KlugAuth

<extensions>
    <extensionID>com.klug.auth.KlugAuth</extensionID>
</extensions>

<key>com.apple.developer.applesignin</key>
<array><string>Default</string></array>

import com.klug.auth.KlugAuth;
import com.klug.auth.KlugAuthEvent;

var auth:KlugAuth = KlugAuth.getInstance();
var nonce:String = "";   // a fresh one for every attempt

appleButton.visible  = auth.isSupported;         // iOS 13+, macOS 10.15+, iPad apps on the Mac
googleButton.visible = auth.isGoogleSupported;   // Android, iOS 13+, macOS 10.15+

auth.addEventListener( KlugAuthEvent.APPLE_SUCCESS,   onAppleSuccess );
auth.addEventListener( KlugAuthEvent.APPLE_CANCELED,  onCanceled );
auth.addEventListener( KlugAuthEvent.APPLE_ERROR,     onError );
auth.addEventListener( KlugAuthEvent.GOOGLE_SUCCESS,  onGoogleSuccess );
auth.addEventListener( KlugAuthEvent.GOOGLE_CANCELED, onCanceled );
auth.addEventListener( KlugAuthEvent.GOOGLE_ERROR,    onError );

function signInWithApple():void
{
    nonce = KlugAuth.generateNonce();          // 32 random bytes as hex, used once
    if ( !auth.signInWithApple( nonce ) )      // false: not supported, or a sheet is already open
        showMessage( "Sign in with Apple is not available." );   // your app function
}

function onAppleSuccess( e:KlugAuthEvent ):void
{
    // the token carries SHA-256 of the nonce: the server hashes the raw value and compares
    sendToServer( "apple", e.identityToken, nonce, e.fullName, e.authorizationCode );
    saveAppleUserID( e.userID );   // stable for this Apple ID; your app function
    // e.email and the names arrive only on the FIRST authorization;
    // the e-mail is always inside the identity token
}

// your app function: the server verifies the token and signs the user in
function sendToServer( provider:String, idToken:String, rawNonce:String,
                       name:String, appleCode:String = "" ):void
{
    var vars:URLVariables = new URLVariables();
    vars.provider = provider;
    vars.id_token = idToken;
    vars.nonce    = rawNonce;
    vars.name     = name;
    if ( appleCode != "" ) vars.code = appleCode;   // lets the server revoke the link later

    var req:URLRequest = new URLRequest( "https://your.server/auth" );
    req.method = URLRequestMethod.POST;
    req.data = vars;
    var loader:URLLoader = new URLLoader();
    loader.addEventListener( Event.COMPLETE, onServerAnswer );   // your app function
    loader.load( req );
}

import flash.system.Capabilities;

// Android: the WEB client ID, which is the token audience on your server.
// iOS and macOS: the iOS client ID, used in the system sign-in window.
var googleClientId:String = Capabilities.manufacturer.indexOf( "Android" ) >= 0
    ? "YOUR_WEB_CLIENT_ID.apps.googleusercontent.com"
    : "YOUR_IOS_CLIENT_ID.apps.googleusercontent.com";

function signInWithGoogle():void
{
    nonce = KlugAuth.generateNonce();         // Google puts the raw value into the token
    if ( !auth.signInWithGoogle( googleClientId, nonce ) )   // false: no client ID, or already open
        showMessage( "Google sign-in could not start." );
}

function onGoogleSuccess( e:KlugAuthEvent ):void
{
    // e.userID is the account e-mail; names arrive every time
    sendToServer( "google", e.identityToken, nonce, e.fullName );
}

function onCanceled( e:KlugAuthEvent ):void
{
    // the user closed the sheet: not an error, simply stay on the start screen
}

function onError( e:KlugAuthEvent ):void
{
    if ( e.type == KlugAuthEvent.GOOGLE_ERROR && e.errorCode == "NO_ACCOUNT" )
        showMessage( "Please add a Google account to this device first." );   // Android
    else
        showMessage( "Sign-in failed: " + e.errorMessage );   // e.errorCode for your log
}

auth.addEventListener( KlugAuthEvent.APPLE_CREDENTIAL_STATE, function( e:KlugAuthEvent ):void {
    // e.state: authorized | revoked | notFound | transferred | unknown
    if ( e.state == "revoked" || e.state == "notFound" )
        signOut();   // your app function: the user removed the app from their Apple ID
});

var savedID:String = loadAppleUserID();   // stored after APPLE_SUCCESS; your app function
if ( auth.isSupported && savedID != "" )
    auth.getCredentialState( savedID );      // Apple only: iOS and macOS