title: Sign in with Apple (iOS App + Backend verification) API returns error "invalid_client"
body: <p>I'm trying to implement <strong>Sign In with Apple</strong> with an iOS app and a backend. The goal is this:</p>
  
  <ol>
  <li>The User signs in on the iOS app</li>
  <li>After a positive response the app calls an endpoint on the backend and hands over the <code>authorizationCode</code></li>
  <li>The backend now needs to verify the <code>authorizationCode</code> with another call to apple's server.</li>
  </ol>
  
  <p>Here I'm confused. In order to make this call, the backend needs to provide a bunch of parameters:</p>
  
  <p><strong>URL</strong></p>
  
  <pre><code>https://appleid.apple.com/auth/token
  </code></pre>
  
  <p><strong>Query Parameters</strong></p>
  
  <pre><code>client_id     = com.mycompany.appname
  client_secret = ...
  code          = ... // `authorizationCode` from the signin in the iOS app
  grant_type    = authorization_code
  </code></pre>
  
  <p>I've generated a <code>JWT</code> for the <code>client_secret</code>:</p>
  
  <p><strong>JWT Properties</strong></p>
  
  <pre><code>header:
      kid: &lt;key id, created on Apple Dev Portal&gt;
  claims:
      iss: &lt;team id&gt;
      iat: &lt;current timestamp&gt;
      exp: &lt;current timestamp + 180 days&gt;
      aud: "https://appleid.apple.com"
      sub: "com.mycompany.appname"
  </code></pre>
  
  <p>Yesterday I've created two keys for two apps (A and B) on the Dev Portal, used it to generate secrets and today app A worked and I've got a positive response:</p>
  
  <p><strong>Positive response</strong></p>
  
  <pre><code>{
      "access_token" : "a1e64327924yt49f5937d643e25a48b81.0.mxwz.GN9TjJIJ5_4dR6WjbZoVNw",
      "token_type" : "Bearer", 
      "expires_in" : 3600, 
      "refresh_token" : "rca76d9ebta644fde9edba269c61eeb41.0.mxwz.sMDUlXnnLLUOu2z0WlABoQ", 
      "id_token" : "eyJraWQiOiJBSURPUEsxIcccYWxnIjoiUlMyNTYifQ.eyJpc3MiOiJodHRwczovL2FwcGxlaWQuYXBwbGUuY29tIiwiYXVkIjoiZGUudHJ1ZmZscy5hcHBsZS1zaWduaW4tdGVzdCIsImV4cCI6MTU2NzcwMDI0MiwiaWF0IjoxNTY3Njk5NjQyLCJzdWaaaiIwMDA3NjkuYWY3NDdjMTlmZGRmNDJhNjhhYmFkZjhlNTQ1MmY3NjAuMjIwNSIsImF0X2hhc2giOiJrVThQTkZOUHYxS0RGUEtMT2hIY213IiwiYXV0aF90aW1lIjoxNTY3Njk5NjM5fQ.g3JD2MDGZ6wiVS9VMHpj24ER0XqJlunatmqpE7sRarMkhMHMTk7j8gty1lpqVBC6Z8L5CZuewdzLuJ5Odrd3_c1cX7gparTQE4jCyvyTACCPKHXReTC2hGRIEnAogcxv6HDWrtZgb3ENhoGhZW778d70DUdd-e4KKiAvzLOse-endHr51PaR1gv-cHPcwnm3NQZ144I-xhpU5TD9VQJ9IgLQvZGZ8fi8SOcu6rrk5ZOr0mpt0NbJNGYgH5-8iuSxo18QBWZDXoEGNsa4kS5GDkq5Cekxt7JsJFc_L1Np94giXhpbYHqhcO1pZSGFrJVaMvMMftZfuS_T3sh2yCqkcA"
  }
  </code></pre>
  
  <p>B, however, still doesn't work. Today I revoked the key for A and created a new one and now it doesn't work anymore with the new one, but still with the old one, even though I deleted it on the Dev Portal. I'm so confused.</p>
  
  <p><strong>Response Error</strong>:</p>
  
  <pre><code>{
      "error": "invalid_client"
  }
  </code></pre>
  
  <p>I wonder if Apple needs some time indexing or something like that. I just want to understand how this works.</p>