Sign in with Apple: invalid_client at /auth/authorize Please investigate the Sign in with Apple registration on Apple's authentication backend for the identifiers below. The Developer portal configuration appears correct, but public authorization requests are rejected before the user can sign in. Identifiers and verified configuration Developer Team ID: WW9948F28Q Primary App ID / bundle identifier: com.doorsfps.mobile App ID resource identifier: K3248JASVU Services ID: com.doorsfps.mobile-service Services ID resource identifier: GCF5G4KPN4 Primary App ID has Sign In with Apple enabled with "Enable as a primary App ID". Services ID has Sign In with Apple enabled and is associated with the DoorsFPS primary App ID. Website domain: clerk.doorsfps.com Return URL: https://clerk.doorsfps.com/v1/oauth_callback After leaving and reopening the service configuration, both URLs are present. Apple's confirmation page reports "2 Website URLs". Clerk production Apple Services ID and Return URL match the values above. Reproduction independent of Clerk This public request sends no private key, client secret, cookies, Apple account credentials, or authorization code. The state below is a diagnostic placeholder, not a live Clerk sign-in state. Do not complete an Apple sign-in using this diagnostic request; restart sign-in from the application for an actual login. curl --get 'https://appleid.apple.com/auth/authorize' \ --data-urlencode 'client_id=com.doorsfps.mobile-service' \ --data-urlencode 'redirect_uri=https://clerk.doorsfps.com/v1/oauth_callback' \ --data-urlencode 'response_type=code' \ --data-urlencode 'response_mode=form_post' \ --data-urlencode 'scope=name email' \ --data-urlencode 'state=doors-apple-diagnostic' Expected: Apple accepts the registered client and presents the sign-in flow. Actual: Apple returns an HTML error page containing invalid_client and Invalid client. The HTTP transport status is 200; Apple's response headers carry the following error information: Field Services ID request Date Fri, 28 Aug 2026 15:05:30 GMT X-Apple-I-Request-ID e91f0c01-a2f1-11f1-a42e-371ffc943bfa X-Apple-I-Rscd 400 X-Apple-I-Ercd -24000 An additional diagnostic request with client_id=com.doorsfps.mobile and the same remaining parameters also returned invalid_client: Field Primary App ID diagnostic request Date Fri, 28 Aug 2026 15:07:33 GMT X-Apple-I-Request-ID 31f6f6f3-a2f2-11f1-9992-497df8a03fd6 X-Apple-I-Rscd 400 X-Apple-I-Ercd -24000 The App ID request is supplementary diagnostic evidence; the production Clerk web flow remains configured with the Services ID. No token-exchange or native-app sign-in test was performed. Request Please check whether the primary App ID and Services ID are correctly registered and available to the Sign in with Apple authentication servers, including any team or identifier provisioning issue. We cannot confirm the backend cause from the client side. Apple's TN3107 describes authorization-stage invalid_client as an inability to find the primary app or web service for the supplied client ID. Recent reports in the following Apple Developer thread describe related client lookup failures; Apple staff responded to affected developers, and developers reported resolution without client changes. These reports are supporting context, not proof that this account has the same cause. https://developer.apple.com/documentation/technotes/tn3107-resolving-sign-in-with-apple-response-errors https://developer.apple.com/forums/thread/837986 This note intentionally excludes private keys, cookies, session identifiers, and live OAuth state values. No configuration was changed or credentials rotated during these checks, and this report has not been submitted to Apple.