title: Manage Sign with Apple redirect in PHP
body: <p>I'm trying to implement Sign In with Apple workflow on a backend server, for all those devices that do not support it natively.</p>
  <p>I've tried both with and without 3rd party libraries. Right now I'm using <a href="https://packagist.org/packages/patrickbussmann/oauth2-apple" rel="nofollow noreferrer"><code>patrickbussmann/oauth2-apple</code></a>.</p>
  <p>I successfully authorize the account through the authorization URL, but the redirect URL have no fields (especially the 'code' one).
  This is how I generate the authorization URL:</p>
  <pre><code>function get_apple_signin_url() {
      $options = [
          'scope' =&gt; ['email'],
      ];
      $authUrl = $this-&gt;provider-&gt;getAuthorizationUrl($options);
      $_SESSION['oauth2state'] = $this-&gt;provider-&gt;getState();
      return '{&quot;url&quot;: &quot;'.$authUrl.'&quot;}';
  }
  </code></pre>
  <p>The URL obtained is correct and it works utill the end of login:
  <code>https://appleid.apple.com/auth/authorize?scope=email&amp;state=a9583c14408af68ac05cbfed3a8274ef&amp;response_type=code&amp;approval_prompt=auto&amp;redirect_uri=MY_REDIRECT_URI&amp;client_id=MY_CLIENT_ID&amp;response_mode=form_post</code></p>
  <p>This is the code inside the redirect uri (<code>apple_auth_redirect.php</code>):</p>
  <pre><code>&lt;?php
  
  if (isset($_POST['code'])) {
      $code = urlencode($_POST['code']);
      header(&quot;Location: intent://callback?apple_id_token=&quot;.$code);
  } else {
      echo &quot;no_code&quot;;
  }
  </code></pre>
  <p>As you can see from the authorization URL, the <code>response_mode</code> is <code>form_post</code>. If I use <code>query</code> as <code>response_mode</code> I obtain the code, but I cannot insert <code>email</code> as scope. More details in <code>response_mode</code> at <a href="https://developer.apple.com/documentation/sign_in_with_apple/sign_in_with_apple_js/incorporating_sign_in_with_apple_into_other_platforms" rel="nofollow noreferrer">Incorporating Sign in with Apple into Other Platforms (developer.apple.com)</a>.</p>
  <p>This is the current authorization workflow I've implemented:</p>
  <ol>
  <li>Mobile app calls <code>get_apple_signin_url</code> on the server.</li>
  <li>Mobile app opens the url in the browser.</li>
  <li>The authorization through Apple website is completed and the browser is redirected to redirect uri <code>apple_auth_redirect.php</code>.</li>
  <li>The code should be parsed by <code>apple_auth_redirect.php</code> but the redirect request has no fields.</li>
  </ol>
  <p>I've implemented the same procedure for Google and Huawei sign in without problems.</p>