# Give Firebase your Sign in with Apple key, so that deleting an account works

The step `firebase_auth.apple_revocation`, for [`firebase_auth`](https://doc.saymyframe.com/modules/firebase-auth.md).

When a user who signs in with Apple deletes the account, the app revokes the tokens that Apple gave it, as the App Store asks of every app with Sign in with Apple (App Store Review Guideline 5.1.1(v)). Firebase revokes them with a key for Sign in with Apple and a Services ID of your team. Until you give Firebase both, deleting such an account fails with the reason `notConfigured`, and the account stays. Firebase then answers `Code flow is not enabled for Apple`.

You make a key and a Services ID in your Apple Developer account, then enter both in the settings of the Apple provider in Firebase. Turn on the Apple provider first; see [the step about it](https://doc.saymyframe.com/setup/firebase-auth-apple-provider.md).

:::tip
The screenshots use example values: the Team ID `SAYMYFRAME`, the Key ID `SMFSIWAKEY`, the bundle id `com.example.my-app`, the Services ID `com.example.my-app.signin` and the Firebase project `my-app-12345`. Your Team ID is under **Membership details** in your Apple Developer account. The orange frames mark what to click or fill in, in the order of their numbers.
:::

## 1. A key for Sign in with Apple

In [your Apple Developer account](https://developer.apple.com/account), open **Certificates, IDs & Profiles**, then **Keys**, and click the **+** next to the title. Name the key (1), such as `My App Sign in with Apple`, check **Sign in with Apple** (2) and click **Configure** (3) in its row.

![Register a New Key, with the name My App Sign in with Apple marked 1, the checked Sign in with Apple marked 2 and its Configure button marked 3](https://doc.saymyframe.com/assets/images/new-key-siwa-a88d93dd91a45e93a46d16cb00f226fb.png)

Choose the App ID of the app as the **Primary App ID** (1) and click **Save** (2).

![Configure Key, with the primary App ID My App, SAYMYFRAME.com.example.my-app, marked 1 and Save marked 2](https://doc.saymyframe.com/assets/images/configure-siwa-e7b32a5fbd66dfac118f61fe2f772f40.png)

Click **Continue**, then **Register**. On the page of the key, copy the **Key ID** and click **Download** for the `.p8` file.

:::warning
Apple lets you download the file **only once**. Keep it in a password manager. The private key in it is a secret: you paste it into the Firebase console yourself, and it never goes into the app or its repository.
:::

## 2. A Services ID

Open **Identifiers** and click the **+** next to the title. Choose **Services IDs** (1) and click **Continue** (2).

![Register a new identifier, with Services IDs selected and marked 1, and Continue marked 2](https://doc.saymyframe.com/assets/images/new-identifier-services-ids-d07c32dfb47b44a77bbf766da58adb44.png)

Enter a description (1), such as `My App sign-in`, and an identifier (2). The bundle id of the app with `.signin` at the end is a good choice; it cannot be the bundle id itself. Click **Continue** (3), then **Register**.

![Register a Services ID, with the description My App sign-in marked 1, the identifier com.example.my-app.signin marked 2 and Continue marked 3](https://doc.saymyframe.com/assets/images/register-services-id-2579298aeab224c4bd379af86408dada.png)

Switch the filter at the top right of the list from **App IDs** to **Services IDs** (1) and click the new Services ID (2).

![The Identifiers page with the filter Services IDs marked 1, and the Services ID My App sign-in marked 2](https://doc.saymyframe.com/assets/images/services-ids-list-7c430bd96f73382fa622065b7d62e024.png)

Check **Sign In with Apple** (1) and click **Configure** (2).

![Edit your Services ID Configuration, with the checked Sign In with Apple marked 1 and its Configure button marked 2](https://doc.saymyframe.com/assets/images/services-id-edit-cdbe04858c1a7ece0ace25ac7e78df58.png)

Choose the App ID of the app as the **Primary App ID** (1), then click the **+** next to **Website URLs** (2).

![Web Authentication Configuration, with the primary App ID marked 1 and the plus button of the website URLs marked 2](https://doc.saymyframe.com/assets/images/services-id-web-auth-11c362dcccffe97075b3f21d1a4fd627.png)

Enter the domain (1) and the return URL (2) of your Firebase project, with the id of your project in place of `my-app-12345`:

- **Domains and Subdomains:** `my-app-12345.firebaseapp.com`
- **Return URLs:** `https://my-app-12345.firebaseapp.com/__/auth/handler`

The settings of the Apple provider in Firebase show this return URL too, with a button that copies it.

![Register Website URLs, with the domain of the Firebase project marked 1, its return URL marked 2 and Next marked 3](https://doc.saymyframe.com/assets/images/services-id-urls-7c4667199f4dd8009be481e724359c38.png)

Click **Next** (3), then **Done**, then **Continue**, and **Save**.

## 3. Both in Firebase

In the [Firebase console](https://console.firebase.google.com/), open **Authentication**, the tab **Sign-in method**, and click **Apple** in the list of providers. Open **OAuth code flow configuration**, then fill in:

1. **Services ID:** the identifier from part 2, such as `com.example.my-app.signin`.
2. **Apple team ID:** your Team ID.
3. **Key ID:** the Key ID from part 1.
4. **Private key:** open the `.p8` file in a text editor and paste all of it, from `-----BEGIN PRIVATE KEY-----` to `-----END PRIVATE KEY-----`.

![The settings of the Apple provider, with the Services ID, the Apple team ID, the Key ID and the empty field of the private key marked 1 to 4](https://doc.saymyframe.com/assets/images/apple-code-flow-fields-17b304c08fca9174c01ede238ecd1ad0.png)

Then click **Save** (5). The return URL that part 2 gives Apple is the one under the fields, which the button next to it copies.

![The bottom of the settings of the Apple provider, with the callback URL of the project and the button Save marked 5](https://doc.saymyframe.com/assets/images/apple-code-flow-save-cbfb48f00361e0b0dc6a28990f4ac706.png)

**Check.** Sign in with Apple in the app, then delete the account on the screen of the account. The app deletes the account and returns to the sign-in, and the user is gone from the tab **Users** of Authentication.