# Authenticate an Apple Messages customer

Define the identity provider, conversation binding and resource permissions needed to protect an account action in Apple Messages.

## Prerequisites

Prepare the business identity provider, supported OAuth configuration, intended account operation and an authorized test conversation.

## 1. Choose the protected operation

Identify what requires account verification, such as viewing an order or changing an appointment. Define the minimum identity and scope needed for that action.

Ask Apple’s required clarifying yes/no question before collecting personal information needed for the task. Use the appropriate Quick Reply and [policy requirements](https://register.apple.com/resources/messages/messaging-documentation/policies).

## 2. Configure the identity connection

Use the supported authentication settings and callback flow for your identity provider. Keep client secrets and token handling in the execution environment. Validate callback and account binding through the owning authentication system.

## 3. Explain the sign-in request

Tell the customer why sign-in is needed and which business account they are using. Launch the supported native authentication experience at the point where it helps the task.

## 4. Apply access to the action

Bind the authenticated result to the correct conversation and customer account. The business application must still authorize the requested resource and operation. A successful login is not permission for every account action.

## 5. Test expiry, refusal and recovery

Exercise canceled sign-in, insufficient scope, expired access and an account mismatch. Return a useful next step without exposing protected account content to an unverified conversation.

## Verify access with two accounts

Test the requested operation with an authorized customer account and a different account that must not access the same record. Use the same application authorization checks for an AI tool and a human service action. A successful sign-in establishes identity; the application still decides whether the requested read or change is allowed.

| Test case                                             | Action                                                                     | Expected result                                                                            |
| ----------------------------------------------------- | -------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------ |
| The customer cancels sign-in                          | Keep private account information out of the response.                      | The public conversation remains usable and explains how to continue the protected request. |
| The authenticated session expires                     | Require the appropriate sign-in step before further protected access.      | The original request remains identifiable after authentication succeeds again.             |
| A signed-in customer requests another account’s order | Let the application deny access and offer an appropriate service response. | No protected details from the other account appear in the conversation or summary.         |

## Troubleshooting

If authentication completes but access fails, inspect scope and resource authorization. If the wrong account is associated, stop the protected action and resolve the binding. An Apple conversation identifier is not proof of the customer’s business account.

## Next steps

- [Explore the related Apple Messages capability](/products/apple-messages/authentication).
- [Find Apple Messages guides and answers](/products/apple-messages/resources).
- [Prepare your first complete conversation](/products/apple-messages/getting-started).

## Related resources

- [What is Apple Messages for Business?](/explained/apple-messages/what-is-apple-messages-for-business) (answer)
- [Apple Messages for Business](/products/apple-messages) (product)
- [Integrate an Apple Messages customer journey](/docs/guides/apple-messages/api) (docs)

[Get an implementation brief](/learn/workspace?topic=apple-messages)