Ok I was curious so I tested myself. I get the `invalid

Darryl Young https://twitter.com/darryl_young • Nov 6
Hey. Yeah, I also wondered that so I decoded the generated JWT and it looks like exactly what's required and shown at the bottom of this document.

https://developer.apple.com/documentation/signinwithapplerestapi/generate_and_validate_tokens

Ok I was curious so I tested myself. I get the `invalid_grant` error unless I include the `redirect_uri` in the POST request with the authorization code.

Malmö, Skåne län • 39°F

Wed, Nov 6, 2019 6:16pm +01:00

5 replies
Have you written a response to this? Let me know the URL:
- Aaron Parecki twitter.com/aaronpk
  
  Cool, so that URL on the GraphQL server is the redirect_url, and that's what needs to be sent in that POST request.
  
  Wed, Nov 6, 2019 5:51pm +00:00 (via brid-gy.appspot.com)
- Darryl Young twitter.com/darryl_young
  
  I have a GraphQL server (Prisma) and I'm sending the auth code there. Then, on that server, I'm trying to validate the auth code with Apple. Once it validates, I'd either be creating a user and sending a session token back or signing a user in by sending back a session token.
  
  Wed, Nov 6, 2019 5:50pm +00:00 (via brid-gy.appspot.com)
- Aaron Parecki twitter.com/aaronpk
  
  Also you need to be exchanging the authorization code from a server somewhere, because you can't ship this app with the client secret built in.
  
  Wed, Nov 6, 2019 5:32pm +00:00 (via brid-gy.appspot.com)
- Aaron Parecki twitter.com/aaronpk
  
  What URL are you sending people back to to have Apple deliver the authorization code to? That's the redirect URL, and you have to have configured it in the request and in the developer console anyway too.
  
  Wed, Nov 6, 2019 5:32pm +00:00 (via brid-gy.appspot.com)
- Darryl Young twitter.com/darryl_young
  
  Interesting. I’ll give it a go again in case I missed something. I’m not sure what the redirect_uri will be in my React Native, though. Thanks for the help, by the way. Appreciate it.
  
  Wed, Nov 6, 2019 5:30pm +00:00 (via brid-gy.appspot.com)

Posted in /replies using monocle.p3k.io

Aaron Parecki