[Feature] Apple OAuth login #24
Description
Summary
Implement Apple Sign In for user authentication.
Prerequisites
- [Feature] OAuth infrastructure setup #20 OAuth infrastructure setup
Scope
Setup
- Enroll in Apple Developer Program
- Configure Sign in with Apple capability
- Create Service ID
- Create and configure private key
- Set return URLs
Backend
- Add Apple OAuth config (team ID, key ID, service ID, private key)
- Implement Apple OAuth callback handler
- Verify Apple ID token (JWT)
- Handle Apple's unique user identifier
- Handle "Hide My Email" feature
Frontend
- Add "Sign in with Apple" button (with Apple brand guidelines)
- Handle Apple OAuth redirect
Environment Variables
APPLE_TEAM_ID=
APPLE_SERVICE_ID=
APPLE_KEY_ID=
APPLE_PRIVATE_KEY=
APPLE_REDIRECT_URI=
Notes
- Apple only sends user email on first authorization
- Must store email on first login
- Required for iOS apps with social login
Acceptance Criteria
- Users can sign up/login with Apple ID
- Apple account linked to user profile
- Follows Apple Human Interface Guidelines
- Handles "Hide My Email" correctly