callback URL


import { Auth } from "@auth/core"
import Apple from "@auth/core/providers/apple"
const request = new Request(origin)
const response = await Auth(request, {
  providers: [
      clientId: APPLE_CLIENT_ID,
      clientSecret: APPLE_CLIENT_SECRET,



The Apple provider comes with a default configuration. To override the defaults for your use case, check out customizing a built-in OAuth provider.


If you think you found a bug in the default configuration, you can open an issue.

Auth.js strictly adheres to the specification and it cannot take responsibility for any deviation from the spec by the provider. You can open an issue, but if the problem is non-compliance with the spec, we might not pursue a resolution. You can ask for more help in Discussions.

Type parameters

Type parameter
P extends AppleProfile


optionsOmit<OAuthUserConfig<P>, "clientSecret"> & { clientSecret: string; }



Auth.js © Balázs Orbán and Team - 2024