I saw this exact error when trying to use an Authorization Code that was expired. They only last 5 minutes. You can use the refresh token instead. Here is further details: https://developer.apple.com/documentation/sign_in_with_apple/generate_and_validate_tokens OP mentions it didn't work on  Apple's reviewing devices. I'm guessing they are testing flows that you have not setup correctly. Just a helpful tip for testing you can always revoke access here: https://appleid.apple.com and then generate new auth/refresh codes. But your code should be storing the codes and handle both cases. Hope that helps