App Store rejection: Guideline 4.8, Sign in with Apple
You offered Google or Facebook login, submitted, and got Guideline 4.8 back. This is one of the most common rejections in mobile and one of the easiest to fix — but only once you understand precisely when the rule fires.
When the rule applies
Guideline 4.8 requires an equivalent privacy-preserving login option whenever your app uses a third-party or social login service as its primary or only login option.
It fires if you offer Google, Facebook, X, GitHub, or any similar social provider. It does not fire if you only offer email and password, or if your app has no accounts at all. Adding a single social provider is what triggers it.
In practice, Sign in with Apple is the option nearly everyone chooses to satisfy it, because it is the one Apple guarantees meets the bar.
What Apple actually checks
The reviewer opens your sign-in screen and looks for the button. It must be visible on the same screen as the other social options — not behind a 'more options' link, and not on a separate page.
It must also work. A button that opens a broken flow is rejected under Guideline 2.1 instead, which is a slower fix because it needs a new build.
Fixing it in React Native
On the native side you need the Sign in with Apple capability enabled and the provider configured on your backend. In Expo this is a config plugin plus a provider on your auth server — it is not something you can add over the air, because it changes the entitlements file.
In Nativestarter the Apple provider is already wired in packages/auth, and the sign-in screen renders it alongside every other social button, so the rejection cannot happen by omission.
// apps/api/src/auth.ts
socialProviders: {
// Guideline 4.8: required alongside any other social provider.
apple: {
clientId: process.env.APPLE_CLIENT_ID,
clientSecret: process.env.APPLE_CLIENT_SECRET,
appBundleIdentifier: process.env.APPLE_BUNDLE_ID,
},
google: { /* ... */ },
}After you fix it
This needs a new build — entitlements are native. Bump the build number and resubmit, and note in App Review notes exactly what changed.
If you believe the rejection was wrong because you only offer email and password, reply in Resolution Center rather than resubmitting. Explain the login options in your app. Reviewers do reverse 4.8 when it was applied in error, and a reply is far faster than a new review cycle.