Sign in with Apple

In the app

The native flow asks Apple for an identity token and sends it to POST /api/auth/apple. The server verifies it against Apple's published keys and signs you in, creating the account on first use. Apple asks for your name and email only the first time; DomainGuard stores what Apple hands over. The app also sends Apple's one-time authorization code, which the server exchanges with Apple for a refresh token and stores encrypted. That token is used for one thing: revoking DomainGuard's access with Apple when you delete the account.

On the website

The web flow (GET /api/auth/apple/start then Apple's form post to POST /api/auth/apple/callback) requests a signed identity token directly and verifies it the same way as the native path. The web flow does not exchange its code for Apple tokens, so a web sign-in stores no Apple token. (The app's sign-in does; see above.)

Hidden email (relay addresses)

If you choose "Hide my email", Apple gives DomainGuard a relay address that forwards to you. That relay becomes the account's email, and account mail such as password resets and scan reports you ask for goes through it. Alerts are not emailed; they arrive in the Alerts feed and the app.

Linking Apple to an existing account

There is no Link button. Sign in with Apple and share the same email address as your existing account (not Hide my email): DomainGuard sees the account, emails a link to that address, and the link (valid for 15 minutes, opening nhmohio.com/link-apple) connects your Apple ID. Sign in again and both sign-ins land on the same account. Settings, Profile shows Sign in with Apple: Linked afterwards. If you share a different address, or hide it, Apple sign-in creates a second account instead.

Revocation

Revoking DomainGuard in your Apple ID settings (Sign in with Apple, DomainGuard, Stop using) has no effect on your DomainGuard session or account. To leave, sign out, or delete the account; deleting also revokes the app's stored Apple token.

Two-factor

Apple's own two-factor stands in for DomainGuard's TOTP on Apple sign-ins. TOTP applies to password sign-ins.

Common questions

I see two accounts. One was created by Apple with a relay email, one by email registration. Delete the Apple-created account, then sign in with Apple again sharing your real address, and follow the emailed link to connect it to the email account.

Can I remove Apple from my account? Give the account a password first, so there is another way in: nhmohio.com/forgot-password sends a reset link to the account's email. Then contact support to unlink.