Apple sign in, authorize method returns name only first time

Implementing Apple sign in in a web app (old fashion ASP.NET, but it doesn't matter - the question can be treated as simple HTML/JS POC), calling method authorize on Apple endpoint:

https://appleid.apple.com/auth/authorize?client_id=...&redirect_uri=...&response_type=code%20id_token&state=...&response_mode=form_post&scope=name%20email

I want to get the user's first and last name. Method returns something like this: {

   "state": "xxx",
   "code": "yyy",
   "id_token": "zzz",
   "user": {
        "name": {
            "firstName":"John",
            "lastName":"Doe"
        },
        "email":"example@privaterelay.appleid.com"
    }
}

id_token is JWT which consists of user's apple ID and email, there is no data regarding name or surname.

As you can see, I can get name and surname from the user property. That's the only way known to me.

The problem is, Apple returns this data only the first time I request it. It's not a bug, it's a feature: https://developer.apple.com/documentation/sign_in_with_apple/sign_in_with_apple_js/configuring_your_webpage_for_sign_in_with_apple :

Important

Apple only returns the user object the first time the user authorizes the app. Persist this information from your app; subsequent authorization requests won’t contain the user object.

So I store this data for later in the workflow, I will store it in database.

Now my problem/question:

When user deletes their account, I delete all their data from db (I have to, because of the contract, law etc).

When the user registers again through Apple sign in, I ping Apple endpoint, and I don't get user data (including name and surname) any more (because of the Apple policy quoted above)!

What should I do to get it?

Solution

I'm doing apple sign-in back-end part, faced the similar issue.

For IOS 13+

SDK provides apple user uuid, email and name for the first authorize request.
We are mapping this unique apple_user_uuid with the profile details in DB. (In case of request failures, you can ask back-end to put this in queue and app should keep this in cache until back-end call is successful).

For ANDROID/WEB Flow/IOS Below 13

For the first time in apple callback, it sends us the name with a one time code (5 minute expiry).
Using this code when we call token API, it provides us id_token JWT.
In token the subject is apple_user_uuid.
Persist it in the same table.

So now in back-end you will always have email,firstName, lastName tagged with apple_user_uuid, which remains constant for an apple id.

And don't delete this mapping if the user deletes your account. Until apple provides a fix.