Sign in with Apple — showcase

Before this works, unlike the Google showcase:

1. Get an Apple Developer account (paid — there's no free tier for this, unlike Google Cloud).
2. In Certificates, Identifiers & Profiles, create a Services ID (not an App ID) — this is your client_id, e.g. com.example.webapp.
3. Apple does not allow localhost, even for the popup flow — redirectURI must match a real domain you own, served over HTTPS.
4. That domain must be verified: host the file Apple gives you at https://yourdomain/.well-known/apple-developer-domain-association.txt (exact path, no redirects, served as text/plain). This applies to the popup flow too, not just redirect-based integrations — and the downloaded file is only valid for 7 days, so expect to re-verify periodically.
5. Add that domain under the Services ID's Domains and Subdomains, and the exact page URL under Return URLs.
6. Replace CLIENT_ID in variant-popup/index.html with your Services ID.

Once it's signed in, you're done — the token in this page is exactly what you'd hand off to whatever other system verifies and consumes it. Verifying the signature (and, if you ever need Apple's own access/refresh tokens, exchanging the auth code) happens wherever you integrate it, not here.