fix(api,swift): accept native iOS client IDs for Google and Apple sign-in by mikib0 · Pull Request #2638 · PackRat-AI/PackRat

mikib0 · 2026-07-22T08:17:35Z

Description

Native sign-in from the Swift iOS app was failing with "Invalid id token" for both Google and Apple providers.

Google: the Swift app authenticates with the iOS-specific Google OAuth client ID, whose aud claim differs from the web client ID Better Auth was validating against.
Apple: the Swift app is a separate Xcode target (com.andrewbierman.packrat.swift) from the Expo app's EAS build variants, so its Apple ID token's aud claim never matched Better Auth's configured audience list. Its entitlements file also had an empty <dict/>, missing the com.apple.developer.applesignin capability.

Type of change

🐛 Bug fix

Area(s) affected

Mobile app (apps/swift, not listed above but affected)
API / Backend (packages/api)

Testing

Manually tested on macOS build (Apple Sign-In sheet completes; API config confirmed correct via debug audience/claims logging)
bun check-types, bun check (scoped to changed files), bun test:api:unit (619 tests) all pass

Pre-merge checklist

bun format && bun lint passes with no errors
bun check-types passes with no errors
No new secrets or credentials are committed
Database migration included (if schema changed) — N/A
Feature flag added (if this is a new feature) — N/A
PR title follows conventional commits

Notes for reviewers

Local testing surfaced a separate infra issue unrelated to this PR's code: wrangler dev's local sandbox gets a 403 Forbidden from https://appleid.apple.com/auth/keys (Apple's JWKS endpoint), which blocks Apple Sign-In from completing in local dev regardless of this fix. The audience/bundle-ID config was verified correct via debug logging before this was discovered — this fix should still be validated against a deployed (non-local) API environment.

Requires deploying these new env vars to staging/prod as Worker secrets:

GOOGLE_IOS_CLIENT_ID
APPLE_SWIFT_CLIENT_ID (value: com.andrewbierman.packrat.swift)

Summary by CodeRabbit

New Features
- Added Apple Sign-In support for the iOS app.
- Improved native iOS Google and Apple authentication compatibility.
- Added configuration options for native mobile OAuth credentials.
Bug Fixes
- Fixed validation of authentication tokens from native iOS sign-in flows.

Native Google Sign-In on iOS mints an ID token with the iOS OAuth client ID as its aud claim, not the web client ID Better Auth was validating against — causing "Invalid id token" on every Swift Google sign-in. Better Auth's google provider accepts an array of client IDs, so pass both.

The Swift iOS app is a separate Xcode target (com.andrewbierman.packrat.swift) from the Expo app's EAS build variants, so its Apple ID token's aud claim never matched Better Auth's configured audience list — sign-in failed with a generic "content could not be loaded" error in the Swift UI. Add APPLE_SWIFT_CLIENT_ID to the accepted audiences, mirroring the iOS Google client ID fix.

PackRat-iOS.entitlements had an empty dict, so the iOS app never declared the com.apple.developer.applesignin capability even though it's wired into the Xcode project's provisioning. Native Apple Sign-In needs this entitlement present for a device build to be authorized.

coderabbitai · 2026-07-22T08:17:57Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: f6d0e386-2de2-42ed-9a2d-74561f939912

📥 Commits

Reviewing files that changed from the base of the PR and between 45e0660 and 5c82f91.

📒 Files selected for processing (4)

apps/swift/Resources/PackRat-iOS.entitlements
packages/api/.dev.vars.e2e.example
packages/api/src/auth/index.ts
packages/api/src/utils/env-validation.ts

Walkthrough

Adds iOS Apple Sign-In entitlement support and configures API Google and Apple OAuth validation for native client IDs.

Changes

Native OAuth configuration

Layer / File(s)	Summary
Native identity setup `apps/swift/Resources/PackRat-iOS.entitlements`, `packages/api/.dev.vars.e2e.example`	Enables the Apple Sign-In entitlement and adds Google iOS and Apple Swift client ID placeholders.
API OAuth audience wiring `packages/api/src/utils/env-validation.ts`, `packages/api/src/auth/index.ts`	Validates the native client ID variables and includes them in Google and Apple OAuth audience configuration.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

PackRat-AI/PackRat#2629: Adds the Google iOS client ID to the Swift app configuration, complementing this API wiring.

Suggested labels: mobile

Suggested reviewers: andrew-bierman, claude

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: native iOS client ID support for Google and Apple sign-in.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch fix/swift-apple-google-signin-audience

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

github-actions · 2026-07-22T08:18:07Z