{"record":{"id":"31609c19ed599128","repo":"gitroomhq/postiz-app","slug":"invalid-provider-token-31609c","errorCode":null,"errorMessage":"Invalid provider token","messagePattern":"Invalid provider token","errorType":"error_code","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"apps/backend/src/services/auth/providers/apple.provider.ts","lineNumber":99,"sourceCode":"        'Content-Type': 'application/x-www-form-urlencoded',\n      },\n      body: new URLSearchParams({\n        grant_type: 'authorization_code',\n        code,\n        redirect_uri: redirectUri || defaultRedirect(),\n        client_id: clientId,\n        client_secret: clientSecret(),\n      }).toString(),\n    });\n\n    if (!response.ok) {\n      const error = await response.text();\n      throw new Error(`Token request failed: ${error}`);\n    }\n\n    const { id_token } = await response.json();\n    if (!id_token) {\n      throw new Error('Invalid provider token');\n    }\n\n    return id_token;\n  }\n\n  async getUser(providerToken: string) {\n    const { clientId } = getConfig();\n    const decoded = decode(providerToken, { complete: true });\n    const { keys } = await (\n      await fetch('https://appleid.apple.com/auth/keys')\n    ).json();\n\n    const key = keys.find(\n      (k: { kid: string }) => k.kid === decoded?.header?.kid\n    );\n    if (!key) {\n      throw new Error('Invalid provider token');\n    }","sourceCodeStart":81,"sourceCodeEnd":117,"githubUrl":"https://github.com/gitroomhq/postiz-app/blob/0f1647f7491a217d43eb5ae7a480484bdf0aff3e/apps/backend/src/services/auth/providers/apple.provider.ts#L81-L117","documentation":"Apple's token endpoint responded 2xx but the JSON body contained no id_token, which is the only credential this flow uses. Without id_token the Apple sign-in cannot proceed.","triggerScenarios":"Exchange succeeds at HTTP level but the response only contains an access_token (wrong response_type/scope, e.g. missing the 'openid' scope) or Apple returns an unexpected/empty body.","commonSituations":"The Services ID's scope configuration omits openid/name/email; requesting response_type that only yields a code+access_token; Apple behavior change in the token response shape; parsing the wrong endpoint response.","solutions":["Ensure the authorization request includes scope 'openid name email' and response_type 'code'","Verify you're posting to https://appleid.apple.com/auth/token with grant_type=authorization_code","Log the full token response body to see exactly which fields Apple returned","If the body contains an error object, address that error (it can come with a 200 in some proxies)"],"exampleFix":"// before\nconst url = `?client_id=${clientId}&redirect_uri=${uri}&response_type=code`;\n\n// after\nconst url = `?client_id=${clientId}&redirect_uri=${uri}` +\n  `&response_type=code&scope=name%20email`; // server adds openid via response_mode form_post","handlingStrategy":"try-catch","validationCode":"null","typeGuard":"const hasIdToken = (b: unknown): b is { id_token: string } =>\n  typeof (b as any)?.id_token === 'string' && (b as any).id_token.length > 0;","tryCatchPattern":"try {\n  const token = await appleProvider.getToken(code);\n} catch (e) {\n  if (e instanceof Error && e.message === 'Invalid provider token') {\n    return restartFlowWithOpenIdScope();\n  }\n  throw e;\n}","preventionTips":["Include openid scope in the Apple authorization request","Inspect the full token response body during integration testing"],"tags":["oauth","apple","openid","id-token"],"backgroundTag":"oauth-id-token-missing","analyzedSha":"0f1647f7491a217d43eb5ae7a480484bdf0aff3e","analyzedAt":"2026-08-27T12:09:55.020Z","schemaVersion":2},"datasetVersion":"2026-08-27T13:17:12.746Z"}