[Bug] iOS: BadRequestRestException: Bad Request (Unacceptable audience in id_token: xxx)

[658jjh]

General Info

• I checked for similar bug report
• I am using the latest version
• I checked the troubleshooting page for similar problems

Version(s)

3.1.4

Kotlin Target(s) and their respective versions

JVM 17, iOS18

What happened? (include your code)

Hi, I’m running into an issue when trying to implement login with Apple on iOS using Supabase in a Kotlin Multiplatform (KMP) project.

Google login works fine on Android, and the Apple login code is basically the same in structure. But when I try to sign in with Apple on iOS, I get this error:
BadRequestRestException: Bad Request (Unacceptable audience in id_token: xxx)

here is how I call login:
supabase.composeAuth.rememberSignInWithApple()

Is there anything specific I need to configure on the Apple Developer side or in Supabase for this to work correctly on iOS?

Thanks in advance!

Steps To Reproduce (optional)

No response

Relevant log output (optional)

[jan-tennert]

Whats xxx? Can you recheck everything in your dashboard and Apple Developer config? Client ids, secrets etc

[658jjh]

xxx is the app id.
I've followed exactly to this video: https://www.youtube.com/watch?v=6I2JEky20ME

[658jjh]

@jan-tennert The supbase doc doesn't clearly say which one is Client ids. So I followed the video above.
Detail here:

On Apple developer:

• Service:
  • app bundle id].service
  • Return URL: https://app id.supabase.co/auth/v1/callback
  • Domain subdomain: this one I don't know exactly, I use the website landing page
• Key: Select Sign in with Apple and pick the app in the configure step.

On Supbase:

• Client IDs:[app bundle id].service (same as service ids created in the Apple developer)
• Secret Key (for OAuth): Is generated by this Ruby code:

require 'jwt'
require 'openssl' # For handling the .p8 key

# --- Configuration - Replace with your actual values ---
key_file = 'private_key.p8' # Your .p8 private key file
key_id = 'key_id'                               # Found in App Store Connect
team_id = 'team_id'                             # For APNs, often used as the issuer (iss)
client_id = '[app bundle id].service'
validity_period = 180 # In days. Max 180 (6 months) according to Apple docs.

private_key = OpenSSL::PKey::EC.new IO.read key_file

token = JWT.encode(
    {
        iss: team_id,
        iat: Time.now.to_i,
        exp: Time.now.to_i + 86400 * validity_period,
        aud: "https://appleid.apple.com",
        sub: client_id
    },
    private_key,
    "ES256",
    header_fields=
    {
        kid: key_id
    }
)
puts token

[jan-tennert]

@grdsdev Any idea?