Skip to main content
This page documents Apple authentication in Lovable Cloud. It is available only for apps using the built-in backend (Cloud). For an overview of all sign-in methods, see Users and authentication.
Let users sign in to your app with their Apple account instead of creating a password. Like Google authentication, Sign in with Apple can be configured in two ways:
  • Managed by Lovable: Lovable manages the OAuth configuration and security updates. This is the default and requires no Apple Developer account.
  • Your own credentials: you connect credentials from your own Apple Developer account and manage their rotation yourself.
Both options provide the same sign-in experience for users:
  1. The user clicks Sign in with Apple in your app
  2. Apple asks them to confirm with their Apple Account
  3. The user chooses whether to share their email address with your app
  4. Apple redirects the user back to your app, signed in

​
Why use Apple sign-in

Apple sign-in reduces signup friction for users in the Apple ecosystem, and it appeals to privacy-conscious audiences:
  • Faster onboarding without password creation
  • A trusted, familiar confirmation flow on Apple devices
  • Built-in privacy controls, including the option to hide the real email address
  • Reduced password reset and account recovery overhead
  • Pre-verified identity backed by the user’s Apple Account

​
Common use cases

Apple sign-in is commonly used for:
  • Consumer apps with a large iPhone, iPad, or Mac audience
  • Apps that pair a Lovable web app with a mobile experience
  • Products for privacy-conscious users who prefer not to share their real email
  • Apps that already offer Google sign-in and want parity for Apple users

​
Apple authentication setup options

The end-user experience is identical in both modes; the difference is who manages the OAuth credentials.
Lovable manages the OAuth configuration and related security updates. No Apple Developer account is required.Use this option if you:
  • want zero setup
  • do not need the flow tied to your own Apple Developer account
  • do not need to control whether users can sign in without sharing an email
1

Prompt Lovable to add Apple sign-in

Lovable enables the provider in Cloud tab → Users → Auth settings → Apple and adds the sign-in button to your app’s login page. You can also enable it manually from the same settings.
2

Test the flow

Verify that:
  • a Sign in with Apple button appears on your login page
  • users are redirected to Apple to confirm
  • users return to the app in a signed-in state
  • new users appear in Cloud tab → Users
In Managed by Lovable mode, users must share an email address with your app to complete sign-in. Users who pick Apple’s Hide My Email option still provide one: Apple shares a private relay address with your app instead of the real one.

​
Managing Apple authentication

You can switch between Managed by Lovable and Your own credentials at any time from Cloud tab → Users → Auth settings → Apple. Existing accounts are kept, but Apple identifies users per developer team: users who signed up under the previous mode may not be recognized when they next sign in with Apple, and Hide My Email relay addresses change with the team. Plan the switch before your app has many Apple users. To remove the sign-in option, ask Lovable in chat:
Or disable the provider in the auth settings. Users who signed up with Apple keep their accounts but need another enabled sign-in method to get back in.

​
Troubleshooting

Your client secret has probably expired. Apple limits each JWT to 6 months. Generate a new secret from your .p8 key with Generate secret and save it in the Apple auth settings.
The return URLs in your Apple Services ID configuration don’t match the redirect URLs Lovable shows. Copy every return URL from Lovable into the Apple Developer portal exactly, then retry. If sign-in fails only on your published app or custom domain, also check your project’s redirect URLs.
Apple forwards mail sent to the relay address only while the user keeps forwarding on. Treat the relay address like any other email in your app, and offer an in-app way for users to update their contact details.

​
FAQ

Only if you use your own credentials. In Managed by Lovable mode, Lovable provides the OAuth configuration and no Apple Developer account is needed.
Apple shares a private relay address with your app instead of the real one, so the user still has an email your app can use. With your own credentials, the Allow users without an email toggle additionally controls whether users can sign in without providing any address.
If you use your own credentials, the most common cause is an expired client secret: Apple limits each JWT to 6 months. Generate a new secret from your .p8 key and save it in the Apple auth settings.
No. It is an additional sign-in method, and you can offer it alongside email, Google, and other methods.
Yes, anytime from Cloud tab → Users → Auth settings → Apple. Existing accounts are kept, but Apple identifies users per developer team, so users who signed up under the previous mode may not be recognized after the switch. Plan the switch before your app has many Apple users.
No. Sign in with Apple works in any browser. Users sign in with their Apple Account credentials, and users on Apple devices get the smoothest flow.