expo-secure-store & expo-crypto

npx expo install expo-secure-store expo-crypto

import * as SecureStore from "expo-secure-store";
 
const REFRESH_KEY = "auth.refresh_token";
 
export async function saveRefreshToken(token: string) {
  await SecureStore.setItemAsync(REFRESH_KEY, token, {
    keychainAccessible: SecureStore.WHEN_UNLOCKED_THIS_DEVICE_ONLY,
  });
}
 
export async function loadRefreshToken(): Promise<string | null> {
  return SecureStore.getItemAsync(REFRESH_KEY);
}
 
export async function clearAuthSecrets() {
  await SecureStore.deleteItemAsync(REFRESH_KEY);
}

import * as Crypto from "expo-crypto";
 
export async function sha256Hex(input: string) {
  return Crypto.digestStringAsync(
    Crypto.CryptoDigestAlgorithm.SHA256,
    input
  );
}
 
export function randomNonce(bytes = 16) {
  return Crypto.getRandomBytes(bytes);
}

npx expo install expo-secure-store expo-crypto

// src/auth/secureTokenVault.ts
import * as SecureStore from "expo-secure-store";
 
const keys = {
  refresh: (userId: string) => `auth.refresh_token.${userId}`,
  device: "auth.device_binding",
} as const;
 
export const tokenVault = {
  async saveRefresh(userId: string, token: string) {
    await SecureStore.setItemAsync(keys.refresh(userId), token, {
      keychainAccessible: SecureStore.WHEN_UNLOCKED_THIS_DEVICE_ONLY,
    });
  },
 
  async loadRefresh(userId: string) {
    return SecureStore.getItemAsync(keys.refresh(userId));
  },
 
  async clearUser(userId: string) {
    await SecureStore.deleteItemAsync(keys.refresh(userId));
  },
 
  async clearAllKnownUsers(userIds: string[]) {
    await Promise.all(userIds.map((id) => tokenVault.clearUser(id)));
    await SecureStore.deleteItemAsync(keys.device);
  },
};

// src/cache/cacheKey.ts
import * as Crypto from "expo-crypto";
 
export async function cacheKeyForUrl(url: string) {
  const hash = await Crypto.digestStringAsync(
    Crypto.CryptoDigestAlgorithm.SHA256,
    url
  );
  return `cache:${hash.slice(0, 16)}`;
}

// src/auth/logout.ts
import { tokenVault } from "./secureTokenVault";
 
export async function logout(userId: string, allUserIds: string[]) {
  await tokenVault.clearAllKnownUsers(allUserIds);
  // Also: queryClient.clear(), router.replace('/sign-in') - see auth-session
}

await SecureStore.setItemAsync("pin.step_up", "verified", {
  requireAuthentication: true, // iOS: Face ID to read
  authenticationPrompt: "Confirm identity to view account",
});

import * as Crypto from "expo-crypto";
 
const verifier = Crypto.getRandomBytes(32);
const uuid = Crypto.randomUUID();

Refresh token     → expo-secure-store
Access token      → memory or short SecureStore session
User preferences  → AsyncStorage / MMKV
Photos            → expo-file-system paths

// Minimum logout sequence
await SecureStore.deleteItemAsync("auth.refresh_token");
queryClient.clear();
router.replace("/sign-in");