Socialite Apple Provider

Socialite Apple Provider is an OAuth2 provider that extends Laravel Socialite with support for Sign in with Apple. It plugs into the SocialiteProviders manager so a Laravel application can authenticate users through their Apple ID using the same familiar Socialite driver API.

Beyond the standard OAuth redirect and callback flow, the package handles the specifics of Apple’s authentication, including verifying the identity token (a JWT) returned by Apple and working with the client-secret JWT that Apple requires in place of a static secret. It integrates with firebase/php-jwt and lcobucci/jwt for token signing and verification.

What You Get

• An ‘apple’ driver for Laravel Socialite registered through the SocialiteProviders manager
• Sign in with Apple OAuth2 redirect and callback handling
• Verification of the Apple identity token (JWT) returned during authentication
• Support for Apple’s JWT client-secret model via lcobucci/jwt and firebase/php-jwt
• An AppleToken abstraction and signer helpers for in-memory and no-op signing

Common Use Cases

• Adding a Sign in with Apple button to a Laravel application’s login flow
• Authenticating mobile-app users against an Apple ID through a Laravel backend
• Verifying Apple identity tokens to establish a trusted user session
• Meeting App Store requirements to offer Apple sign-in alongside other social logins

Under The Hood

Architecture - The package is a thin extension over Laravel Socialite. AppleExtendSocialite is an event listener that registers the ‘apple’ driver with the SocialiteProviders manager; Provider.php implements the OAuth flow (authorization URL, token exchange, and mapping Apple’s response to a Socialite user). AppleToken models the returned token, while AppleSignerInMemory and AppleSignerNone adapt lcobucci/jwt signing strategies for verifying and issuing the JWTs Apple’s flow requires.

Tech Stack - PHP 8.0+ package distributed as socialiteproviders/apple. It requires ext-openssl, firebase/php-jwt 7.x and lcobucci/jwt 4/5 for JWT handling, lcobucci/clock, and socialiteproviders/manager for driver registration. Autoloading is PSR-4 with the classes at the package root.

Code Quality - The codebase is small and single-purpose (five classes), keeping the surface easy to audit. It delegates cryptographic JWT work to well-established libraries rather than reimplementing it. As a read-only subtree split of the SocialiteProviders monorepo, issues and tests are centralized upstream, so this repository itself carries no separate test suite.

API Design - Usage follows the idiomatic Socialite pattern: add config to services.php, register the event listener, then call Socialite::driver(‘apple’). This consistency with other Socialite providers makes the learning curve gentle for Laravel developers, though understanding Apple’s JWT client-secret requirement is the main conceptual hurdle.