Symptom
A Capacitor/native iOS app built via xcodebuild archive with CODE_SIGNING_ALLOWED=NO CODE_SIGNING_REQUIRED=NO CODE_SIGN_IDENTITY= (a common pattern for non-interactive CI, since the archive action wants an Apple Development identity), then signed at -exportArchive time with signingStyle: automatic, ships to TestFlight/App Store fine — but Sign in with Apple fails on every attempt with:
com.apple.AuthenticationServices.AuthorizationError error 1000(ASAuthorizationError.unknown, raised before any credential UI callback). Associated domains / universal links also silently stop working. The IPA looks completely normal on disk and uploads without complaint.
Root cause
-exportArchive derives the distribution-signing entitlement request from the archived binary's existing signature. An unsigned archive has none, so the exported IPA carries only profile defaults: com.apple.developer.applesignin and com.apple.developer.associated-domains are dropped even though the provisioning profile supports them and App/App.entitlements declares them.
Fix
Ad-hoc sign the archived app with the project entitlements before export; exportArchive re-signs with the Apple Distribution identity regardless but now preserves the entitlement request:
codesign --force -s - --entitlements ios/App/App/App.entitlements \
MyApp.xcarchive/Products/Applications/App.app
xcodebuild -exportArchive -archivePath MyApp.xcarchive ...Guard against regression
After export, unzip the IPA and assert required entitlements are present:
codesign -d --entitlements - Payload/App.app # must contain applesignin etc.A missing-entitlement IPA is indistinguishable from a good one until a user (or App Store reviewer) taps the button.
Diagnosis tip
Error 1000 is otherwise blamed on device state (no iCloud login, Screen Time). If ALL users of one build fail deterministically and the events stop when a new build rolls out, suspect the binary's entitlements, not the devices.