Sign in with Apple

Sign in with Apple is the first button on the app's welcome screen and is available on nhmohio.com/login as well.

In the app

The native flow asks Apple for an identity token and sends it to POST /api/auth/apple. The server verifies it against Apple's published keys and signs you in, creating the account on first use. Apple asks for your name and email only the first time; DomainGuard stores what Apple hands over.

On the website

The web flow (GET /api/auth/apple/start then Apple's form post to POST /api/auth/apple/callback) requests a signed identity token directly and verifies it the same way as the native path. DomainGuard never exchanges a code for Apple API tokens, calls no Apple API on your behalf, and holds no Apple private key; there is nothing to rotate or expire.

Hidden email (relay addresses)

If you choose "Hide my email", Apple gives DomainGuard a relay address that forwards to you. That relay becomes the account's email, and alert emails on paid plans go through it. You can set a different notification email under Settings, Alerts.

Linking Apple to an existing account

An account created with email and password can add Apple: Settings, Profile, Link Apple (GET /api/auth/apple/link, and the nhmohio.com/link-apple page). After linking, both sign-ins land on the same account. If the Apple email differs from the account email, link explicitly rather than signing in with Apple, which would create a second account.

Revocation

Revoking DomainGuard in your Apple ID settings (Sign in with Apple, DomainGuard, Stop using) has no effect on your DomainGuard session or account. To leave, sign out, or delete the account.

Two-factor

Apple's own two-factor stands in for DomainGuard's TOTP on Apple sign-ins. TOTP applies to password sign-ins.

Common questions

I see two accounts. One was created by Apple with a relay email, one by email registration. Sign in to the email account and link Apple from Profile; the Apple-created account can then be deleted.

Can I remove Apple from my account? Set a password on the account first (Settings, Profile), so there is another way in, then contact support to unlink.