I have the exact same experience, including removing current return urls from a service id, and despite that fact they continue to work. I am attempting to implement sign in on a website. No new App Ids I create work (invalid client). New new service ids or even return urls in existing service ids work (invalid redirect). This issue probably hasn't gained much momentum because it will only affect new things, while anyone with existing service Ids is probably fine. On top of that, if you're like me and doing this for the first time, it's easy to assume that the problem lies on your side rather than Apple's. I believe I have exhausted all possible avenues on my side. This definitely seems like some kind of a caching issue. Check your CDNs - I don't think they're getting invalidated.