Search across all documentation pages
Secrets handling, secure storage, transport security, and certificate pinning decisions for Expo apps on SDK 57. Mobile clients are untrusted environments - assume attackers can extract bundled values, intercept traffic on compromised devices, and replay tokens. These rules define the minimum bar before store submission.
expo config --type public and logout flows are common audit failures.Never put secrets in EXPO_PUBLIC_* or extra: Both inline into the client bundle - attackers extract them from the IPA/APK or Hermes bytecode.
EAS Secrets for build-time and CI values: eas secret:create and environment-scoped variables - not Slack, not committed .env.production.
eas env:pull --environment development - .env.local stays gitignored.eas update --environment production uses EAS environment vars (SDK 55+) - local .env is ignored on update runners.Audit public config before every release: npx expo config --type public - confirm no staging URLs, internal hostnames, or debug keys shipped to production profile.
.env.example documents keys, not values: List required EXPO_PUBLIC_* and APP_ENV vars with placeholder values - onboarding without leaking prod secrets.
No secrets in crash logs or analytics breadcrumbs: Sentry and logging utilities must scrub tokens, emails, and PAN fragments before upload.
Authorization headers in network breadcrumbs.Third-party SDK keys are client-exposure reviewed: Maps, analytics, and attribution keys in the bundle are assumed public - restrict by bundle ID and platform in vendor dashboard.
Refresh and access tokens in expo-secure-store: Hardware-backed keystore on supported devices - not AsyncStorage, unencrypted MMKV, or plain expo-file-system files.
npx expo install expo-secure-store.AsyncStorage for non-sensitive preferences only: Theme, last tab, draft UI state - never auth artifacts or PII caches.
AsyncStorage.setItem with token-like keys in PR review.Clear secure storage on logout: SecureStore.deleteItemAsync for all auth keys - paired with navigation stack reset (see Navigation & Routing Rules).
Short-lived access tokens with refresh rotation: Mobile clients should refresh proactively - handle 401 with single retry, not infinite loops.
AppState foreground if token nears expiry.Biometric gate for sensitive actions, not storage replacement: expo-local-authentication unlocks UI or confirms transactions - it does not replace secure enclave storage for tokens.
Encrypt offline caches that contain PII: If MMKV or SQLite caches user health or financial data, use encryption or server-side minimization - default MMKV is fast, not confidential.
HTTPS only for production API calls: Reject cleartext exceptions in production app.config - android.usesCleartextTraffic is for local dev builds only.
http://localhost in development profile with APP_ENV=development.http:// in src/ outside __tests__.Certificate pinning is an explicit product decision: Default to system certificate validation on SDK 57 - pinning breaks corporate proxies, complicates rotation, and requires native modules.
If pinning, plan rotation before implementation: Pin SPKI hashes with backup pins - store updates lag weeks; expired pins brick the app.
Validate TLS at the API client layer: Central fetch wrapper rejects non-HTTPS in production builds - one choke point for headers and auth attachment.
api/client.ts attaches bearer from secure store; features never call raw fetch to arbitrary URLs.fetch(process.env.EXPO_PUBLIC_API_URL + path) without validation.Do not disable SSL verification in production: rejectUnauthorized: false and custom fetch agents are debug-only - grep CI blocks them on main.
OAuth and deep links use PKCE and state parameters: expo-auth-session with secure redirect - validate state on return; never embed client secrets in mobile OAuth flows.
app.config - no wildcard redirect URIs in provider console.Jailbreak/root detection is policy-driven, not security theater: If required by compliance, use a maintained SDK and document bypass limitations - do not claim "unhackable."
Screenshot and screen recording policy for sensitive screens: iOS UITextField secure flag or overlay for CVV entry - balance UX with PCI and HIPAA guidance.
FLAG_SECURE via config plugin when mandated.Permissions are minimal and justified: Request camera, location, and contacts only when the feature is active - iOS/Android review and user trust depend on it.
app.config and localized locales/.Dependency audit before store submission: npm audit, expo-doctor, and review native SDK privacy manifests (Apple Privacy Nutrition Labels).
Feature flags do not bypass server authorization: Client flags hide UI - server must enforce entitlements on every mutation.
Incident runbook for token and key compromise: Document who rotates EAS Secrets, revokes OAuth clients, and forces logout - mobile leads know the steps before an incident.
Only if the key is designed for client exposure (e.g., Google Maps client key restricted by bundle ID). Server secrets, Stripe secret keys, and admin tokens never belong in EXPO_PUBLIC_*.
Default to expo-secure-store for tokens on SDK 57. MMKV with encryption is an option for larger structured data - still requires an ADR and key management story; secure store is simpler for auth artifacts.
Most apps should not pin initially - system TLS plus proper cert lifecycle on the server is enough. Pin when threat model and security operations can own rotation; document in an ADR.
EAS Secrets and environment variables inject at build/update time on EAS workers - they do not automatically mean safe for client bundles. Only non-sensitive values should reach JS via extra or public env. True secrets stay server-side.
Expo Go uses Expo's bundle identifier - OAuth redirect and some SDK restrictions differ from production. Test auth on dev-client or preview builds with your real bundle ID before release.
Run npx expo config --type public with production env vars and inspect output. Add CI grep for patterns like sk_live, BEGIN PRIVATE KEY, and internal hostnames.
Secure store auth keys, in-memory session state, query caches with PII, and navigation stack to auth - in that order. Verify with automated test or Maestro smoke.
OTA can remove a leaked key from new bundles - but existing installs may retain old bundles until update. Rotate the compromised secret immediately on the server; treat OTA as distribution fix, not rotation.
Only when compliance or fraud policy requires it - understand it is bypassable. Document limitations in ADR; do not rely on it for core authorization.
Short (minutes to low tens of minutes) with refresh rotation - mobile apps are long-lived installs. Coordinate refresh logic with background AppState handlers.
No - treat URL params as untrusted input. Never grant privileges from ?role=admin. Validate session server-side.
Avoid caching sensitive images on disk without encryption. Use expiring signed URLs and clear caches on logout.
No - secrets still ship in bundles, secure store APIs are unchanged. Keep the same checklist on RN 0.86.
Stack versions: This page was written for React 19.2.3, React Native 0.86.0, and Expo SDK 57 (
expo~57.0.4).
Reviewed by Chris St. John·Last updated Jul 9, 2026