Herald
OpenapiOauth

Apple native login.

Verifies an Apple `identityToken` (from `ASAuthorizationAppleIDProvider`) server-side and, depending on `downstreamState`, issues either a direct browser session (Bearer token family bound to `clientId`) or a downstream authorization code for the Code+PKCE flow. Requires the realm to have an enabled Apple provider.

POST
/api/oauth/{realmId}/apple/native-login

Verifies an Apple identityToken (from ASAuthorizationAppleIDProvider) server-side and, depending on downstreamState, issues either a direct browser session (Bearer token family bound to clientId) or a downstream authorization code for the Code+PKCE flow. Requires the realm to have an enabled Apple provider.

Path Parameters

realmId*string

Realm ID

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

clientId*string

Herald ClientApp client_id that the direct-session token family binds to.

downstreamState?|

Optional downstream authorization transaction identifier (OAuth state). Presence selects the downstream-authorization-code branch; absence the direct-session branch.

identityToken*string

Apple-issued identity token (JWT) from ASAuthorizationAppleIDProvider.

Response Body

application/json

application/json

application/json

application/json

application/json

curl -X POST "https://example.com/api/oauth/string/apple/native-login" \  -H "Content-Type: application/json" \  -d '{    "clientId": "string",    "identityToken": "string"  }'
{  "redirectUri": "string"}
{  "code": "string",  "details": null,  "message": "string",  "requestId": "string",  "status": 0}
{  "code": "string",  "details": null,  "message": "string",  "requestId": "string",  "status": 0}
{  "code": "string",  "details": null,  "message": "string",  "requestId": "string",  "status": 0}
{  "code": "string",  "details": null,  "message": "string",  "requestId": "string",  "status": 0}