Apple OAuth2 does not return user name, causing App Store rejection

[adriariu]

When using Apple OAuth2 with Flutter and the PocketBase Dart SDK, the returned user meta does not include the user's name, even on the first authorization.
This causes issues with App Store review, as Apple requires displaying the user’s name after sign-in.

Steps to reproduce:

Set up Apple OAuth2 provider in PocketBase.

Use Flutter and the Dart SDK:

final authData = await pb.collection('users').authWithOAuth2('apple', (url) async {
    // open the URL for user sign-in
});

Delete the app from the Apple ID account.

Sign in again.

Actual result:
authData.meta.name is empty:

{
  "name": "",
  "email": "*****@gmail.com",
  "isNew": true,
  "rawUser": {
    "email": "*****@gmail.com",
    "email_verified": true,
    "sub": "..."
  }
}

Expected result:
On the first authorization, name should contain the full name provided by Apple (firstName and lastName).

Notes:

I confirmed this multiple times after removing the app from my Apple ID account.

I found this discussion: #6118
It mentions that the Apple user parameter in the initial POST contains the name, but PocketBase’s apple.go implementation may not be capturing it.

I plan to clone the repo and add debug logs in tools/auth/apple.go to check if Apple’s user JSON is returned, and will submit a PR if confirmed.

Environment:

PocketBase version: 29.2
Platform: iOS

[ganigeorgiev]

I don't have Apple developer account so I cannot assist here (the Apple OAuth2 provider implementation is the only one that I haven't manually tested).

Are the rawUser's firstName and lastName returned as part of the first Apple authorization call?

Note also that the token.Extra("user") parsing was added later but the user at the time wasn't able to help with the testing - #5074 (reply in thread).

Please try to provide a full JSON response of rawUser during first authorization so that all returned properties are known.

[adriariu]

The full meta with rawUser

accessToken: a3d0306f4ee9c4ec3a3c50c4a27796bf5***********, 
avatarURL: , 
avatarUrl: , 
email: i********@gmail.com, 
expiry: 2025-08-11 18:31:20.894Z, 
id: 000169.792dcb4bfbb242858*********, 
isNew: true, 
name: , 
rawUser: {
  at_hash: 7m-IfdhfAJ7qSTN*******, 
  aud: com.weplan.server, 
  auth_time: 1754933478, 
  email: *********@gmail.com, 
  email_verified: true, 
  exp: 1755019880, 
  iat: 1754933480, 
  iss: https://appleid.apple.com, 
  nonce_supported: true, 
  sub: ***********3fc76f4249.1706
}, 
refreshToken: **********d90e7d84b80202.0.prwz.zYvd******AjZ-1aLW8dKXrg, 
username: 

[ganigeorgiev]

If the above is what is returned for rawUser for the first Apple OAuth2 auth, then probably there is something wrong with the way how the user data is extracted.

You can try to add fmt.Println(token.Extra("user")) or similar above Apple.go#L113.

If that doesn't return anything, then either the field is named something else or maybe the default scopes need to change.

[adriariu]

I modified FetchRawUserInfo in tools/auth/apple.go to print out.

func (p *Apple) FetchRawUserInfo(token *oauth2.Token) ([]byte, error) {
	idToken, _ := token.Extra("id_token").(string)

	claims, err := p.parseAndVerifyIdToken(idToken)
	if err != nil {
		return nil, err
	}

	// Replace the problematic debugging section with this:
	fmt.Println("---- User From Apple Token ----")

	// Try all known Apple-specific keys
	appleKeys := []string{
		"user", "id_token", "token_type", "expires_in", "refresh_token", 
		"scope", "state", "name", "firstName", "lastName", "givenName", 
		"familyName", "fullName", "user_name", "real_user_status",
		"given_name", "family_name", "preferred_username", "nickname",
		"profile", "picture", "website", "gender", "birthdate", "zoneinfo",
		"locale", "updated_at", "email_verified", "is_private_email",
	}

	fmt.Println("---- Checking All Possible Apple Keys ----")
	foundAny := false
	for _, key := range appleKeys {
		if value := token.Extra(key); value != nil {
			fmt.Printf("%s: %v\n", key, value)
			foundAny = true
		}
	}

	if !foundAny {
		fmt.Println("No extra fields found in token")
	}

	// Also print the raw token structure (this might show internal fields)
	fmt.Printf("---- Raw Token Structure ----\n%+v\n", token)

	// Add comprehensive debugging
	fmt.Println("---- All Token Extras ----")
	for key, value := range map[string]interface{}{
		"user":          token.Extra("user"),
		"id_token":      token.Extra("id_token"),
		"token_type":    token.Extra("token_type"),
		"expires_in":    token.Extra("expires_in"),
		"refresh_token": token.Extra("refresh_token"),
		"scope":         token.Extra("scope"),
		"state":         token.Extra("state"),
	} {
		if value != nil {
			fmt.Printf("%s: %v\n", key, value)
		}
	}

	fmt.Println("---- JWT Claims ----")
	fmt.Printf("Claims: %+v\n", claims)

	

	// Apple only returns the user object the first time the user authorizes the app
	// https://developer.apple.com/documentation/sign_in_with_apple/sign_in_with_apple_js/configuring_your_webpage_for_sign_in_with_apple#3331292
	rawUser, _ := token.Extra("user").(string)
	if rawUser != "" {
		user := map[string]any{}
		err = json.Unmarshal([]byte(rawUser), &user)
		if err != nil {
			return nil, err
		}
		claims["user"] = user
	}

	return json.Marshal(claims)
}

This was to confirm whether the user field (which contains the user's full name the first time they authorize the app) was present.

Example debug output (sensitive values masked with ***):

---- User From Apple Token ----
---- Checking All Possible Apple Keys ----
id_token: eyJraWQiOi***.eyJpc3MiOiJodHRw*** (JWT trimmed)
token_type: Bearer
expires_in: 3600
refresh_token: r04cb7b652fa*** 
---- Raw Token Structure ----
&{AccessToken: a8a8f03d85*** TokenType:Bearer RefreshToken: r04cb7b652fa*** Expiry:2025-08-12 ... raw:map[access_token:a8a8f03d85*** expires_in:3600 id_token:eyJraWQiOi*** refresh_token:r04cb7b652fa*** token_type:Bearer]}
---- All Token Extras ----
id_token: eyJraWQiOi***.eyJpc3MiOiJodHRw*** (JWT trimmed)
token_type: Bearer
expires_in: 3600
refresh_token: r04cb7b652fa***
---- JWT Claims ----
Claims: map[
  at_hash:u_53Sq8SPi*** 
  aud:com.weplan.server
  auth_time:1754990510
  email:***@gmail.com
  email_verified:true
  exp:1755076912
  iat:1754990512
  iss:https://appleid.apple.com
  nonce_supported:true
  sub:000169.792dcb4bfbb2428587f3023fc76f4249.1706
]

Result:

The user field was not present in any of the token extras during my tests, even after removing the app from my Apple ID account and signing in again.

Only id_token, refresh_token, token_type, expires_in, and email were returned.

This confirms that PocketBase never receives the user JSON from Apple in the current flow, so the user's name is never captured.

[ganigeorgiev]

Thank you for debugging it.

So in that case, my guess for the reason why token.Extra("user") doesn't return anything is one of:

• token.Extra is not populated with the POST body response fields (Apple is the only provider that require POST redirect so I haven't really tested it with other clients)
• "name email" as scopes are not enough (we can rule this out if on the initial Apple authorization popup, there is a text that explain that the name will be shared with the app)
• some obscure configuration need to be set in the Apple OAuth2 app dashboard in order to be allowed (unlikely)

To rule out the first one, you can try to add at the beginning of oauth2SubscriptionRedirect:

info, _ := e.RequestInfo()
fmt.Println(info.Body)

Clear your Apple OAuth2 app authorizations and try to login again. If you see the user field in the response then we'll have to figure out a way to forward it to the auth action somehow (or at least properly document it).

If that doesn't provide any new information, then I'm out of ideas how to debug it. If possible, one option could be to grant me temporary credential for your Apple OAuth2 app and send them to me over support@pocketbase.io and I'll try to find time to investigate in more details this weekend.

[ganigeorgiev]

@adriariu if you are still trying to make it work and have some free time to help me, could you try again with the info.Body print statement and report back the output (it is also important to check whether the user object would be returned as serialized json string or map)?

The Apple docs seems to have been updated so I'll try to find a little bit more information regarding the redirect response.

Edit: based on the information in https://developer.apple.com/documentation/signinwithapple/incorporating-sign-in-with-apple-into-other-platforms#Handle-the-response, it seems that the user field is expected to be returned as part of the redirect response data as json serialized string. I'll try to think of a solution how to forward the redirect data back to the auth action to avoid requiring users to manually send it (at least as part of the all-in-one call).

[ganigeorgiev]

I've pushed in the develop branch a small change that will temporary store the supposedly returned user's name from the redirect so that it can be loaded in the auth handler as seamlessly as possible.

The "fix" will be tagged most likely next weekend.

Once again, I'll appreciate if someone actually test it because I don't have an Apple developer account and I find it difficult to navigate and fully understand their OAuth2 documentation.

[adriariu]

@ganigeorgiev Sorry, I was on holiday. Tomorrow I’ll be back at work and I’ll give you feedback on the commit. Thanks!

[adriariu]

I finally managed to test it, properly and it works great thanks @ganigeorgiev.