Federated Login Keys (Apple + Google)

What this covers

thephenom.app federated login (Sign in with Apple and Google) runs through AWS Cognito. The app redirects to Cognito’s hosted UI; Cognito holds the Apple and Google keys and brokers the sign-in. The keys are not in the app repo and were never a file committed to PhenomApp.

Where the keys are

Shared dev folder on the Phenom Mac Studio (readable by the dev accounts on that machine):

/Users/builder/Public/phenom-federated-login-keys/
├── AuthKey_68D568JG5R.p8        # Apple Sign in with Apple private key
├── google-oauth-client.json     # Google OAuth web client (client_id + client_secret)
└── README.md

Canonical source of truth (pass):

• Apple: phenom/apple-siwa/{private-key, key-id, services-id, team-id}
• Google: phenom/google-oauth/{client-id, client-secret}

If a key is rotated, update pass first, then refresh the shared folder.

Identifiers

Sign in with Apple

Google

How to use them

Fastest path — test against the dev pool (no key handling)

All three Cognito pools already have both IdPs configured. To exercise federated login in development, point the dev build / dev environment at the dev-local pool; Apple and Google sign-in work with no reconfiguration:

• User pool: us-east-1_AkG9mnbjA (phenom-dev-local)

Configuring a Cognito pool from these keys

• Apple IdP: upload AuthKey_68D568JG5R.p8; set Key ID 68D568JG5R, Team ID 5VZQAJBZ8H, Services ID app.thephenom.nest, scopes email name.
• Google IdP: use the client_id / client_secret from google-oauth-client.json, scopes openid email profile.

As code (preferred)

The federation is codified in phenom-infra:

• Dev: environments/development/cognito-federation.tf
• Prod: environments/production/cognito.tf
• Runbook: docs/runbooks/cognito-federation-and-staff-roles.md

Handling

These are shared team credentials. Do not commit them to git, attach them to email, or post them anywhere public. This page intentionally records only their location and usage, never the private key or client secret.