We are transferring an iOS app from Team A to Team B and following TN3159 to migrate Sign in with Apple users.
Setup on Team A:
The app’s bundle ID (com.example.app) is enabled for Sign in with Apple as its own primary App ID, not grouped. Our website uses a Services ID (com.example.web-service) whose primary App ID is a different App ID (com.example.web), not the app. Some users signed in only on the website and never used the app.
Using a Sign in with Apple key associated with the app’s App ID and client_id=com.example.app, /auth/usermigrationinfo returns a transfer_sub for every user we tested, web-only users included.
Questions:
After the transfer, Team B will exchange these transfer_sub values with client_id=com.example.app and its own client secret. Will that work for users who only authorized the web Services ID? Or can it fail (for example invalid_request) because they never authorized the app’s App ID? If it can fail, can we change the Services ID’s primary App ID to the app’s App ID before the transfer, so the Services ID transfers with the app (as TN3159 describes)? Would that affect existing users, for example by changing their identifiers or asking for consent again? For users with a private relay email: since Team A has no other app those users use, does the old relay address stop forwarding after the transfer? Does the exchange return the new relay address for web-only users too?
Thanks!