David Kimura PRO said almost 3 years ago on Sign in with Apple :
Do you have skip_before_action :verify_authenticity_token in the controller that Apple is calling?