According to this CloudKit overview:
CloudKit also enables your users to anonymously sign in to your apps with their iCloud Apple IDs without sharing their personal information.
I can't find anything else in their documentation about this capability. I already have an app with my own backend, so I wouldn't need any of the back-end-as-a-service features that CloudKit offers, but I would like to take advantage of logging a user in with their iCloud account, much the same way we currently do with Facebook and Twitter.
Is that possible with CloudKit, or do you also have to leverage their BAAS features in order to take advantage of login?
From what they discussed at WWDC, you'd do this using the fetchUserRecordIDWithCompletionHandler: method on CKContainer. That returns a CKRecordID that corresponds to the current user. This ID will be stable across devices but different for each app-- so if the same person uses your app on multiple devices, your app will get the same result everywhere, but other apps would get different results from yours.
Once you have the CKRecordID you can look up limited other user data (their name and email, I think) using fetchRecordWithID:completionHandler:. This request will trigger a permission alert to the user, so you only get it if they allow it.
This doesn't require you to use anything else in CloudKit. It does require that the user actually have an iCloud account configured on the device.