title: Sign in with Apple = invalid_client
body: <p>I'm facing a very bad issue because I read so many guides and tutorials and nothing works.</p>
  
  <p>The result is always the same: <code>{"error":"invalid_client"}</code></p>
  
  <p>I get the code, identityToken and everything I need - except the call to <a href="https://appleid.apple.com/auth/token" rel="noreferrer">https://appleid.apple.com/auth/token</a> - because of invalid_client.</p>
  
  <p>Here is my url for getting the code.</p>
  
  <p><a href="https://appleid.apple.com/auth/authorize?response_type=code&amp;client_id=org.example.service&amp;redirect_uri=https%3A%2F%2Fexample.org" rel="noreferrer">https://appleid.apple.com/auth/authorize?response_type=code&amp;client_id=org.example.service&amp;redirect_uri=https%3A%2F%2Fexample.org</a></p>
  
  <p>So then I have the default workflow.
  And after accepting / loggin in I will be redirected to my page.</p>
  
  <p><a href="https://example.org/?code=a277243e2ec324fb09ba1c3333a8e6576.0.abcde.u4xiTDP2qHXoNEaxrcrIGx" rel="noreferrer">https://example.org/?code=a277243e2ec324fb09ba1c3333a8e6576.0.abcde.u4xiTDP2qHXoNEaxrcrIGx</a></p>
  
  <p>(When I'm using the JavaScript API I'll get other informations like state, code and id_token. I already tried it with the "code" there, too.)</p>
  
  <p>Back to the main function.</p>
  
  <p>This is my request for Apple.</p>
  
  <pre><code>'client_id' =&gt; 'org.example.service',  
  'client_secret' =&gt; JWT-Data encoded (OPENSSL_ALGO_SHA256) see below  
  'grant_type' =&gt; 'authorization_code',  
  'code' =&gt; 'a277243e2ec324fb09ba1c3333a8e6576.0.abcde.u4xiTDP2qHXoNEaxrcrIGx'  
  </code></pre>
  
  <p><strong>JWT Header:</strong></p>
  
  <pre><code>{
    "alg": "ES256",
    "kid": "1ABC2345DE"
  }  
  </code></pre>
  
  <p><strong>JWT Payload:</strong></p>
  
  <pre><code>{
    "iss": "1A234BCD56",
    "iat": 1571269964,
    "exp": 1571273564,
    "aud": "https://appleid.apple.com",
    "sub": "org.example.service"
  }
  </code></pre>
  
  <p><strong>Response:</strong></p>
  
  <pre><code>{  
    "error": "invalid_client"  
  }  
  </code></pre>
  
  <p>The useless error message of the world.</p>
  
  <p>I dont know why the client should be invalid.</p>
  
  <p>I have a key in <a href="https://developer.apple.com/account/resources/authkeys/list" rel="noreferrer">https://developer.apple.com/account/resources/authkeys/list</a> with downloaded file name AuthKey_1ABC2345DE.p8. (means 1ABC2345DE is my key id)</p>
  
  <p>Then I have a native iOS app with identifier "org.example" and a service with identifier "org.example.service".</p>
  
  <p>Its not working with both ids and mixed different things.</p>
  
  <p>Nothing. invalid_client.</p>
  
  <p>Can anyone help me please? I'm sitting here for hours and getting only invalid_client</p>
  
  <p>My testing page:</p>
  
  <p><div class="snippet" data-lang="js" data-hide="false" data-console="true" data-babel="false">
  <div class="snippet-code">
  <pre class="snippet-code-html lang-html prettyprint-override"><code>&lt;html&gt;
  &lt;head&gt;
  &lt;/head&gt;
  &lt;body&gt;
  &lt;script type="text/javascript" src="https://appleid.cdn-apple.com/appleauth/static/jsapi/appleid/1/en_US/appleid.auth.js"&gt;&lt;/script&gt;
  &lt;div id="appleid-signin" data-color="black" data-border="true" data-type="sign in" data-width="330px" data-height="100px"&gt;&lt;/div&gt;
  &lt;script type="text/javascript"&gt;
      AppleID.auth.init({
          clientId : 'org.example.service',
          scope : 'email',
          redirectURI: 'https://example.org',
          state : 'EN'
      });
  &lt;/script&gt;
  &lt;/body&gt;
  &lt;/html&gt;</code></pre>
  </div>
  </div>
  </p>
  
  <p>And PHP:</p>
  
  <pre class="lang-php prettyprint-override"><code>&lt;?php
  // index.php
  
  // function by https://stackoverflow.com/q/56459075/1362858
  function encode($data) {
      $encoded = strtr(base64_encode($data), '+/', '-_');
      return rtrim($encoded, '=');
  }
  
  // function by https://stackoverflow.com/q/56459075/1362858
  function generateJWT($kid, $iss, $sub, $key) {
      $header = [
          'alg' =&gt; 'ES256',
          'kid' =&gt; $kid
      ];
      $body = [
          'iss' =&gt; $iss,
          'iat' =&gt; time(),
          'exp' =&gt; time() + 3600,
          'aud' =&gt; 'https://appleid.apple.com',
          'sub' =&gt; $sub
      ];
  
      $privKey = openssl_pkey_get_private($key);
      if (!$privKey) return false;
  
      $payload = encode(json_encode($header)).'.'.encode(json_encode($body));
      $signature = '';
      $success = openssl_sign($payload, $signature, $privKey, OPENSSL_ALGO_SHA256);
      if (!$success) return false;
  
      return $payload.'.'.encode($signature);
  }
  
  $client_id = 'org.example.service';
  $data = [
      'client_id' =&gt; $client_id,
      'client_secret' =&gt; generateJWT('1ABC2345DE', '1A234BCD56', $client_id, file_get_contents('AuthKey_1ABC2345DE.p8')),
      'code' =&gt; 'a277243e2ec324fb09ba1c3333a8e6576.0.abcde.u4xiTDP2qHXoNEaxrcrIGx',
      'grant_type' =&gt; 'authorization_code'
  ];
  $ch = curl_init();
  
  curl_setopt($ch, CURLOPT_URL, 'https://appleid.apple.com/auth/token');
  curl_setopt($ch, CURLOPT_POST, 1);
  curl_setopt($ch, CURLOPT_POSTFIELDS, $data);
  curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
  
  $serverOutput = curl_exec($ch);
  
  curl_close ($ch);
  
  /**
   * {"error":"invalid_client"}
   */
  var_dump($serverOutput);
  
  </code></pre>