# Sign in with Apple setup

HT Portal uses the web OAuth flow because authentication is displayed in an
`SFSafariViewController`. The native target does not invoke Authentication
Services directly.

## Apple Developer configuration

1. Enable Sign in with Apple on the primary App ID used by HT Portal.
2. Create a Services ID for the portal, for example
   `net.hivetechnology.portal.web`, and associate it with that primary App ID.
3. Configure the website domain `portal.hivetechnology.net` and return URL
   `https://rest.portal.hivetechnology.net/auth/social/apple/callback`.
4. Create a Sign in with Apple key and download its `.p8` private key once.

## REST API secrets

Configure these values only in the production secret environment:

```text
APPLE_OAUTH_CLIENT_ID=<Services ID>
APPLE_OAUTH_TEAM_ID=<Apple Developer Team ID>
APPLE_OAUTH_KEY_ID=<Sign in with Apple key ID>
APPLE_OAUTH_PRIVATE_KEY_BASE64=<base64 of the complete .p8 file>
```

The provider is enabled in `o20010.03/setup/config.js`. The callback uses
`form_post`, so both GET and POST callback routes must remain available through
the reverse proxy and ModSecurity configuration.

## Behavior

- `/login` starts social authentication with intent `login`; it may link the
  provider to an existing email but never creates a missing HT Portal account.
- `/signin` starts with intent `register`; it may create the account when no
  matching user exists.
- `/mobile-vpn` exposes only the existing-account login flow.
