Sign In With Apple

Skill: Sign in with Apple

Purpose

Detects apps that offer third-party social login (Google, Facebook, Twitter/X, etc.) without offering Sign in with Apple, violating Guideline 4.8 — which requires Sign in with Apple wherever third-party authentication is used.

Apple Guideline

• Primary: 4.8 — Design: Sign in with Apple
• Related: 5.1.1(i)
• Reference: references/guidelines/4-design.md

Real-World Rejection Cases

• Case: App offered Google Sign-In and Facebook Login as the only login options — rejected under Guideline 4.8

Source: Apple Developer Forums (multiple threads, 2020–2024) Root cause: Guideline 4.8 requires apps that use third-party or social login to also offer Sign in with Apple as an equivalent option. Apple enforced this starting June 30, 2020.

• Case: App updated to add Instagram OAuth login — Apple rejected the update for missing Sign in with Apple, even though the app had previously passed review without it

Source: Developer experience, 2023 Root cause: Adding any new third-party auth method after the June 2020 deadline triggers the Sign in with Apple requirement for the entire app.

• Case: App used "Login with Twitter" for a social feature — rejected; developer assumed the rule didn't apply to secondary/optional login methods

Source: Apple Developer Forums Root cause: The rule applies to any third-party authentication — not just the primary login, but also secondary social login options like Twitter, LinkedIn, or GitHub.

• Case: App offered only Facebook Login as the sole authentication option — developer believed Sign in with Apple was only required when offering multiple social login providers — rejected under Guideline 4.8

Source: Apple Developer Forums (multiple developer reports, 2020–2024) Root cause: Sign in with Apple is required whenever any third-party or social authentication is offered, regardless of whether it is the only login option or one of several — offering a single social provider does not exempt the app from Guideline 4.8

• Case: React Native app using react-native-auth0 rendered Sign in with Apple button with a gray border — Apple reviewer flagged non-compliant button styling and rejected

Source: Auth0 Community / react-native-auth0 GitHub issue #310 Root cause: Sign in with Apple button must use ASAuthorizationAppleIDButton with no custom border, shadow, or color modifications; any deviation from Apple's button styling guidelines is grounds for rejection

• Case: App using Sign in with Apple did not revoke the Apple identity token when user deleted their account — rejected under account deletion and Sign in with Apple requirements

Source: Apple TN3194 (developer.apple.com/documentation/technotes/tn3194) Root cause: When a user deletes their account in-app, the app must call Apple's token revocation endpoint to invalidate the Sign in with Apple credential; failing to revoke violates both Guideline 5.1.1(v) and the Sign in with Apple specification

Trigger

Invoke on any iOS/macOS project that includes social login, OAuth flows, or third-party authentication.

Inputs

| Name | Type | Default | Description | |------|------|---------|-------------| | project_root | path | cwd | iOS/macOS project root | | shared_context | object | nil | Pre-collected context from appstore-full-audit Phase 1 |

Actions

Phase 1: Context Collection

Skip this phase if shared_context is provided.

1. Glob **/*.swift — collect all Swift source files.
2. Glob **/Podfile and **/Package.resolved — check for third-party auth SDK dependencies.
3. Glob **/*Login* **/*Auth* **/*SignIn* **/*OAuth* — locate authentication flow files.

Phase 2: Checks

1. Third-party auth SDK detection

Grep pattern GoogleSignIn|GIDSignIn|FBSDKLoginKit|FacebookLogin|TwitterKit|TwitterAuthProvider|GithubAuthProvider|OAuthProvider|LinkedInAuth|AmazonAuth|WeChatAuth in **/*.swift and dependency files. If any match found → proceed to check 2.

1. Sign in with Apple presence

Grep pattern ASAuthorizationAppleIDProvider|AuthenticationServices|ASAuthorization|SignInWithApple|signInWithApple in **/*.swift. If third-party auth detected (check 1) but Sign in with Apple absent → 🔴 CRITICAL.

1. Sign in with Apple button usage

Grep pattern ASAuthorizationAppleIDButton|SignInWithAppleButton in **/*.swift. If Sign in with Apple code exists but no Apple button found → 🟠 HIGH. The official ASAuthorizationAppleIDButton or SwiftUI SignInWithAppleButton must be used — custom-styled buttons that don't meet Apple's guidelines are rejected.

1. AuthenticationServices import

Grep pattern import AuthenticationServices in **/*.swift. If third-party auth present but AuthenticationServices not imported → 🔴 CRITICAL.

1. Credential state handling

Grep pattern getCredentialState|ASAuthorizationAppleIDProvider.*getCredentialState in **/*.swift. If Sign in with Apple is implemented but credential state check absent → 🟠 HIGH. Apps must check the Sign in with Apple credential state at launch to handle revoked credentials gracefully.

Phase 3: Output

Collect all findings from Phase 2 and build the prioritised findings list below. Include file paths and line numbers. Omit tiers with no findings.

Output Format

## Sign in with Apple — Findings

### 🔴 CRITICAL — Guaranteed rejection
- [ ] TODO: Add Sign in with Apple — GoogleSignIn detected but ASAuthorizationAppleIDProvider absent — Guideline 4.8
- [ ] TODO: Import AuthenticationServices and implement ASAuthorizationAppleIDProvider — `AuthViewModel.swift:12` — Guideline 4.8

### 🟠 HIGH — Very likely rejection
- [ ] TODO: Replace custom Apple login button with ASAuthorizationAppleIDButton or SwiftUI SignInWithAppleButton — custom styling not permitted — `LoginView.swift:55` — Guideline 4.8
- [ ] TODO: Add credential state check at app launch — handle revoked Sign in with Apple credentials — `AppDelegate.swift` — Guideline 4.8

### 🟡 MEDIUM — Possible rejection
- [ ] TODO: Verify Sign in with Apple is presented with equal visual prominence to other social login options — Guideline 4.8

### 🟢 LOW — Best practice
- [ ] TODO: Handle the case where a user's Apple ID credential is revoked — sign them out gracefully rather than crashing

Tools Used

Glob, Grep, Read

Constraints

• Read-only. No file edits.
• No network calls.
• Skip Phase 1 if shared_context is provided by orchestrating agent.
• Exception: Apps that only use username/password login (no third-party OAuth) do not require Sign in with Apple.
• Exception: Apps used exclusively by employees or enterprise accounts are exempt.

Quick Commands

Run these in your project root to check manually:

# Check for third-party auth SDKs
!grep -rn "GoogleSignIn\|GIDSignIn\|FBSDKLogin\|FacebookLogin\|TwitterKit\|OAuthProvider" . --include="*.swift" | grep -v "//"

# Check for Sign in with Apple implementation
!grep -rn "ASAuthorizationAppleIDProvider\|AuthenticationServices\|SignInWithAppleButton" . --include="*.swift"

# Check for Apple login button (required visual component)
!grep -rn "ASAuthorizationAppleIDButton\|SignInWithAppleButton" . --include="*.swift"

Swift Anti-Pattern Reference

examples/swift/SubscriptionPatterns.swift (auth flow patterns)

Detection Steps

1. Find target files

• Glob: **/*.swift, **/*.m, **/project.pbxproj, **/Info.plist

1. Search for rejection patterns

• Grep GIDSignIn\|GoogleSignIn\|FBSDKLoginButton\|LoginWithAmazon\|TwitterAuthProvider — third-party auth SDKs
• Grep ASAuthorizationAppleIDButton\|SignInWithAppleButton — Apple sign-in button
• Grep ASAuthorizationAppleIDProvider\|ASAuthorizationController — Apple auth implementation
• Grep getCredentialState\|credentialState.*revoked — credential state handling

1. Determine verdict

• Third-party auth SDK found + no ASAuthorizationAppleIDButton → 🔴 CRITICAL (Guideline 4.8)
• ASAuthorizationAppleIDButton present but no getCredentialState handling → 🟠 HIGH
• Apple Sign-In implemented with credential state handling → 🟢 pass

1. Report

• File path + line of third-party auth without Apple alternative
• Fix: Add ASAuthorizationAppleIDButton alongside existing login options; implement ASAuthorizationAppleIDProvider().getCredentialState on app launch

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: cruisediary
• Source: cruisediary/apple-app-review-skills
• License: MIT

Install and usage instructions live in the source repository linked above.