abhishek-hingnikar

I am a Specialist Solutions Engineer at Auth0. I specialize in Identity and Access Management and enjoy building software. I have experience developing software in several frameworks and a variety of domains. I enjoy traveling, cooking, and building robots!

Specialist Solutions Engineer

Abhishek Hingnikar



For the average person, it’s a monumental task to constantly monitor if any of their accounts have been affected by a breach. Because [password reuse](https://securityboulevard.com/2020/04/8-scary-statistics-about-the-password-reuse-problem/) is an unfortunately extremely common practice, it becomes even more challenging to monitor all of the accounts that may be using the same credentials as the one involved in a breach.

On top of this, some passwords may not have been involved in a breach, but are still weak and should be updated. Some people have hundreds of accounts across all of their applications, so how can they possibly keep track of all of these credentials and make sure they aren’t vulnerable to an attack?

Apple aims to solve this problem with One Tap Account Upgrades.

At [WWDC 2020](https://developer.apple.com/wwdc20/), Apple announced some huge upgrades to how iOS manages passwords. These upgrades aim to alleviate some of the challenges faced by password management. In this article, we’ll look at Apple’s recent announcements on password upgrades, why they matter, and how they work behind the scenes.

## What’s with Apple and Passwords?

Apple users often rely on Keychain and iCloud Keychain, Apple’s built-in credentials management system, to store and manage their passwords. Keychain is integrated deep within all of their operating systems and powers features such as WiFi hotspot credential sharing, beyond just being a password manager.

This year, Apple added several capabilities to Keychain related to breached or weak password detection and mitigation. Keychain now monitors for weak, re-used, or breached passwords, notifies the user regarding a breach, and offers mitigation options right away.

<div class="row">
  <div class="col-sm-6">
    <img src="https://images.ctfassets.net/23aumh6u8s0i/55jOFPkV1LnvLEWpp9PLmD/582968258c37e5d1dea08b2b0c62f860/keychain-homescreen-iOS-14" alt="Apple Keychain homescreen" style="padding:20px 0;"/>  
  </div>
  <div class="col-sm-6">
    <img src="https://images.ctfassets.net/23aumh6u8s0i/7qJW5Rx3iAn46QmfCHmm6n/f87c675e5da4326b613f6f3a163acc78/keychain-suggestions-screen" alt="Apple Keychain password suggestion screen" style="padding:20px 0;"/>
  </div>
</div>
<div class="row">
  <div class="col-sm-offset-3 col-sm-6">
    <img src="https://images.ctfassets.net/23aumh6u8s0i/61eqEuOhA40P8QaeWnY8fF/afc3ff16294e1aa1383315fbf45ac68f/keychain-mitigation-options" alt="Apple Keychain easily guessed reused password" style="padding:20px 0;"/>
  </div>
</div>

The ability to check if your credentials or information were found in a breach is a great step towards mitigating the threats caused by a breach. Users have been able to check if they were affected by a breach using 3rd party password managers like 1Password or by checking websites like [haveibeenpwned.com](https://haveibeenpwned.com). Breached password detection is also offered by some service providers, such as [Auth0’s breached password detection](https://auth0.com/breached-passwords). With Apple’s recent announcement, this security feature has now been introduced to more than one billion iOS devices. 

When it comes to handling a breach, notifying the user is only half of the problem. The other half is mitigating the threat. When a breached credential is detected, a user has to mitigate the threat by resetting the password manually, which can involve several steps. Apple intends to offer a one-tap mitigation to remove this burden on the user. 

## Easy Mitigation of Breached Credentials

One of the easiest ways to encourage a user to do something is to offer them a call to action (CTA) right away. Many password reset experiences are long and time-consuming, and some even require you to enter the answer to a secret security question that you set up ages ago!

Apple solves this problem by offering a CTA right in the report, inviting the user to mitigate the threat immediately. If a breached or weak password is detected, Keychain offers you a simple button that will replace the weak password with a new one or offer you to upgrade to Sign in with Apple. The image below demonstrates what happens when Keychain detects a weak password. 

<div class="row">
  <div class="col-sm-offset-3 col-sm-6">
    <img src="https://images.ctfassets.net/23aumh6u8s0i/5cTx5qLP0kqWYqvGciEYMy/8550e1b88ebfb7b25f057c1581c8350a/password-upgrade-option" alt="Apple Keychain easily guessed weak password" style="padding:20px 0;"/>
  </div>
</div>

For this to work, there are two requirements:

- The app must be installed on iOS 
- The app must offer an Account Upgrades Extension that offers the Upgrade to Strong Password capability

In addition to this, Apple introduced another call to action for apps that support Sign in with Apple. If your app supports it, Keychain will now offer a quick and easy way to upgrade the user’s account to Sign in with Apple with just the click of a button. Now, the user doesn’t have to worry about managing another username and password for that application!

It's exciting to see these password security upgrades. My personal wishlist for these features would include an experience similar to [App Clips](https://developer.apple.com/app-clips/), but for account upgrades. App Clips are Apple’s ephemeral apps, which means you do not need to install the full application to use them. App Clips offer a great balance between opening a web page and installing an app. If you want to learn more about App Clips, keep an eye out for our upcoming blog post on App Clips.

For now, let’s look at how Account Upgrades work and some of the options Apple is offering to enhance password security:

- Upgrade to Strong Password
- Upgrade to Sign in with Apple
- In-App Upgrades

## How do Account Upgrades work? 

Apple uses something called an App Extension to power the button that upgrades a weak password to Sign in with Apple. 
If you are unfamiliar with iOS nitty-gritty, an App Extension can be thought of as a service, intent, or an action handler. These are single-purpose micro-apps with specific entry and exit points. They are iOS triggered events that let a developer return a custom action in response. This is similar in concept to Auth0’s Hooks and Rules, but in this case, all of this is on the iOS client.

Some App Extension examples include Account Upgrade, SSO Capabilities, and more. Let’s take a closer look at the Account Upgrade Extension introduced in WWDC 2020.

**The Account Upgrade Extension has four tasks:**

- Present the UI to accommodate extra steps when changing the password.
- Upgrade the user’s password. 
- Present the UI to accommodate extra steps when changing the password. 
- Upgrade the user’s account to use Sign in with Apple.
- To implement Account Upgrade Extension, you simply add a new target and select “Account Upgrade Extension”.
- XCode then generates a template extension file, which includes each task as a single function handler. You are then expected to provide the business logic to perform the tasks. XCode will also generate an `Info.plist` file for the extension that informs iOS about the individual capabilities for account upgrades offered by this extension.

Next, let’s look at how the Upgrade to Strong Password feature works.

## Upgrade to Strong Password 

Programmatically, the Upgrade to Strong Password flow is similar to how the Account Upgrade to Sign in with Apple described in the previous section works.

On a high level, the Upgrade to Strong Password flow works as follows:

- User taps on the "Upgrade to Strong Password" button
- iOS will generate a strong password 
- Optionally, you can define the specific criteria for this password
- iOS then activates your extension and calls `changePasswordWithoutUserInteraction` with the existing set of credentials and the new set of generated credentials. 
- At this point, your application needs to perform additional steps, such as calling an API, to actually finish this operation. Some next steps may include:
  - Check if the credentials don’t exist with `.credentialIdentityNotFound`
  - If second-factor authentication is required, you can respond with `.userInteractionRequired`
  - In any other error scenario, you can respond with `.failed`
  - Lastly, if everything goes correctly, you should invoke the `completeChangePasswordRequest` with the new set of credentials. This tells iOS that the process has successfully completed, at which point iOS will update its copy.
- If your application responds with `.userInteractionRequired`, iOS will call `prepareInterfaceToChangePassword` to actually update the password.

The screenshots below show the Upgrade to Strong Password process in action. The “Easily guessed password warning” is displayed in the application. The user clicks “Change to Strong Password”, then the password is updated.

<div class="row">
  <div class="col-sm-6">
    <img src="https://images.ctfassets.net/23aumh6u8s0i/5cTx5qLP0kqWYqvGciEYMy/8550e1b88ebfb7b25f057c1581c8350a/password-upgrade-option" alt="Apple Keychain change to strong password upgrade" style="padding:20px 0;"/>  
  </div>
  <div class="col-sm-6">
    <img src="https://images.ctfassets.net/23aumh6u8s0i/7tbnmBMMube9CZcJ4KDstZ/78e58802767c32d832636129ed905cdc/password-upgrade-confirmation-prompt" alt="Apple Keychain password upgrade confirmation" style="padding:20px 0;"/>
  </div>
</div>
<div class="row">
  <div class="col-sm-offset-3 col-sm-6">
    <img src="https://images.ctfassets.net/23aumh6u8s0i/3u0QxLw46MmkYvMablSZSp/5e5b30638f1c5e2b9549389199621a0d/password-upgrade-final-screen" alt="Apple Keychain account using strong password screen" style="padding:20px 0;"/>
  </div>
</div>

Here is an example of what the Upgrade to Strong Password would look like in your application code:

```swift
override func changePasswordWithoutUserInteraction(for serviceIdentifier: ASCredentialServiceIdentifier, existingCredential: ASPasswordCredential, newPassword: String, userInfo: [AnyHashable : Any]? = nil) {
  changePassword(existingCredentials, newPassword, userInfo) { result in
    switch (result) {
      case .error(let errorCode):
        self.extensionContext.cancelRequest(withError: NSError(domain: ASExtensionErrorDomain, code: errorCode))
      case .success(_):
        let newCredential = ASPasswordCredential(
          user: existingCredential.user, 
          password: newPassword
        )
        self.extensionContext.completeChangePasswordRequest(
          updatedCredential: newCredential
        )
    }
  }
}
```

Let’s break it down a bit.

- `changePassword` performs the actual operations for changing the user’s password.
- If the result fails, it responds by canceling the request and showing the error to the user.
- If the API change was successful, it will notify iOS regarding the state of the change.

Next, let’s look at how Upgrade to Sign in with Apple works.

## Upgrade to Sign in with Apple

The Upgrade to Sign in with Apple flow is almost exactly the same. However, instead of a new set of credentials, iOS provides the original set of credentials and offers a way to perform Sign in With Apple interactions without having to start the application.

This interaction is slightly different from the usual Sign in with Apple flow when signing up or logging the user in. It explicitly informs the user about the action being taken and that their information from the past account will be linked to the new identity.

The flow is as follows:

- The user taps on Upgrade to Sign in with Apple.
- iOS will invoke convertAccountToSignInWithAppleWithoutUserInteraction with the set of existing credentials.
- Like the password reset, you can respond with the appropriate error, and iOS will offer to perform second-factor authentication or inform the user.
- Once this flow is complete, it’s important to note that Keychain will remove the password from its store. From this point, the user is supposed to use Sign in With Apple.

<div class="row">
  <div class="col-sm-6">
    <img src="https://images.ctfassets.net/23aumh6u8s0i/2fsp4SpqEmZyKVRusBZCtH/1c0eba802069d5be8fff6091723e7fe0/siwa-upgrade-option" alt="Apple Keychain easily guessed password" style="padding:20px 0;"/>  
  </div>
  <div class="col-sm-6">
    <img src="https://images.ctfassets.net/23aumh6u8s0i/pcTJO06Uz5EI1qmzm7UZD/0f158138f66b396ee3db7e5b2e312348/siwa-upgrade-action" alt="Apple Keychain SIWA upgrade" style="padding:20px 0;"/>
  </div>
</div>

Let's walk through some of the code that could be used to accomplish this:

```swift
override func convertAccountToSignInWithAppleWithoutUserInteraction(for serviceIdentifier: ASCredentialServiceIdentifier, existingCredential: ASPasswordCredential, userInfo: [AnyHashable : Any]? = nil) {
  let challenge = validateExistingAccountAndPrepareForUpgrade(existingCredentials, userInfo)
  self.extensionContext.getSignInWithAppleUpgradeAuthorization(
    state: challenge.state, 
    nonce: challenge.nonce
    ) { (authorization, error) in
      if error != nil {
        // Handle error
        self.extensionContext.cancelRequest(withError: NSError(domain: ASExtensionErrorDomain, code: ASExtensionError.failed.rawValue))

        return
      }

      // handle the authorization 
      upgradeAccount(challenge, authorization) { error in
        if error != nil {
          // Handle error
          self.extensionContext.cancelRequest(withError: NSError(domain: ASExtensionErrorDomain, code: ASExtensionError.failed.rawValue))

          return
        }

        self.extensionContext.completeUpgradeToSignInWithApple(userInfo: nil)
      }
    }
  }
}
```

Let’s break it down a bit.

- `validateExistingAccountAndPrepareForUpgrade` performs the actual operations for changing the user’s password.
- If the result fails, it responds by canceling the request and showing the error to the user.
- If the API change was successful, it will request Sign in with Apple authorization using `getSignInWithAppleUpgradeAuthorization` on `extensionContext`.
- If this is successful, it will then try to upgrade the accounts.

## In-App Upgrades
 
Since the underlying API is an extension, Apple also allows you to leverage the extension you have built from within your application. When doing so, you do not access the password, as your application should have already logged the user in.

You can do this as follows:

```swift
class ASInAppSIWALinkHelper: NSObject, ASAccountAuthenticationModificationControllerDelegate {
  var controller: ASAccountAuthenticationModificationController =  ASAccountAuthenticationModificationController()
  
  func accountAuthenticationModificationController(_ controller: ASAccountAuthenticationModificationController, didFail request: ASAccountAuthenticationModificationRequest, error: Error) {
    print("Error \(error) \(request.description)")
  }
  func accountAuthenticationModificationController(_ controller: ASAccountAuthenticationModificationController, didSuccessfullyComplete request: ASAccountAuthenticationModificationRequest, userInfo: [AnyHashable : Any]? = nil) {
    print("Success \(String(describing: userInfo))")
  }
  
  func siwaUpgrade() {
    print("Attempt")
    let userInfo = ["someid": "foobar"]
    let siwaUpgrade = ASAccountAuthenticationModificationReplacePasswordWithSignInWithAppleRequest(
        user: userIdenitifer,
        serviceIdentifier: ASCredentialServiceIdentifier(
            identifier: "yourdomain.com",
            type: .domain
        ),
        userInfo: userInfo
    )
    controller.delegate = self
    controller.perform(siwaUpgrade)
  }
}
```

Note that you are only sending the user’s identifier to the extension here. The app should retrieve the existing credentials from Keychain (or any storage mechanism) and use that token instead. The code for the upgrade will stay the same for the rest. This means that you can re-use most of your logic for In-App Upgrades as well as Keychain-initiated upgrades.

## Security Concerns

As of writing this, the API for these features is currently in beta. iOS 14 is due to release in September, so we may see some changes in the APIs by then. In their current state, there are some concerns regarding these APIs.

One concern is that the Upgrade Password request does not allow the use of more modern password resetting flows, such as sending a [one-time password reset link](https://auth0.com/docs/mfa/guides/configure-otp) through email or some other verifiable factor.  Additionally, in case of a breached credential, an attacker would be able to use the same API to potentially take over the account. While [second-factor password](https://auth0.com/docs/mfa) does offer protection here, you should implement some sort of second-factor before allowing either interaction.

## Conclusion

Apple has released several welcome changes to the Keychain that all iOS users can benefit from. This improves security for everyone on iOS. However, there are still some concerns to be resolved and design decisions to accommodate these solutions.

How would you use these extensions and enhancements in your application? What does your password reset experience look like? Do you wish to offer account upgrades in your app? Let us know in the comments below!

<include src="asides/AboutAuth0" />

**Sources**

- [Apple Developer Documentation](https://developer.apple.com/documentation/authenticationservices/asaccountauthenticationmodificationviewcontroller) for `ASAccountAuthenticationModificationViewController`
- [WWDC 2020 One-tap account security upgrades presentation](https://developer.apple.com/videos/play/wwdc2020/10666/)


Apple One Tap Account Upgrades from WWDC 2020



<div class="alert alert-info alert-icon">
  <i class="icon-budicon-500"></i>
  Integrated support for Sign In with Apple is now available in Auth0 as a beta feature! <strong><a href="https://auth0.com/blog/try-sign-in-with-apple-in-your-auth0-apps-today/">Implement Sign In With Apple now</a>.</strong>
</div>

Last Thursday, [we took a look at Sign In with Apple](https://auth0.com/blog/what-is-sign-in-with-apple-a-new-identity-provider/), the new identity provider features Apple released at WWDC 2019. In that post, we included simple steps to add support for Sign In with Apple in a Node.js application. Today, we're going to show you how you can support Sign in with Apple without adding any special code to your app — thanks to [Auth0's Custom Social Connections](https://auth0.com/docs/connections/social/oauth2), Apple is just one of the many [identity providers](https://auth0.com/docs/identityproviders) you can leverage when connecting to Auth0.

## Extending Auth0’s Core Functionality

We recently wrote about our [vision and guiding principles](https://auth0.com/blog/the-developer-first-identity-platform-auth0-story-and-future/). Developers don’t want to feel like they are constrained by their tools and libraries, especially with an infrastructure component like authentication. Extensibility within our product is a first class citizen, and this is reflected by the fact that 87% of our customers extend the platform. One of the extensibility points we provide allows for adding a new federated authentication method, as highlighted below. This is what we will use to add support for Sign In with Apple:

![Auth0’s extensibility options](https://images.ctfassets.net/23aumh6u8s0i/76ZZsR3TMEJbf9WBnLMRma/7e91db2ea59764168e13721b2db8829a/auth0-engine-custom-connections)

## Prerequisites

To add support for Sign In with Apple, you'll need to have an Auth0 Tenant [set up with a custom domain](https://auth0.com/docs/custom-domains), as well as a web application configured to use Auth0 for authentication at that domain. You can get an application up and running in a few simple steps by using any of our [quick starts](https://auth0.com/docs/quickstarts). Note that for the purpose of this post, your application can use any development stack: Node.js, ASP.NET, Java, and so on.

## Register with Apple

Once you have your application set up, you'll need to create an Apple App ID and a Services ID. We covered these steps in detail in our [previous post](https://auth0.com/blog/what-is-sign-in-with-apple-a-new-identity-provider/#Implementing-Sign-In-with-Apple), but in summary the steps are:

* Create an [Apple Developer Account](https://developer.apple.com)
* Go to ["Certificates, IDs, & Profiles"](https://developer.apple.com/account/resources/certificates/list) -> [ "Identifiers"](https://developer.apple.com/account/resources/identifiers/list/serviceId) -> "Register an App ID"
* Choose "App IDs" as the identifier type and hit "Continue"
* Provide a description and a Bundle ID (reverse-domain name style, i.e., `com.mycustomdomain`)
* Scroll down and check "Sign In with Apple", then "Continue" followed by "Register"
* Back at the "Certificates, IDs, & Profiles" section, click the blue icon next to "Identifiers"
* Choose "Services IDs" and click "Continue". Fill in the description and identifier (`com.mycustomdomain.webapp`)
* After checking "Sign In with Apple", click on "Configure"
* Define your "Web Domain" (`mycustomdomain.com`) and "Return URL" (`mycustomdomain.com/callback`)
* Click "Save", and then "Continue" followed by "Register"

Once you have your Services ID, you'll need to verify your domain with Apple:

* On the "Certificates, IDs, & Profiles" page, click your newly created Services ID
* Hit the "Configure" button next to the "Sign In with Apple" feature, then click "Download" 
* Copy the `apple-developer-domain-association.txt` file to your application server and make it accessible at `https://mycustomdomain.com/.well-known/apple-developer-domain-association.txt` (see our [previous post](https://auth0.com/blog/what-is-sign-in-with-apple-a-new-identity-provider/#Implementing-Sign-In-with-Apple) for a detailed example)
* When this is ready, click "Verify" on your Services ID configuration page. If no error is raised, you are good to go

## Create a Custom Social Connection

In the next step, you’ll add Apple to the collection of identity providers you can integrate with via Auth0.

After you've registered your application with Apple, visit the Auth0 Dashboard and go to **Connections > Social**, scroll to the bottom, and click **Create Custom**.

Most of the information you'll need to create this custom connection has been established in previous steps. To generate the client secret, do the following:

* Head to ["Keys"](https://developer.apple.com/account/resources/authkeys/list) under the "Certificates, Identifiers, & Profiles" section of your Apple developer dashboard
* Click on the round, blue icon to add a new key
* Enter a "Key Name" and check the "Sign In with Apple" option
* Click on "Configure" to make sure the "Choose a Primary App ID" field is filled with your App ID
* Hit "Save", "Continue", and then "Register"
* Download the key, move to its own directory, and rename to `authkey.p8`. Make a note of the Key ID
* Use a JWT library with support for the ES256 algorithm to generate the client secret from the key — the example below uses Node.js, but libraries for other languages can be used in a similar fashion

To use this script, create a new file called `generate-secret.js` in the same directory as the key and add the following code:

```js
const jwt = require("jsonwebtoken");
const fs = require("fs");

const privateKey = fs.readFileSync("./authkey.p8");
const token = jwt.sign({}, privateKey, {
 algorithm: "ES256",
 expiresIn: "60 days",
 audience: "https://appleid.apple.com",
 issuer: "TEAM_ID",
 subject: "com.mycustomdomain.webapp",
 keyid: "KEY_ID"
});

console.log("The token is:", token);
```

> **Note:** You will need to replace `com.mycustomdomain.webapp` with the identifier for your Services ID and replace `TEAM_ID` with your Team ID, which can be found [here](https://developer.apple.com/account/#/membership). You'll also need to replace `KEY_ID` with the Key ID you noted earlier.

Run this script to generate your client secret:

```bash
node generate-secret.js
```

With this, you have almost everything you need to complete the custom social connection! Returning to your Auth0 dashboard, make sure your custom social connection fields look like this:

* **Name:** `Apple`, or any name you choose
* **Client ID:** your Services ID identifier, e.g., `com.mycustomdomain.webapp`
* **Client Secret:** the string generated in the previous step
* **Fetch User Profile Script:**

    ```js
    function (accessToken, ctx, cb) {
      const jwt = require('jsonwebtoken@7.1.9');
      const jwksClient = require('jwks-rsa@1.1.1');
    
      const client = jwksClient({
        jwksUri: 'https://appleid.apple.com/auth/keys',
        cache: true
      });
    
      const idToken = ctx.id_token;
      const decoded = jwt.decode(idToken, {complete: true});
      const {kid, alg} = decoded.header;

      client.getSigningKey(kid, (err, key) => {
        if (err) {
          console.log(err);
          return callback(err);
        }
        const signingKey = key.publicKey || key.rsaPublicKey;
    
        jwt.verify(idToken, signingKey, {
          issuer: 'https://appleid.apple.com',
          audience: 'com.mycustomdomain.webapp',
          algorithms: [alg]
        }, (err, profile) => {
          if (err) return cb(err);
          profile.id = profile.sub;
          cb(null, profile);
        });
      });
    }
    ```
* **Authorization URL:** `https://appleid.apple.com/auth/authorize`
* **Token URL:** `https://appleid.apple.com/auth/token`
* **Scope:** `email name`
* **Custom Headers:**
    
    ```json
    {
      "UserAgent": "Auth0",
      "Accepts": "application/json"
    }
    ```

Once you have everything filled out correctly, click **Create** and enable this connection for your application.

And that's it for set up! 

## Using Sign In with Apple

To try it out, make sure your application is running and give it a visit. When you visit your login page,  you should now see an option for Sign In with Apple:

![Login page](https://images.ctfassets.net/23aumh6u8s0i/4koCt6YbjXzQbGbt00affl/a0c196a8f93f3b7f6f4ea75e6adc01ab/login-page)

Click "Continue with Apple", then enter your Apple ID and password:

![Apple credentials](https://images.ctfassets.net/23aumh6u8s0i/7C7TdNTFutvWyWcdsdJsas/594d3a6de274f7f99c3f6827fea734bd/apple-credentials)

You will be asked to verify a new device. Click "Allow":

![Verify device](https://images.ctfassets.net/23aumh6u8s0i/ouXAZobxgZZKtkDR6NFtW/7b2d78d5242f42dd0586c1a73f29537c/verify-device)

Next you'll be given a verication code. Make a note of this code, click "Done", and then enter the code on the "Two-Factor Authentication" screen:

![2FA](https://images.ctfassets.net/23aumh6u8s0i/52IPsCq25vPdRzE9MpYuuO/fa6dd59fb20d9aafb8f81caa8ae02545/2FA)

When this is done, you'll have the option to edit your name and choose whether you'd like to share or hide your email. Make your choice, then click "Continue":

![Email preferences](https://images.ctfassets.net/23aumh6u8s0i/4wtIHL0LNQqhTd6SsKU5x4/1db29403d5c797a22693e1b290a7a787/email-preferences)

You are now signed in with Apple!

![Logged in](https://images.ctfassets.net/23aumh6u8s0i/7J3lSENs4GOIGkfaCe269P/497f957787a9de1e4a2db66987836897/logged-in)

## Coming Soon

We’re working hard to add Sign In with Apple as one of our core integrations, which will make supporting this option in your application as [easy as turning on a switch](https://auth0.com/learn/social-login/). Stay tuned!





Abhishek Hingnikar

Apple One Tap Account Upgrades from WWDC 2020

Implement Sign In with Apple using Auth0 Extensibility

Try for free today