Installation and configuring plug-in Sign in with Apple

The plugin adds the 'Sign in with Apple' button to the login page of your store. Your customers sign in or register with their Apple ID and don't need a new password for your store.

It's easy to configure the plugin. See pictures.

1. Install the plugin. Open Configuration - Authentication - External authentication and click 'Configure' for 'Sign in with Apple'. Enable 'Sign in with Apple'.

Check that the IIS application pool of your site has 'Load User Profile' = True. It's mandatory. Without it the plugin cannot use your private key and the Apple sign-in fails.
For Azure set WEBSITE_LOAD_USER_PROFILE = 1 in the application settings and use at least the Basic (B1) tier.

2. Create an App ID in your Apple Developer account.
Open the developer account and click 'Certificates, IDs & Profiles'.

Click 'Identifiers' and the plus button next to 'Identifiers'.

Select 'App IDs' and click 'Continue'.

Select the type 'App' and click 'Continue'.

Enter a description and an explicit 'Bundle ID' in the reverse-domain style, e.g. com.example. Enable 'Sign In with Apple' in the 'Capabilities' list below. Click 'Continue' and 'Register'.
The 'App ID Prefix' is your Team ID. You need it for the plugin.

3. Create a Services ID. The identifier of the Services ID is the 'Client Id' of the plugin.
Create a new identifier again. This time select 'Services IDs'.

Enter a description and an identifier, e.g. com.example.signin. Click 'Continue' and 'Register'.

Select 'Services IDs' in the dropdown on the right to find your new Services ID.

Click your Services ID.

Enable 'Sign In with Apple' and click 'Configure'.

'Primary App ID' - select the App ID from step 2.
'Domains and Subdomains' - the domain of your store without https://, e.g. www.yourstore.com.
'Return URLs' - copy the 'Return URLs' value from the plugin configure page, e.g. https://www.yourstore.com/signin-apple (see step 5). The picture shows only an example.
Click 'Next', 'Done', 'Continue' and 'Save'.
Apple needs a public domain with https (TLS 1.2 or higher). localhost and IP addresses don't work.
If you have several stores, add the domain and the return URL of each store, separated by commas.

4. Create a private key.
Click 'Keys' and the plus button next to 'Keys'. Enter a key name and enable 'Sign in with Apple'. Click 'Configure' next to it and select the App ID from step 2 as the 'Primary App ID'. Click 'Save', 'Continue' and 'Register'.
Download the key file AuthKey_XXXXXXXXXX.p8. Apple lets you download it only once, so keep it in a safe place.
The 10-character 'Key ID' is shown on the key page and in the file name.

5. Copy the Apple credentials to the plugin configure page.
'Team ID' - the App ID Prefix from step 2. You also see it at the top right of the Apple Developer account, next to your name.
'Client Id' - the identifier of the Services ID from step 3 (e.g. com.example.signin), not the App ID.
'Key ID (the 10-character key)' - the Key ID from step 4.
'Private Key' - open the .p8 file in a text editor and paste all its content.
'Return URLs' - the return URL of your store. The plugin builds it from the store URL (Configuration - Stores), so your store must use https. Add this URL to the 'Return URLs' of the Services ID (step 3). It must match exactly.
Click 'Save'.

6. This is how the button looks on the login page. The customer clicks 'Sign in with Apple', signs in on the Apple page and comes back to your store signed in.
On the first sign-in the plugin registers a new customer and fills the first and last name from Apple. If a customer with the same email already exists, the plugin signs in this customer, so no duplicate account is created.
Apple sends the name only on the first sign-in. If the customer selects 'Hide My Email', Apple gives a relay address like [email protected].

7. New customers are registered only when the 'Registration method' in Configuration - Settings - Customer settings is not 'Registration is disabled'. With 'A customer should be approved by administrator' the new customer waits for your approval.
All settings could be set for each store separately. Select the store in 'Multi-store configuration for' and check the override checkboxes. Each store could have its own Services ID and key.