Sign in with Apple rejection: Guideline 4.8 fix
What App Store Guideline 4.8 says
Apple's Guideline 4.8 (Login Services) states that apps using a third-party or social login service, such as Facebook Login, Google Sign-In, Log in with X, Sign In with LinkedIn, Login with Amazon, or WeChat Login, to set up or authenticate the user's primary account must also offer, as an equivalent option, another login service that:
- limits data collection to the user's name and email address;
- lets users keep their email address private as part of setting up the account; and
- does not collect interactions with the app for advertising purposes without consent.
Sign in with Apple meets all three. The guideline also lists exceptions: apps that use only their own account systems, education or enterprise apps that require an existing managed account, and apps that use a government or industry-backed citizen or electronic ID are not required to add it.
The official text lives on the App Store Review Guidelines page.
Why apps get rejected under 4.8
Common triggers:
- The app offers Google or Facebook login but no equivalent privacy-focused option.
- The app added a third-party login in an update and did not add Sign in with Apple alongside it.
- Sign in with Apple is present but buried below the social buttons rather than offered equally.
- The implementation does not honor the private email relay, so it does not meet the "keep email private" requirement.
The common thread is that a user who wants a privacy-respecting login does not have an equivalent choice, when a third-party or social login is offered.
How to fix it
- Decide if 4.8 even applies. If your app uses only your own email and password account system, you are exempt and the fix may be clarifying that in App Review notes. The requirement is triggered by a third-party or social login.
- Add Sign in with Apple. Implement it through the Sign in with Apple framework so it sits alongside your existing third-party logins.
- Present it as an equal option. Place the button on par with the other login methods, following the Human Interface Guidelines for Sign in with Apple, not hidden below them.
- Honor private email relay. Support the hide-my-email flow so users can keep their address private, which is one of the three required properties.
- Test the full sign-in and account creation path, including a fresh account, before resubmitting.
Remember that submitted is not approved. Adding an equivalent login is what the rule asks for, but Apple verifies the flow on resubmission.
How AppFlight helps
AppFlight builds native iOS apps in Swift and SwiftUI and wires authentication through a Supabase backend, which supports Sign in with Apple, so adding it as an equal option to a social login is part of the native auth it can generate. When Apple returns a 4.8 rejection, AppFlight reads the rejection reason, works on adding or repositioning the Sign in with Apple option, and resubmits the build. If your app only uses your own account system, the honest answer is that 4.8 likely does not apply and the fix may be a note to the reviewer rather than new code. AppFlight does not guarantee approval. Apple reviews every app and every resubmission, and the login option has to genuinely meet the three requirements.
FAQ
When is Sign in with Apple required?
Guideline 4.8 requires it when your app uses a third-party or social login, such as Google, Facebook, or X, to set up or authenticate the primary account. In that case you must also offer an equivalent login that limits data to name and email, lets users keep email private, and does not track for ads without consent.
Do I need Sign in with Apple if I only use my own email and password login?
No. If your app exclusively uses your own account system, Sign in with Apple is not required. The requirement is triggered specifically by offering a third-party or social login. Education, enterprise, and government or industry ID logins are also exempt.
Does Sign in with Apple have to be presented equally?
Yes. When required, it has to be an equivalent option, not hidden below the third-party buttons. Apple expects it offered on par with the other login methods so users can pick the privacy-focused choice as easily as any other.