composer require ikromjon/nativephp-mobile-social-auth

php artisan vendor:publish --tag=nativephp-plugins-provider
php artisan native:plugin:register ikromjon/nativephp-mobile-social-auth

php artisan native:plugin:list      # should list 4 registered bridge functions
php artisan native:plugin:validate  # should report OK

cp vendor/nativephp/mobile/config/nativephp.php config/nativephp.php

// config/nativephp.php
'android' => [
    'min_sdk' => 29,
    // ... leave the rest of the array as shipped
],

php artisan native:install --force

GOOGLE_IOS_CLIENT_ID=123456789-abc.apps.googleusercontent.com
# Optional -- derived from GOOGLE_IOS_CLIENT_ID when omitted:
# GOOGLE_IOS_REVERSED_CLIENT_ID=com.googleusercontent.apps.123456789-abc
GOOGLE_SERVER_CLIENT_ID=123456789-xyz.apps.googleusercontent.com

php artisan vendor:publish --tag=social-auth-config

<?php
 
namespace App\Livewire;
 
use Ikromjon\NativePHP\SocialAuth\Data\AuthResult;
use Ikromjon\NativePHP\SocialAuth\Events\AppleSignInCompleted;
use Ikromjon\NativePHP\SocialAuth\Events\GoogleSignInCompleted;
use Ikromjon\NativePHP\SocialAuth\Events\SignInFailed;
use Ikromjon\NativePHP\SocialAuth\Facades\SocialAuth;
use Livewire\Component;
use Native\Mobile\Attributes\OnNative;
 
class LoginScreen extends Component
{
    public ?string $error = null;
 
    public function signInWithApple()
    {
        $rawNonce = bin2hex(random_bytes(16));
        session(['auth_nonce' => $rawNonce]);
 
        // The result is handled by the #[OnNative] listeners below --
        // identically on iOS and Android. (On iOS the call also returns
        // the result synchronously; it is intentionally unused here.)
        SocialAuth::appleSignIn(
            scopes: ['email', 'fullName'],
            nonce: hash('sha256', $rawNonce),
        );
    }
 
    public function signInWithGoogle()
    {
        $nonce = bin2hex(random_bytes(16));
        session(['auth_nonce' => $nonce]);
 
        // The result is handled by the #[OnNative] listeners below --
        // identically on iOS and Android. (On iOS the call also returns
        // the result synchronously; it is intentionally unused here.)
        SocialAuth::googleSignIn(nonce: $nonce);
    }
 
    // Event handlers use NAMED PARAMETERS matching the event payload keys.
    // Do NOT use a single $data array — Livewire dispatches each key as a named argument.
 
    #[OnNative(AppleSignInCompleted::class)]
    public function onAppleSignIn(
        string $userId = '',
        ?string $identityToken = null,
        ?string $authorizationCode = null,
        ?string $email = null,
        ?string $givenName = null,
        ?string $familyName = null,
        ?string $displayName = null,
        ?string $state = null,
        ?string $realUserStatus = null,
    ) {
        if (!empty($userId)) {
            $this->handleSignIn([
                'provider' => 'apple',
                'userId' => $userId,
                'identityToken' => $identityToken,
                'email' => $email,
                'givenName' => $givenName,
                'familyName' => $familyName,
            ]);
        }
    }
 
    #[OnNative(GoogleSignInCompleted::class)]
    public function onGoogleSignIn(
        string $userId = '',
        ?string $identityToken = null,
        ?string $email = null,
        ?string $displayName = null,
        ?string $givenName = null,
        ?string $familyName = null,
        ?string $photoUrl = null,
        ?string $accessToken = null,
        ?string $authorizationCode = null,
    ) {
        if (!empty($userId)) {
            $this->handleSignIn([
                'provider' => 'google',
                'userId' => $userId,
                'identityToken' => $identityToken,
                'email' => $email,
                'displayName' => $displayName,
                'givenName' => $givenName,
                'familyName' => $familyName,
                'photoUrl' => $photoUrl,
            ]);
        }
    }
 
    #[OnNative(SignInFailed::class)]
    public function onSignInFailed(
        string $provider = '',
        string $error = '',
        ?string $errorCode = null,
    ) {
        if ($errorCode !== 'CANCELED') {
            $this->error = !empty($error) ? $error : 'Sign-in failed.';
        }
    }
 
    private function handleSignIn(array $data)
    {
        // Verify identity token server-side, then create/find user
        // IMPORTANT: Apple only sends email/name on FIRST sign-in!
        // You must persist this data immediately.
        return $this->redirect('/dashboard');
    }
 
    public function render()
    {
        return view('livewire.login-screen');
    }
}

{{-- resources/views/livewire/login-screen.blade.php --}}
<div class="flex flex-col gap-4 p-6">
    @if($error)
        <div class="bg-red-100 text-red-700 p-3 rounded">{{ $error }}</div>
    @endif
 
    <button
        wire:click="signInWithApple"
        class="flex items-center justify-center gap-2 bg-black text-white rounded-lg py-3 px-6 font-medium"
    >
        Sign in with Apple
    </button>
 
    <button
        wire:click="signInWithGoogle"
        class="flex items-center justify-center gap-2 bg-white text-gray-700 border border-gray-300 rounded-lg py-3 px-6 font-medium"
    >
        Sign in with Google
    </button>
</div>

import { On } from '#nativephp';
import socialAuth from 'vendor/ikromjon/nativephp-mobile-social-auth/resources/js/social-auth';
 
// Generate nonce client-side
function generateNonce() {
    const array = new Uint8Array(16);
    crypto.getRandomValues(array);
    return Array.from(array, b => b.toString(16).padStart(2, '0')).join('');
}
 
async function sha256Hex(value) {
    const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(value));
    return Array.from(new Uint8Array(digest), b => b.toString(16).padStart(2, '0')).join('');
}
 
// Google Sign-In
async function handleGoogleSignIn() {
    const nonce = generateNonce();
    // The result is handled by the On(...) listeners below -- identically
    // on iOS and Android. (On iOS the promise also resolves with the
    // result; it is intentionally unused here.)
    await socialAuth.googleSignIn(nonce);
}
 
// Apple Sign-In
async function handleAppleSignIn() {
    const rawNonce = generateNonce();
    // Apple expects the SHA-256 hash of the nonce -- keep rawNonce for server-side verification
    await socialAuth.appleSignIn(['email', 'fullName'], await sha256Hex(rawNonce));
}
 
// Single handling path: these events fire on both platforms
On('Ikromjon\\NativePHP\\SocialAuth\\Events\\GoogleSignInCompleted', (payload) => {
    sendTokenToBackend(payload.identityToken);
});
 
On('Ikromjon\\NativePHP\\SocialAuth\\Events\\AppleSignInCompleted', (payload) => {
    sendTokenToBackend(payload.identityToken);
});
 
On('Ikromjon\\NativePHP\\SocialAuth\\Events\\SignInFailed', (payload) => {
    if (payload.errorCode !== 'CANCELED') {
        alert(`Sign-in failed: ${payload.error}`);
    }
});

use Firebase\JWT\JWT;
use Firebase\JWT\JWK;
 
// Google verification
//
// Note on `azp`: a real token from this plugin carries `aud` = your server
// client ID and `azp` = the *platform* client ID (the iOS or Android client
// that requested it). Check `aud`; do not compare `azp` against the server
// client ID, or every mobile sign-in will be rejected.
$googleKeys = json_decode(
    file_get_contents('https://www.googleapis.com/oauth2/v3/certs'), true
);
$decoded = JWT::decode($identityToken, JWK::parseKeySet($googleKeys));
// Verify: $decoded->aud === your GOOGLE_SERVER_CLIENT_ID
// Verify: $decoded->iss === 'https://accounts.google.com'
// If you passed a nonce to googleSignIn():
// Verify: $decoded->nonce === session('auth_nonce')
 
// Apple verification
$appleKeys = json_decode(
    file_get_contents('https://appleid.apple.com/auth/keys'), true
);
$decoded = JWT::decode($identityToken, JWK::parseKeySet($appleKeys));
// Verify: $decoded->aud === your app's bundle ID
// Verify: $decoded->iss === 'https://appleid.apple.com'
// If you passed a nonce to appleSignIn() (SHA-256 of the raw nonce):
// Verify: $decoded->nonce === hash('sha256', session('auth_nonce'))