We are in the process of transferring our existing Apple account to a new account. We read the documentation and we realized that "Sign in with Apple" users needs to be migrated via API. This API seems to require "sub" which we are not currently storing in our systems. So we are planning to "collect subs" over a period before we can start transfer.
I want to make sure we are collecting correct data so I am looking for confirmation from Apple engineers on this. Should we get "sub" from "user" property in ASAuthorizationAppleIDCredential or by decoding identityToken and get "sub" from the token? I think both are same but wanted to double check. Thank you!
Hi @JayMuthialu,
You wrote:
I want to make sure we are collecting correct data so I am looking for confirmation from Apple engineers on this. Should we get "sub" from "user" property in ASAuthorizationAppleIDCredential or by decoding identityToken and get "sub" from the token? I think both are same but wanted to double check.
Yes, both values are expected to be identical. The ASAuthorizationAppleIDCredential API is to be used by apps without a backend server infrastructure; otherwise, the backend server should verify the tokens provided to the app during authorization. To learn more, see the following documentation:
Verifying a user
https://developer.apple.com/documentation/signinwithapple/verifying-a-user
To learn more about the importance of sub, and its expectation as the primary unique identifier for your apps and websites, please see below:
TN3194: Handling account deletions and revoking tokens for Sign in with Apple: Securely store user tokens for account creations
https://developer.apple.com/documentation/technotes/tn3194-handling-account-deletions-and-revoking-tokens-for-sign-in-with-apple#Securely-store-user-tokens-for-account-creations
Cheers,
Paris X Pinkney | WWDR | DTS Engineer
