eoinnoble

The basic flow I have is as follows:

• iOS app authenticates the user with Apple and gets an authorization code
• the iOS app sends the authorization code along with a state variable to Django (see native_app_calls_this.py)
• make sure that {YOUR_BACKEND_NAME} matches the correct secrets, SOCIAL_AUTH_{YOUR_BACKEND_NAME}_CLIENT etc
• the complete view is where all the magic happens, and 90% of the problems I had there were because:
  • I was using the wrong secrets to try to verify the authorization code
  • I wasn't verifying the code quickly enough, it will expire within ~10 mins
  • I wasn't re-authenticating with Apple after every attempt – Apple will invalidate your original authorization code every time you try to verify it with the complete view, so you always need to get a fresh one for each attempt.