id_token link spike (DISPOSABLE)Real Sign in with Apple (Apple JS, popup) on spike.gracewi.com → the resulting
Apple id_token is handed to supabase.auth.signInWithIdToken() — the
same GoTrue path the native iOS app will use. Access / refresh / id tokens and keys are never logged;
auth.users UUIDs are shown intact for the C1 BEFORE == AFTER check.
Tip: open the page as
https://spike.gracewi.com/#url=https://<ref>.supabase.co&anonKey=<key> and it
auto-fills, stores in sessionStorage only, and strips the hash. Nothing is committed or logged.