Guideline 4.8: when you must offer Sign in with Apple

Deciding whether it applies

Answer these in order:

1. Does the app offer any third-party or social login (Google, Facebook, X, LINE, Kakao, and so on) as a way to create an account? If no, stop; 4.8 is not your problem.
2. Do you also offer an option meeting the equivalence conditions above? If yes, you are done.
3. If no: add one. Sign in with Apple is the obvious choice, and it is not the only permissible one — the guideline describes conditions, not a brand.

The frequent misreading is that offering email-and-password automatically satisfies it. It can, if it genuinely meets the conditions, including the email-privacy one. Read the conditions rather than the summary, because "we have an email option" is the answer that gets appealed and lost.

The three ways it actually breaks in React Native

1. The entitlement is missing. expo-apple-authentication needs the Sign in with Apple capability, which means declaring it in app config so that prebuild writes the entitlement into the generated project. Adding it by hand in Xcode works until the next expo prebuild --clean, at which point the entitlement disappears and sign-in fails on device with an error that does not name the cause.

// app.json
"ios": {
  "usesAppleSignIn": true
}

Verify after building, not after editing:

# the built app should declare the capability
grep -A2 'applesignin' ios/*/\*.entitlements

2. The private relay email is rejected. A user who chooses "Hide My Email" gives you [email protected]. Backends break on this in two ways: validation logic that treats the domain as disposable and refuses it, and transactional email that never arrives because your sending domain is not registered with Apple's private email relay service. Register it. A signup that succeeds and then never delivers the confirmation is indistinguishable, to a reviewer, from a broken app.

3. The name comes back exactly once. Apple returns the user's name only on the first authorization. If your app does not persist it then, it is gone, and every subsequent sign-in yields an account with no name. Testers hit this immediately, because they delete the app and reinstall: the second run returns no name, and the code path that assumed one crashes or shows a blank profile. Revoke the app in Settings to get a genuine first-run again, or you will test the wrong path forever.

What a reviewer does with it

The test is short and it is always the same: install, tap the Apple button, complete the flow, land in the app. Then, frequently, sign out and sign back in.

That second half is where implementations fail, because the first run and the returning run take different code paths and only the first one gets tested during development. What reviewers actually test.

If the flow fails, the rejection you receive is usually 2.1 App Completeness, with a screenshot. It is not filed as a 4.8 problem, which is why searching the guideline number does not find you an answer.

Related requirements people confuse with this one

Account deletion is the one that pairs with 4.8 in practice. Adding a login service means adding accounts, and adding accounts means 5.1.1(v) applies from that release onward. Teams add the sign-in button in one sprint and discover the deletion requirement in the rejection.

The pre-submission check

# capability declared where prebuild will see it
grep -n 'usesAppleSignIn\|apple-authentication' app.json app.config.js package.json

# and present in what actually got built
ls ios/*/*.entitlements && grep -c applesignin ios/*/*.entitlements

# backend does not reject the relay domain
grep -rn 'privaterelay\|appleid.com' src server 2>/dev/null | head

Then do the two-run test on a real device: fresh authorization, then revoke in Settings, then authorize again. If the name is only present on the first run and your code needs it on both, you have found the bug before Apple did, which is the entire point.

shipcheck reads app config, the generated entitlements and Podfile.lock together and flags a Sign in with Apple integration whose capability is not declared where prebuild can write it, citing the guideline text. What it checks. · The first-submission checklist.

Questions and answers