vestibule_apple
Sign in with Apple strategy with JWKS-backed ID token verification and form_post callback support.
When to use it
Use Apple when your application needs Sign in with Apple for web clients and can generate a client-secret JWT.
Default scopes: name email
Install
Until 1.0, install Vestibule packages from GitHub using the movingvestibule-v0.0 tag. This requires Gleam 1.18 or later because companion packages use git path dependencies.
[dependencies]
vestibule_apple = { git = "https://github.com/tylerbutler/vestibule.git", ref = "vestibule-v0.0", path = "packages/vestibule_apple" }Setup
- Create an Apple App ID and enable Sign In with Apple.
- Create a Services ID for the OAuth client_id.
- Register an HTTPS return URL; Apple does not allow localhost callbacks.
- Create a Sign in with Apple key and generate an ES256 client-secret JWT.
Usage
import vestibule_apple
let assert Ok(apple) = vestibule_apple.try_init()
let strategy = vestibule_apple.strategy(apple)What Vestibule handles
- init initializes the JWKS cache used to verify Apple ID tokens.
- try_init lets applications handle duplicate initialization explicitly.
- Apple sends name and email only on first consent.
- User info comes from the verified id_token, not a userinfo endpoint.
What you handle
- Apple client_secret values are JWTs generated from Team ID, Key ID, Services ID, and the .p8 private key.
- Do not commit the Apple private key; generate the client-secret JWT in your app or deployment pipeline.