# Apple Sign In / OAuth Emulator (service host)

Create an instance:
curl -s -X POST https://apple.emulators.dev/_emulate/instances
# Hosted deployments create instances lazily when the returned URL is first used. The instance URL is a capability: anyone who has it can read and modify the instance, so save the returned URLs. Never store real secrets in an emulator.
# The server generates an unguessable name. An optional {"instance":"<prefix>"} body adds a readable prefix.

Then use the returned providerBaseUrl / controlBaseUrl. Example below uses a sample instance.
# Apple Sign In / OAuth Emulator

Stateful Sign in with Apple emulator for OAuth authorization code and OpenID Connect flows.

Provider base URL: https://apple.your-instance.emulators.dev
Control base URL: https://apple.your-instance.emulators.dev/_emulate

Supported surfaces:
- Sign in with Apple: supported at /auth
- OpenID Connect: supported at /.well-known

Control endpoints:
- https://apple.your-instance.emulators.dev/_emulate/manifest
- https://apple.your-instance.emulators.dev/_emulate/coverage
- https://apple.your-instance.emulators.dev/_emulate/connections
- https://apple.your-instance.emulators.dev/_emulate/state
- https://apple.your-instance.emulators.dev/_emulate/ledger
- https://apple.your-instance.emulators.dev/_emulate/faults
- POST https://apple.your-instance.emulators.dev/_emulate/credentials
- POST https://apple.your-instance.emulators.dev/_emulate/seed
- POST https://apple.your-instance.emulators.dev/_emulate/reset

Fault injection:
Arm a one-shot provider failure with a glob pathPattern, then inspect /ledger for faulted: true.
curl -s -X POST https://apple.your-instance.emulators.dev/_emulate/faults \
  -H "content-type: application/json" \
  -d '{"match":{"method":"GET","pathPattern":"/v1/*"},"response":{"status":503,"body":{"error":"temporary"}}}'

Connect:

## openid-client (TypeScript)
import * as client from "openid-client";

const config = await client.discovery(
  new URL("https://apple.your-instance.emulators.dev"),
  "<client_id>",
  "<client_secret>",
);

## Sign in with Apple (env)
APPLE_ISSUER=https://apple.your-instance.emulators.dev
APPLE_AUTHORIZATION_URL=https://apple.your-instance.emulators.dev/auth/authorize
APPLE_TOKEN_URL=https://apple.your-instance.emulators.dev/auth/token
APPLE_JWKS_URL=https://apple.your-instance.emulators.dev/auth/keys
APPLE_CLIENT_ID=<client_id>
APPLE_CLIENT_SECRET=<client_secret>

## curl OIDC discovery
curl -s https://apple.your-instance.emulators.dev/.well-known/openid-configuration

## curl token exchange
curl -s -X POST https://apple.your-instance.emulators.dev/auth/token \
  -H "content-type: application/x-www-form-urlencoded" \
  -d "grant_type=authorization_code&code=<code>&client_id=<client_id>&client_secret=<client_secret>"

## Base URL (env)
APPLE_BASE_URL=https://apple.your-instance.emulators.dev

## Create a credential
curl -s -X POST https://apple.your-instance.emulators.dev/_emulate/credentials \
  -H "content-type: application/json" \
  -d '{"type":"oauth-authorization-code"}'

## Inspect requests
curl -s https://apple.your-instance.emulators.dev/_emulate/ledger