Resolved — the cause was a broken distribution certificate on my side, not a problem with Sign in with Apple itself. Posting the full diagnosis because the symptom is extremely misleading and several older threads describe the same dead end. What was actually wrong My Apple Distribution certificate (managed by EAS / Expo) was faulty. Every build signed with it failed Sign in with Apple — both Ad Hoc and App Store/TestFlight. Deleting the certificate, revoking it in the Developer Portal, and generating a new certificate and provisioning profile fixed it immediately. Why it was so hard to find The entitlements were correct the whole time. I inspected the signed IPA with codesign -d --entitlements and it showed com.apple.developer.applesignin = ["Default"]. The App ID capability, the provisioning profile and the embedded profile inside the IPA were all correct. Everything that can be inspected looked right — the certificate is the one layer that cannot be verified by looking at it. iOS disguises the failure as a user cancellation. The error returned is "The user canceled the authorization attempt" with no error code, even though no cancellation happened. This points the investigation at the user and away from the build. The error object looked empty but was not. Native error fields are non-enumerable, so JSON.stringify(error) printed {}. Iterating with Object.getOwnPropertyNames() reveals domain, code and userInfo. How to find it quickly Build a minimal native test project (SwiftUI + ASAuthorizationController, about 200 lines) and run it on the same device. Then narrow down in layers: Step Setup Result 1 Fresh bundle ID, Xcode-managed signing worked 2 The real bundle ID, Xcode-managed signing worked 3 The real app, built locally in Xcode worked 4 The real app via CI, new certificate worked Steps 1–3 ruled out the device, the Apple ID, the App ID and the app code in about an hour. Everything before that — days of re-checking capabilities, regenerating profiles and comparing entitlements — found nothing, because nothing was wrong there. Takeaway If Sign in with Apple fails with "The user canceled the authorization attempt" and your entitlements and provisioning profile check out, regenerate the distribution certificate. And test with a minimal native project rather than inspecting configuration: the certificate is the one layer configuration checks cannot see.