Adding this for future readers: the client secret JWT has a hard maximum lifetime of 6 months (exp − iat ≤ 15777000 seconds), and it expires without any warning — web sign-in just starts returning invalid_client. If you rely on a statically generated secret, it needs to be regenerated at least every 6 months. This can be automated in CI (I maintain an open-source GitHub Action that does this on a schedule: github.com/oskar-makarov/apple-client-secret-rotator), or generate it dynamically server-side if your framework supports it.