Apple Guideline 4.8 Rejection: Mandatory Sign in with Apple (SIWA) with Google Login

According to Apple Review Guideline 4.8, apps that use a third-party or social login service (such as Google or Facebook) must also offer Sign in with Apple as an equivalent option. Failure to do so results in immediate App Store rejection. ### Critical Technical Complexities Resolved by Kerweb: 1. **Frontend & Capacitor Layer:** - Leveraging the native `@capacitor-community/apple-sign-in` plugin to invoke the official iOS system FaceID / TouchID sheet. - Strict adherence to Apple Human Interface Guidelines regarding button styling and prominent positioning. 2. **Backend & Authentication Layer (The First-Login Trap):** - **One-time profile return:** Apple only returns the user's `fullName` and `email` on the very first sign-in attempt. Our architecture guarantees instant database persistence before the session handshake closes. - **Apple Private Relay (Hide My Email):** Reliable support for masked Apple relay email addresses. - **Cryptographic JWT Verification:** Secure decoding and public-key signature verification of the Apple `identityToken` on your backend (Node.js, Python, Laravel, Go).

import { SignInWithApple, SignInWithAppleOptions, SignInWithAppleResponse } from '@capacitor-community/apple-sign-in';

export const handleAppleSignIn = async () => {
  const options: SignInWithAppleOptions = {
    clientId: 'app.kerweb.mobile',
    redirectURI: 'https://kerweb.app/api/auth/apple/callback',
    scopes: 'email name',
    state: '12345',
    nonce: 'nonce',
  };

  const result: SignInWithAppleResponse = await SignInWithApple.authorize(options);
  
  // result.response.identityToken -> to be verified on backend
  // Note: result.response.email & givenName are ONLY provided on first login
  return result.response;
};