Apple Sign In: Is 'user' credential returned by Apple permanent?

user_4705368 0
Viewed 2828

I am able to successfully access the credential returned by Apple as part of it's new (WWDC '19 -- iOS 13) Sign In With Apple library.

The credential is accessed in this delegate method:

extension ViewController: ASAuthorizationControllerDelegate {
    func authorizationController(controller: ASAuthorizationController, didCompleteWithAuthorization authorization: ASAuthorization) {
        if let appleIDCredential = authorization.credential as? ASAuthorizationAppleIDCredential {
         //here is credentials . 
        }
    }
}

One then uses 'user' property to extract the user id:

    credential.user 
    //returns, for example, '000046.20082df1df9a41b78cd1552979288e19.2346' dummy value

Is this 'user' property understood to be static / permanent for that specific AppleID (and perhaps that specific app)?

(I am accessing a sync API and would like to hardcode user credentials from that 44 character Apple 'user' credential.)

apple-sign-in
1 Answers

The user identifier property of ASAuthorizationAppleIDCredential is a stable unique identifier between an Apple ID and Developer Team. Application revocations will not affect the stability of the user ID. This also means that among a developer team's set of applications the user ID will be the same, making it optimal for synchronization among a developer's apps.

Edit for App Transfers:

Transferring an application from one developer team to another will indeed cause the user identifier to change, since it's scoped as a stable user identifier per team.

The best practice when transferring an app that uses Sign in with Apple will be to use an Apple API endpoint to map the user IDs for the old team with user IDs for the new team. If for some reason a developer does not use the API endpoint, AuthenticationServices supports application transfers by accepting the old user ID in an ASAuthorizationAppleIDRequest and the new user ID will be returned.

Generally, AuthenticationServices will do the right thing. However, if a user deletes an app associated with Team A (and used Sign in with Apple for said app), then reinstalls the same app now associated with Team B, the only way to associate the two user IDs will be by using the API endpoint.

Source: I'm an engineer on the team responsible for Sign in With Apple.

user_28984860
Related