# Implement discourse Apple login using API

**URL:** <https://meta.discourse.org/t/implement-discourse-apple-login-using-api/286700>\
**Category:** Development\
**Tags:** apple-auth\
**Created:** [November 27, 2023, 8:49am UTC](https://meta.discourse.org/t/implement-discourse-apple-login-using-api/286700 "2023-11-27T08:49:50Z")\
**Posts on this page:** 1\
**Showing post:** 1

<div class="post-metadata">

**Author:** ![wings](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/wings/32/331381_2.png) [@wings](https://meta.discourse.org/u/wings)\
**Post date:** [November 27, 2023, 8:49am UTC](https://meta.discourse.org/t/implement-discourse-apple-login-using-api/286700/1 "2023-11-27T08:49:50Z")

</div>

Hi, I am working on building an API for Discourse login using Apple. I have already installed the plugin and followed the instructions from [Discourse Apple Authentication](https://meta.discourse.org/t/discourse-apple-authentication/171485). It works fine when logging into Discourse using an Apple account in website.

Upon checking the flow of Apple login from the web, I noticed that it redirects to the Apple page for login, obtains a code generated from Apple upon successful login, and then redirects to:

POST `{{discourse_host}}/auth/apple/callback` with parameters `state:{state}, code:{code from Apple}`

After that, it redirects to GET `{{discourse_host}}/auth/apple/callback?code={{code from Apple}}&state={state}`, generating a new cookie that will be used in the Discourse API.

 ![image](https://global.discourse-cdn.com/meta/original/4X/8/6/5/86568e507ad1e5c938b8eae417b6d3e600e02470.png)

from this flow I expect it will generate a new cookie after the call `/auth/apple/callback`

But when I try to call the API it will show the error `Authorization timed out, or you have switched browsers. Please try again.`

 ![image](https://global.discourse-cdn.com/meta/original/4X/9/f/8/9f861776c1ecb7552f3635e49db3ee2ef0fcfa3b.png)

So I tried again with a new code generated by Apple but still got the same error

And when I check the log it show

```plaintext
Started GET "/auth/apple/callback?code=c32f105b5084d42b8bd3e7051873ddb55.0.rrzxz.pChPU9zGlXIHHhgEXLiA5g&state=fbi3bbboud" for>
(apple) Setup endpoint detected, running now.
(apple) Callback phase initiated.
(apple) Authentication failure! csrf_detected: OmniAuth::Strategies::OAuth2::CallbackError, csrf_detected | CSRF detected
Started GET "/auth/failure?message=csrf_detected&strategy=apple" for 123.253.233.16 at 2023-11-27 06:10:28 +0000
Processing by Users::OmniauthCallbacksController#failure as HTML
  Parameters: {"message"=>"csrf_detected", "strategy"=>"apple"}
  Rendered users/omniauth_callbacks/failure.html.erb within layouts/no_ember (Duration: 4.1ms | Allocations: 17)
  Rendered layout layouts/no_ember.html.erb (Duration: 57.5ms | Allocations: 2882)

```

 ![image](https://global.discourse-cdn.com/meta/original/4X/5/b/9/5b9d4e8aa7d0ac1a27e29c5acfd07223223a35bc.png)

```plaintext
Message (47 copies reported)

(apple) Authentication failure! csrf_detected: OmniAuth::Strategies::OAuth2::CallbackError, csrf_detected | CSRF detected

Backtrace

/var/www/discourse/vendor/bundle/ruby/3.2.0/gems/omniauth-1.9.2/lib/omniauth/strategy.rb:163:in `log'
/var/www/discourse/vendor/bundle/ruby/3.2.0/gems/omniauth-1.9.2/lib/omniauth/strategy.rb:486:in `fail!'
/var/www/discourse/vendor/bundle/ruby/3.2.0/gems/omniauth-oauth2-1.7.3/lib/omniauth/strategies/oauth2.rb:87:in `callback_phase'
/var/www/discourse/plugins/discourse-apple-auth/lib/omniauth_apple.rb:60:in `callback_phase'
/var/www/discourse/vendor/bundle/ruby/3.2.0/gems/omniauth-1.9.2/lib/omniauth/strategy.rb:238:in `callback_call'
/var/www/discourse/vendor/bundle/ruby/3.2.0/gems/omniauth-1.9.2/lib/omniauth/strategy.rb:189:in `call!'
/var/www/discourse/vendor/bundle/ruby/3.2.0/gems/omniauth-1.9.2/lib/omniauth/strategy.rb:169:in `call'
/var/www/discourse/vendor/bundle/ruby/3.2.0/gems/omniauth-1.9.2/lib/omniauth/strategy.rb:192:in `call!'
/var/www/discourse/vendor/bundle/ruby/3.2.0/gems/omniauth-1.9.2/lib/omniauth/strategy.rb:169:in `call'
/var/www/discourse/vendor/bundle/ruby/3.2.0/gems/omniauth-1.9.2/lib/omniauth/strategy.rb:192:in `call!'

```

So I want to ask if this direction to using discourse apple sign-in using API is already correct and how I solve the problem with csrf\_detected error

---

_[View the full topic](https://meta.discourse.org/t/implement-discourse-apple-login-using-api/286700)._