We're shipping a cross-platform game (iOS + Android) with Sign in with Apple, and we've hit a limitation with AuthenticateApple.

Our setup:

• iOS uses the native Sign in with Apple SDK → the identity token's aud claim is our App/Bundle ID (e.g. com.mygame.app)
• Android has no native Apple SDK, so it uses Apple's web OAuth flow → the identity token's aud is our Services ID (e.g. com.mygame.app.signin)

Apple requires these to be two different identifiers — a Services ID cannot be the same string as the App ID. And Apple guarantees the same sub (user ID) across both, since the Services ID is grouped under the same Primary App ID.

The problem:
AuthenticateApple validates the token's aud against the single Apple client ID configured in the portal. With only one value allowed, one platform always fails with reason code 40307. So it's currently impossible to support Sign in with Apple on both iOS (native) and Android (web) against the same brainCloud app using the standard Apple authentication.

Our current workaround:
We moved both platforms to AuthenticateExternal with a cloud code script that fully validates the token (RS256 signature against Apple's JWKS, iss/exp/sub checks) and accepts both aud values. It works, but it means giving up the built-in Apple identity type and maintaining our own validation script.

An important caveat with this workaround:
External identities and Apple identities are separate identity types in brainCloud. This means the External Auth workaround is only viable for games that have NOT yet shipped Apple login — existing players who signed up via AuthenticateApple would end up on different profiles when switching to AuthenticateExternal, even though their Apple sub is identical. For a live service with existing Apple-authenticated users, migrating requires attaching a second identity to every active player and maintaining both auth paths during the transition — which makes this workaround effectively impractical for already-launched games. Native multi-client-id support in AuthenticateApple would solve this cleanly.

Feature request:
Please allow the Apple configuration in the portal to accept multiple client IDs (e.g. a comma-separated list, or separate fields for Bundle ID and Services ID), and have AuthenticateApple validate aud against that list. This is a standard requirement for any cross-platform game supporting Sign in with Apple on Android — every backend that validates aud (Firebase, Supabase, etc.) supports a list of accepted client IDs for exactly this reason.

Is this something that could be added to the roadmap? And is there any existing way to achieve this with AuthenticateApple that we've missed?

Thanks!