Apple SSO: Client-managed setup

Misty Flowers

September 24, 2026 13:50

This article guides setup of Apple as a client-managed identity provider for signing into Finalsite, including what to configure in Apple Developer Console and which values to send to Finalsite to complete the connection.

💡Quick answers

What is this setup used for? Signing into Finalsite using an Apple Account (Sign in with Apple), most commonly for community-facing areas such as alumni portals and parent engagement areas, with the school's own IT team keeping full control over the connection.
Which protocol does it use? OAuth 2.0 with a JWT-based client assertion in place of a traditional client secret. This connection does not use SAML.
What access is needed before starting? A paid Apple Developer Program membership, and an Admin or App Manager role on the school's Apple Developer account. A free Apple Developer account cannot complete this setup.
What does Finalsite need at the end of setup? Five values: the Bundle ID, Services ID, Team ID, Key ID, and the Sign In private key file, sent over a secure channel rather than email.
What's different about Apple's domain verification step? Because the redirect URI lives on Finalsite's domain rather than the school's, Apple's domain verification has to be completed together with Finalsite partway through setup; it isn't something the school finishes alone.
Is this the only way to set up Apple sign-in? No. Schools that do not need this level of control can use the Quick Setup with Finalsite option instead, which requires no configuration on the school's side.

Sign in with Apple lets someone sign in using their existing Apple Account instead of creating a new one. Not familiar with it? Apple's own overview of Sign in with Apple covers the basics of how it works. Setting it up as a client-managed identity provider lets a school's own IT team register and control the Apple Developer account Finalsite uses, rather than relying on a connection Finalsite manages by default.

Apple is most commonly used for community-facing sign-in, such as alumni portals, parent engagement areas, and other public-audience content, rather than for staff or administrative accounts; schools authenticating staff with their existing school identity should use the Microsoft Entra ID or Google Workspace guides instead. This guide walks through registering an App ID and Services ID in Apple Developer Console, generating the values Finalsite needs, and where to go if something stops working.

When to use this setup
Before starting
Step 1: Create or identify an App ID
Step 2: Enable Sign in with Apple on the App ID
Step 3: Create a Services ID
Step 4: Capture the Team ID
Step 5: Configure web authentication and verify the domain
Step 6: Create a Sign in with Apple private key
Step 7: Send the values to Finalsite
Troubleshoot common issues
Alternative: Quick Setup with Finalsite

Am I eligible, and how does this work?

This setup is available to schools that want to let community members, such as parents, alumni, or prospective families, sign in with their own Apple Account, and want full control over the Apple Developer account Finalsite uses. Schools that do not need that level of control can skip this guide entirely and request the Quick Setup with Finalsite option instead, which requires no configuration on the school's side.

Once set up, this works as a sign-in option, not a data sync. Instead of typing a Finalsite password, someone can choose to sign in with their Apple Account. Apple checks who they are and sends Finalsite a confirmation; Finalsite never sees or stores the Apple password.

Setting this up requires registering an App ID and a Services ID in Apple Developer Console, generating a private key, and sending Finalsite five values from that registration. One step along the way, verifying that Finalsite's domain is authorized, has to be completed together with the Finalsite contact rather than finished alone. The steps below cover exactly what to do and where to find each value.

When to use this setup

Use this setup when a school wants to let community members sign in with their own Apple Account and requires full control over the Apple Developer account Finalsite uses for authentication. Apple is best suited to community-facing areas rather than staff or administrative sign-in; see the Microsoft Entra ID or Google Workspace guides for staff use cases. Schools that do not need this level of control can request the Quick Setup with Finalsite option instead; it requires no configuration on the school's side and is enough for most schools.

Before starting

Confirm access to the following before beginning:

A paid Apple Developer Program membership (USD $99 per year). A free Apple Developer account cannot create Services IDs or signing keys, so it cannot complete this setup.
An Admin or App Manager role on the school's Apple Developer account.
Ability to coordinate with the Finalsite contact during Step 5, since the domain verification there cannot be completed by the school alone.

Finalsite also provides one value needed during setup:

Return URL (Redirect URI): https://auth-us-east1.finalsite.com/oauth2/callback

⚠️ Important Note

Three Apple-specific behaviors catch most teams off guard:

Domain verification requires Finalsite's help. Because the redirect URI lives on Finalsite's domain rather than the school's, Apple requires proof that Finalsite controls it before sign-in can work. In Step 5, a verification file gets downloaded and sent to the Finalsite contact, who hosts it; the school's part of this step isn't complete until Finalsite confirms it's hosted and the verification is clicked through in Apple Developer Console.
The private key downloads only once. The private key file created in Step 6 can only be downloaded once. Apple does not store a copy, so if it's lost, the only fix is generating a new key and repeating Step 6.
Apple only shares a user's name on their first sign-in. Apple only shares a user's name with Finalsite on that user's very first Apple sign-in, and never again after that, as a privacy protection built into Sign in with Apple. This is expected behavior, not a bug; see Troubleshoot common issues below for what to do if a user reports a missing name.

Step 1: Create or identify an App ID

Sign in to Apple Developer Console with an account that has the Admin or App Manager role.
Go to Certificates, Identifiers & Profiles → Identifiers, then click +.
Select App IDs as the type, then click Continue.
Choose App as the App ID type.
Fill in the App ID details:
- Description: a name that helps identify it later, such as Finalsite SSO.
- Bundle ID: an explicit, reverse-domain identifier, for example com.yourschool.signin.
Click Continue, review the details, then click Register.

If the school already has an App ID it wants to reuse instead of creating a new one, that's fine; Sign in with Apple just needs to be enabled on it in Step 2. Either way, this Bundle ID is one of the five values sent to Finalsite in Step 7.

Need more help? Visit Apple's guide: register an App ID.

Step 2: Enable Sign in with Apple on the App ID

From Certificates, Identifiers & Profiles → Identifiers, select the App ID created or identified in Step 1.
In the Capabilities list, tick Sign in with Apple.
Click Save. Apple will confirm that this is a permanent change to the App ID; accept the prompt to continue.

Step 3: Create a Services ID

The Services ID acts as the OAuth client ID for the web-based sign-in flow Finalsite uses; it's a separate identifier from the Bundle ID created in Step 1.

From Certificates, Identifiers & Profiles → Identifiers, click +.
Select Services IDs as the type, then click Continue.
Fill in the Services ID details:
- Description: a name that helps identify it later.
- Identifier: a reverse-domain identifier distinct from the Bundle ID, for example com.yourschool.signin.web.
Click Continue, review the details, then click Register.

This Identifier is the "Services ID" sent to Finalsite in Step 7. Web authentication for this Services ID gets configured in Step 5.

Step 4: Capture the Team ID

The Team ID is a 10-character alphanumeric value tied to the school's Apple Developer account, shown in the top-right corner of the console or on the Membership page. Copy it; it's one of the five values sent to Finalsite in Step 7.

Step 5: Configure web authentication and verify the domain

This step requires direct coordination with the Finalsite contact, since domain verification involves Finalsite hosting a file on its own domain.

From Certificates, Identifiers & Profiles → Identifiers, select the Services ID created in Step 3.
Tick Sign in with Apple, then click Configure.
Set the Primary App ID to the App ID from Step 1.
Under Website URLs, add:
- Domains and Subdomains: auth-us-east1.finalsite.com
- Return URLs: https://auth-us-east1.finalsite.com/oauth2/callback
Click Next, then Done.
Apple now requires verifying that this domain is authorized. Download the apple-developer-domain-association.txt file Apple provides and send it to the Finalsite contact.
Finalsite hosts the file at https://auth-us-east1.finalsite.com/.well-known/apple-developer-domain-association.txt and confirms once it's live.
Once Finalsite confirms, return to the Services ID configuration in Apple Developer Console and click Verify.

If verification fails on the first try, wait a few minutes; this is usually a brief DNS or CDN propagation delay, and clicking Verify again after a short wait typically resolves it.

Need more help? Visit Apple's guide: configure Sign in with Apple for the web.

Step 6: Create a Sign in with Apple private key

From Certificates, Identifiers & Profiles → Keys, click +.
Enter a Key Name, then tick Sign in with Apple.
Click Configure, select the App ID from Step 1 as the Primary App ID, then click Save.
Click Continue, then Register.
Click Download to download the .p8 private key file immediately, and save it somewhere secure. Apple does not store a copy; if the download button is already disabled, the key was downloaded previously and a new key will need to be generated.
Note the Key ID shown alongside the new key; it's a 10-character alphanumeric value and one of the five values sent to Finalsite in Step 7.

Need more help? Visit Apple's guide: create a private key.

Step 7: Send the values to Finalsite

Send the Finalsite contact the following five values. Use a secure channel; the private key file is sensitive and should not be shared by email.

Field	Where to find it
Bundle ID	Step 1, the App ID's identifier
Services ID	Step 3, the Services ID's identifier
Team ID	Step 4, top-right of the console or the Membership page
Key ID	Step 6, next to the key in Certificates, Identifiers & Profiles → Keys
Sign In Private Key	Step 6, the downloaded `.p8` file

Finalsite uses these values to configure the connection, tests it, and confirms once sign-in is working for the school's users.

Troubleshoot common issues

Domain verification keeps failing. This is usually a brief DNS or CDN propagation delay after Finalsite hosts the verification file. Wait a few minutes and click Verify again in Apple Developer Console. If it continues to fail, check with the Finalsite contact that the file is confirmed live.
The private key file was lost before it could be sent to Finalsite. Apple does not store a copy of a Sign in with Apple private key once its one-time download window has passed. Revoke the key in Certificates, Identifiers & Profiles → Keys and repeat Step 6 to generate a new one.
A returning user's name is missing in Finalsite. This is expected Apple behavior, not a misconfiguration: Apple only shares a user's name on their very first Apple sign-in, never again afterward. Having the user sign out of their Apple ID and back in does not restore it. If a name is genuinely needed again, that has to be collected another way.
"Your account cannot use Sign in with Apple at this time." This message means two-factor authentication is not enabled on the user's Apple ID; Apple requires it for Sign in with Apple. The user will need to enable two-factor authentication on their Apple ID before they can sign in.

Alternative: Quick setup with Finalsite

Schools that do not need this level of control, or would rather not manage an Apple Developer account for this purpose, can request the Quick Setup with Finalsite option instead. It requires no configuration on the school's side and is enough for most schools.