Ctrl+Z Therapy
CasesQuick answersGuides10-minute checklistHow we testCartoonSend it in

Sign in with Apple stopped working? The secret key expires every 6 months

Ship ItChecked against the official source

Source checked 10 Oct 2026 · Published 23 Oct 2026 · Last reviewed 23 Oct 2026 · By Ctrl+Z Therapy (how we test)

The short answer

If your app uses Sign in with Apple through a web/OAuth flow, like Supabase Auth on a website, Supabase's docs say "Apple requires you to generate a new secret key every 6 months". Supabase calls it "a critical maintenance task that will cause authentication failures if missed". So logins can stop working with no code change.

What to do

  1. Generate a new secret key with your .p8 signing key, and paste it into your auth settings.
  2. Store the .p8 file securely. You'll need it for each rotation.
  3. Set a recurring calendar reminder every 6 months to rotate the secret key.
  4. Ask your AI tool: "Does this app use Sign in with Apple through a web/OAuth flow? If yes, tell me where the Apple secret key is set and the date it expires."

Good to know

  • Native-only Sign in with Apple, inside an iPhone app, doesn't require secret key rotation.
  • Apple's own client-secret documentation also limits the expiry to six months. We checked Supabase's guide, not other login providers.

Source

Checked on 10 Oct 2026. Prices, limits and settings change, so check the source before you rely on them.