Sign In with Apple - invalid_client

Hi Apple Developer Support,

We are implementing Sign in with Apple for our web application hosted on example.com.

In the Service ID settings, we have configured the following:

Service ID (client_id): com.example.service.local

Web Domain: example.com

Return URL: https://2db2-121-160-153-88.ngrok-free.app/login/oauth2/code/apple

We also tested login via the following URL from our web application: https://appleid.apple.com/auth/authorize?response_mode=form_post&response_type=code&client_id=com.example.service.local&scope=name%20email&state=2f9gMY1rTe12-O7Wbnb7KWe504HQ0KWBSHTKHbg9ZEY=&redirect_uri=https://2db2-121-160-153-88.ngrok-free.app/login/oauth2/code/apple However, we’re receiving an invalid_client error after submission.

Our questions:

Is it valid to use an ngrok URL like https://2db2-121-160-153-88.ngrok-free.app/... as the Return URL for development and testing?

Does the Web Domain need to match the ngrok domain, or is it enough to register the production domain (e.g., example.com)?

Is there any propagation delay or approval process after updating the Return URL in the Service ID?

Is the client_id strictly required to match the Service ID exactly?

We would greatly appreciate any insights or best practices to help us resolve this issue. Thank you in advance!