A WireMock simulation of Apple's REST API — covering the sign-in page, token exchange, signed id_tokens, and OpenID configuration.
A shared instance of this template runs on a public endpoint — call it right now from curl, an SDK, or an AI agent. Responses are fixed examples and behavior can't be changed; rate limits apply.
Jump to the endpoints ↓Run this template as a mock API in WireMock Cloud for a private instance you control — edit stubs, add stateful scenarios, use dynamic response templating, and inspect requests in the log.
Open in WireMock Cloud (free) →Live sandbox · no signup, no API key
A running WireMock Cloud instance of this template, callable right now from a terminal, a script, or an AI agent.
Endpoints
GET Landing page
curl -s -X GET 'https://1k30o.wiremockapi.cloud/'GET OpenID Configuration
curl -s -X GET 'https://1k30o.wiremockapi.cloud/.well-known/openid-configuration'GET Login page (Authorize endpoint)
curl -s -X GET 'https://1k30o.wiremockapi.cloud/auth/authorize'Spec catalog — Apple Sign in with Apple Mock API (1.0.0) · 5 endpoints
| Method | Path | Summary |
|---|---|---|
| GET | /.well-known/openid-configuration | OpenID Connect Discovery |
| GET | /auth/authorize | Authorization Endpoint |
| GET | /auth/keys | JWKS Endpoint |
| POST | /auth/revoke | Token Revocation Endpoint |
| POST | /auth/token | Token Endpoint |
Unauthenticated WireMock Cloud demo sandbox for Apple — not an official Apple sandbox, and it returns simulated example data only.
Five endpoints reproduce Apple's identity provider, quirks included. The well-known configuration document advertises what makes Apple's OIDC dialect distinctive — pairwise subject identifiers, client_secret_post as the token auth method, and claims like is_private_email and real_user_status — while the token endpoint issues an RS256-signed id_token whose sub follows Apple's 000000-prefixed format and whose aud is whatever client_id you sent, next to the base64 user payload carrying the mock account's name and email.
Faithful where it counts for parsers: the subject uses Apple's opaque 000000-prefixed form, the email claims include is_private_email, and the signature is genuine RS256 material that checks out against the JWKS route. One templated touch helps testing — aud mirrors the client_id from your request, so your verifier's audience assertion passes without special-casing the mock.
Apple's famous one-shot payload — the JSON blob of name and email a real authorization returns only the first time an account approves your app. The mock includes it on every exchange, which makes the trickiest branch of Apple onboarding code (persist it now or lose it forever) exercisable at will.
Any invented Apple ID and password moves the flow forward — the handler answers with a 302 carrying an authorization code and your state value. Since the sandbox is open to everyone, treat it like a stage prop: nothing genuine belongs in that form, least of all a real Apple ID.
The claim structure is there — is_private_email arrives as false against a plain mock address. To rehearse the relay case, clone the template into WireMock Cloud and flip that claim to true with a privaterelay.appleid.com-style address, then confirm your app treats the alias as undeliverable-by-other-channels.
Vendor names identify APIs represented by WireMock template sources. This page does not imply vendor endorsement, certification, partnership, or official integration status.