We are implementing the new guidelines imposed by Apple on user deletion. The problem is that users registered by Apple Sign In have Apple Id associated with the app by token, and by using the token revoke API, the user still remains associated via Apple Id with the app and has to manually remove the association into their Apple id settings. Is this the correct way? Is there a service I can call to disassociate the Apple Id from the app?
2 Answers
The following github readme solution assumes one is using Firebase for their backend auth services:
I used this solution for my app which integrates with Firebase auth for Sign In With Apple and it worked well. Do not forget to create a key in your Apple Developer portal.
If you are not using Firebase, you can reverse engineer a solution based on the javascript shown in the readme. Your HTTP request function flow and parameter info should be an exact match to this solution, but your syntax would be different.
The benefit of this solution is that you do not need to rely on the client to perform this sensitive action, and the computation is outsourced to a persistent container so you can guarantee revocation of the token.
Follow 3 steps to revoke/delete account.
- Generate Refresh token
- Validate Refresh token
- Revoke Access token
https://developer.apple.com/documentation/sign_in_with_apple/generate_and_validate_tokens
https://developer.apple.com/documentation/sign_in_with_apple/revoke_tokens
Related