How to revoke Sign in with Apple tokens when deleting a Supabase account

If your iOS app offers Sign in with Apple, Apple asks you to revoke the person's token when they delete their account. With Supabase that's awkward: native sign-in uses signInWithIdToken, so you never receive an Apple refresh token, and at deletion time you have nothing to revoke.

Here's an approach that works without storing anything from Apple.

The idea

1. When the person taps Delete Account, show the Sign in with Apple sheet once more. It returns a fresh authorization code, valid for five minutes and usable once.
2. Send that code to a Supabase Edge Function.
3. The function exchanges the code for a refresh token at https://appleid.apple.com/auth/token.
4. It revokes that token at https://appleid.apple.com/auth/revoke.
5. Only then does it delete the Supabase user.

What you need

• A Sign in with Apple key (.p8) from Certificates, Identifiers & Profiles > Keys, plus its Key ID and your Team ID.
• Those stored as Edge Function secrets, never in the app.
• A client secret for each request: a short-lived JWT signed with the key using ES256. Web Crypto in the Edge runtime can sign it without a library.

On the Swift side, only ask for the code when the account has an Apple identity:

let identities = try await supabase.auth.user().identities ?? []
if identities.contains(where: { $0.provider == "apple" }) {
    request.appleAuthorizationCode = try await AppleReauthorizer().authorizationCode()
}

Things that trip people up

• Use your bundle identifier as client_id, not a Services ID.
• The code is single use and expires in five minutes, so request it right before calling the function.
• Revoke before you delete. If Apple rejects the code, the account still exists and the person can try again.
• After revocation, the next sign-in looks like a first sign-in, and Apple shares the name again.

The full implementation

The complete Edge Function and Swift code are part of TruKit, a SwiftUI + Supabase starter kit that also covers sign-in, a paywall for Stripe, StoreKit 2 or RevenueCat, and a MapKit view with real-time updates.