You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
fix(expo): throw the verification error when Apple sign-in needs email verification - #10644
On instances that restrict sign-ups, useSignInWithApple falls back to signIn.create({ strategy: 'oauth_token_apple' }). When the server needs the user to verify their email address before the Apple account can be used, that sign-in comes back as needs_first_factor with the error on firstFactorVerification (external_account_email_address_verification_required). The hook returned createdSessionId: null and no error, so the app had no way to tell the user what happened.
The hook now throws that error as a ClerkAPIResponseError, so apps can catch it with isClerkAPIResponseError and read errors[0].code. This matches clerk-ios, which throws the first-factor verification error from signInWithApple. The server returned a 200 for this response, so the thrown error uses status 422. The normal sign-up and transfer path is unchanged.
Verified on an iOS simulator with the verify-clerk-expo skill, spec specs/explored/apple-verification-error.e2e.ts: before run r20261104-100014-16fe on main's hook, after run r20261104-100054-902a on this branch. No test user can reach this state, because the simulator has no Apple ID for Sign in with Apple and the server checks the Apple identity token's signature. So both runs used the same local patch to the expo-native test app, which is not committed. It adds a Sign in with Apple button to the Native modules screen. It replaces expo-apple-authentication and expo-crypto with stubs that return a fake identity token. It also answers the two oauth_token_apple requests in the app's fetch: sign-up with sign_up_mode_restricted (403), and sign-in with needs_first_factor and external_account_email_address_verification_required on first_factor_verification. The hook itself is unpatched. Android is not covered because this hook is iOS only. The new unit test fails on main and passes with the change.
Checklist
pnpm test runs as expected.
pnpm build runs as expected.
(If applicable) JSDoc comments have been added or updated for any package exports
Verified on an iOS simulator. Run r20261104-100054-902a on verify-ios-1 at 79052077fe8c, 1 of 1 passed. Before is run r20261104-100014-16fe at 79052077fe8c, 0 of 1 passed.
…l verification
On instances with restricted sign-ups, useSignInWithApple falls back to
signIn.create with the Apple token. When the server asks for email
re-verification, the sign-in comes back as needs_first_factor with the
error on firstFactorVerification, and the hook returned no session and no
error. It now throws that error as a ClerkAPIResponseError, matching
clerk-ios.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
No actionable comments were generated in the recent review.
Walkthrough
The restricted-sign-up fallback in useSignInWithApple now checks for a first-factor verification error after fallback sign-in. If an error exists, the flow throws a 422 ClerkAPIResponseError with the verification error’s code and messages. Otherwise, it returns the existing sign-in result. A test covers the error response, and a patch changeset records the change.
Apple sign-in now reports the verification error instead of silently returning without a session. No merge-blocking risk was established.
Pre-merge checks: 4 · 1
Failed checks: 1 warning
Check name
Status
Explanation
Resolution
Docstring Coverage
Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Write docstrings for the functions missing them to satisfy the coverage threshold.
Passed checks: 4 passed
Check name
Status
Explanation
Title check
The title names the main change: the Expo Apple sign-in hook now throws the email verification error when sign-in needs email verification. It matches the changeset, which adds a ClerkAPIResponseError…
Linked Issues check
Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check
Check skipped because no linked issues were found for this pull request.
Description check
The description states the bug and the fix. It names the hook (useSignInWithApple), the server response (needs_first_factor with external_account_email_address_verification_required), and the ne…
Full details: Title check
Explanation
The title names the main change: the Expo Apple sign-in hook now throws the email verification error when sign-in needs email verification. It matches the changeset, which adds a ClerkAPIResponseError path in useSignInWithApple.ios.ts with a matching test.
Full details: Description check
Explanation
The description states the bug and the fix. It names the hook (useSignInWithApple), the server response (needs_first_factor with external_account_email_address_verification_required), and the new behavior (a ClerkAPIResponseError with status 422). It also describes the verification steps and the test that fails on main. It is directly related to the changeset.
Full details: Docstring Coverage
Explanation
Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 1 functions across 2 files. (1 skipped: 1 unsupported.)
Resolution
Write docstrings for the functions missing them to satisfy the coverage threshold.
Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Warning
Linked repositories: Some configured repositories could not be included in this review. Cross-repository analysis may be incomplete. Please check linked-repository access and settings.
Included review availability: This review used your included allowance. 2 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 4 reviews per hour.
Before, the hook returned no session and no error; after, it throws a ClerkAPIResponseError with status 422 that isClerkAPIResponseError accepts, carrying the verification code and long message.
Merge-base
This PR 79052077
Also checked · 1 match
Other Apple paths unchanged
Proof on 79052077 · Did Proof get it right? Yes · No
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
On instances that restrict sign-ups,
useSignInWithApplefalls back tosignIn.create({ strategy: 'oauth_token_apple' }). When the server needs the user to verify their email address before the Apple account can be used, that sign-in comes back asneeds_first_factorwith the error onfirstFactorVerification(external_account_email_address_verification_required). The hook returnedcreatedSessionId: nulland no error, so the app had no way to tell the user what happened.The hook now throws that error as a
ClerkAPIResponseError, so apps can catch it withisClerkAPIResponseErrorand readerrors[0].code. This matches clerk-ios, which throws the first-factor verification error fromsignInWithApple. The server returned a 200 for this response, so the thrown error uses status 422. The normal sign-up and transfer path is unchanged.Verified on an iOS simulator with the verify-clerk-expo skill, spec
specs/explored/apple-verification-error.e2e.ts: before runr20261104-100014-16feonmain's hook, after runr20261104-100054-902aon this branch. No test user can reach this state, because the simulator has no Apple ID for Sign in with Apple and the server checks the Apple identity token's signature. So both runs used the same local patch to theexpo-nativetest app, which is not committed. It adds a Sign in with Apple button to the Native modules screen. It replacesexpo-apple-authenticationandexpo-cryptowith stubs that return a fake identity token. It also answers the twooauth_token_applerequests in the app'sfetch: sign-up withsign_up_mode_restricted(403), and sign-in withneeds_first_factorandexternal_account_email_address_verification_requiredonfirst_factor_verification. The hook itself is unpatched. Android is not covered because this hook is iOS only. The new unit test fails onmainand passes with the change.Checklist
pnpm testruns as expected.pnpm buildruns as expected.Type of change
🤖 Generated with Claude Code
Verified on an iOS simulator. Run
r20261104-100054-902aonverify-ios-1at79052077fe8c, 1 of 1 passed. Before is runr20261104-100014-16feat79052077fe8c, 0 of 1 passed.evidence-1f46ee6fc713564d-2.mp4
evidence-1f46ee6fc713564d-1.mp4