Search code examples
iosauthenticationoauthapple-sign-insign-in-with-apple

How to verify realUserStatus value in Sign In With Apple

When signing in using Sign in with Apple for the first time, it returns a value realUserStatus as a part of ASAuthorizationAppleIDCredential in the iOS client. This value indicates whether Apple is confident that the user is real, or not (e.g. it's a script)

My question is how can I verify the value of realUserStatus in my backend authentication system? Because the realUserStatus is returned to iOS client, and the client should tell my server whether it is a bot or not! How can I know if it's not just a script and telling the server that it is real?

Edit (additional clarification): In Apple’s docs it says “ You can skip any additional fraud verification checks or CAPTCHAs that your app normally uses.” but when we use CAPTCHAs, the provider can verify the response, something either Apple doesn’t do, or I can’t find anywhere how to do it!

Solution

  • I just finished a call with an Apple engineer on WWDC online lab.

    So from the iOS 14, the realUserIndicator is included in the identity token, and can be verified with the server.

    For iOS 13 they don't have a solution.