How to Set Up Social Login with Apple for XFile Ultra
Members can use Sign in with Apple. Unlike Google/Facebook, Apple does not give you a static client secret. XFile Ultra builds a short-lived JWT from your Team ID, Key ID, and .p8 private key.
You need an Apple Developer Program membership.
Before you start
1. Social Login is a Premium plugin. If the Social section shows a lock / “Premium plugin required”, buy Social Login on xfileultra.com, then refresh the license under Settings → Main → Site identity.
2. Turn on the master Social login switch (toggle.mrc) in Admin → Settings → Mods → Social.
3. Copy the read-only Redirect URI shown for that provider — you will paste it into the provider console exactly (https, host, path; no extra slash).
Password sign-in stays available when social login is on.
Where to find it in XFile Ultra
Admin → Settings → Mods → Social
1. Turn Social login on
2. Provider → Apple
3. Turn Apple social login on
4. Fill Services ID, Team ID, Key ID, and Private key (.p8)
5. Copy Redirect URI into Apple as a Return URL
6. Save settings
7. Test on /login or /register (Safari is a good first test)
Fields in XFile Ultra
| Field in admin | Setting key | From Apple |
|---|---|---|
| Apple social login | toggle.social_apple |
Enable/disable |
| Services ID | apple_oauth_client_id |
Services ID (this is the OAuth client id) |
| Team ID | apple_oauth_team_id |
10-character Team ID |
| Key ID | apple_oauth_key_id |
Key ID of the Sign in with Apple key |
| Private key (.p8) | apple_oauth_private_key |
Full contents of the .p8 file |
| Redirect URI | (read-only) | Return URL in the Services ID config |
Redirect URI shape:
https://YOUR-DOMAIN/api/auth/oauth/apple/callbackApple sends the callback as form_post (POST). XFile Ultra accepts that on the callback route.
Scopes used: name, email.
Step 1 — Enable Sign in with Apple on an App ID
1. Open Apple Developer → Certificates, Identifiers & Profiles
2. Identifiers → + → App IDs
3. Register an App ID (or edit an existing one)
4. Enable capability Sign in with Apple
5. Save
Step 2 — Create a Services ID (web client)
1. Identifiers → + → Services IDs → Continue
2. Description: example XFile Ultra web
3. Identifier: reverse-domain style, example com.example.xfileultra.web
4. Register, then open it again
5. Enable Sign in with Apple → Configure
6. Select your primary App ID
7. Domains and Subdomains: example.com (no https://)
8. Return URLs: paste the XFile Ultra Redirect URI exactly
9. Save → Continue → Save
Official: Configure Sign in with Apple for the web.
Step 3 — Create a Sign in with Apple key (.p8)
1. Sidebar → Keys → +
2. Name the key
3. Enable Sign in with Apple → Configure → select the primary App ID
4. Continue → Register
5. Download the .p8 file once (Apple will not show it again)
6. Note the Key ID shown on the key
7. Note your Team ID (Membership details / top of the account page — 10 characters)
Step 4 — Paste into XFile Ultra and test
1. Admin → Settings → Mods → Social → Provider Apple
2. Services ID = the Services ID string (example com.example.xfileultra.web), not the App ID bundle id
3. Team ID = 10 characters
4. Key ID = from the Keys page
5. Private key (.p8) = paste the full file, including:
-----BEGIN PRIVATE KEY-----
...
-----END PRIVATE KEY-----6. Turn Apple social login on → Save settings
7. Private window → Apple button → complete Sign in with Apple
Common problems
Invalid client / JWT / invalid_client
Wrong Team ID, Key ID, Services ID, or mangled .p8 (missing BEGIN/END lines, extra spaces). Recreate the key if the .p8 was lost.
Return URL errors
Return URL must be https and match admin Redirect URI exactly. Domain list must include your host.
Works in Safari only / odd redirects
Usually a domain/Return URL mismatch or mixed www / apex. Align Apple domains with the public site origin.
Email is hidden / relay address
Users can choose “Hide My Email”. That is normal — Apple provides a relay address.
Button missing
All four Apple fields are required. Missing any one disables the provider at runtime.