Guideline 4.8 Sign in with Apple: when Apple requires it

Guideline 4.8 Login Services is short and easy to miss when an AI coding agent adds Google Sign-In (or Facebook, Log in with X, LinkedIn, Amazon, or WeChat) as the primary way people create an account.

Apple's rule: if the app uses a third-party or social login to set up or authenticate the user's primary account, you must also offer an equivalent login option that:

Limits data collection to the user's name and email address
Lets the user keep their email private while setting up the account
Does not collect interactions with your app for advertising without consent

Sign in with Apple is the usual way to meet that bar. The full text lives under Design → 4.8 Login Services in the App Store Review Guidelines (last updated October 16, 2026 at time of writing).

When 4.8 applies

It applies when social or third-party login creates or unlocks the primary account people use to identify themselves and reach your features.

It does not always apply. Apple lists exceptions, including:

The app only uses your own account system (email/password or magic link you own)
Education, enterprise, or business apps that require an existing education or enterprise account
Government or industry-backed citizen ID / electronic ID
The app is a client for a specific third-party service and people must sign into that service to see their content (for example a mail or social client)
Certain marketplace-specific login cases described in the guideline

If you are unsure, read your rejection letter and the exceptions list on the official page before you rewrite auth.

Practical fix path

Confirm what login you ship. Open the binary and list every button that creates or opens the primary account.
If you only have Google (or another listed social login), add Sign in with Apple as an equivalent option on the same screen, with similar prominence.
Implement Sign in with Apple properly. Use Apple's APIs/SDK for your stack (native, Expo, React Native, Flutter). Enable the capability in the Apple Developer account and App ID.
Honor Hide My Email. Do not require a "real" email after Apple provides the private relay address.
Do not gate the Apple button. Putting Sign in with Apple behind "More options" while Google is front and center is a common review complaint. Match the spirit of "equivalent option."
Account deletion still applies. If people can create an account, Guideline 5.1.1(v) still needs in-app deletion, including for Sign in with Apple users. Revoke tokens when they delete.
Demo account for review. In App Store Connect review notes, explain how to sign in, and provide a demo account if needed so the reviewer can reach the rest of the app.
Resubmit with notes. Say you added Sign in with Apple as an equivalent login beside Google Sign-In, and where to find it.

Stack notes for AI-built apps

Expo / React Native: use a maintained Sign in with Apple module and test on a real device. Simulator-only checks miss capability and entitlement mistakes.
Templates from Bolt, Lovable, Rork, Cursor agents: search the repo for GoogleSignin, GoogleAuthProvider, signInWithPopup, Supabase/Auth0 social providers, and similar. If Google is there and Apple is not, you are in 4.8 territory for a primary-account app.
Firebase Auth / Supabase Auth / Auth0: enable the Apple provider and add the button to the same auth screen. Check redirect URLs and Service ID setup on Apple's side.

FAQ

Can I drop Google and keep only email login? Yes. If you remove third-party social login and only use your own account system, 4.8's extra equivalent login requirement no longer applies the same way. You still need a solid auth and deletion story.

Is Sign in with Apple required for every app? No. Only when you use a covered third-party/social login for the primary account, and none of the exceptions apply.

Does ShipCheck help? ShipCheck looks for social login usage without Sign in with Apple signals in project files. It cannot configure your Apple Developer account or prove the button is equivalent in the UI. Treat a hit as a prompt to fix auth before submit.

Free scan

Run a free ShipCheck before you upload the next build. Paste a public GitHub link or a zip. You get the guideline, a short label, severity, and how many places. Fixes start at $9. I'm Justin, the builder of ClearedToShip.

Official sources: Guideline 4.8, Sign in with Apple