# Keep unsigned users off product screens with one Expo Router root gate

If a product screen can mount before you know who is signed in, the file tree is doing the wrong job. The fix is not a `Redirect` at the top of every screen. It is a file convention that splits signed-out routes from product routes, plus one guard at the root stack that decides which group is allowed to exist.

Expo Router calls this protected routes. The current API is `Stack.Protected` with a `guard` boolean. The authentication guide uses the same idea with route groups. Older apps still use a layout-level `Redirect`. All three are the same product decision: evaluate auth **before** a home, settings, or billing screen is in the tree.

This post is only that gate.

---

*This is an excerpt. Read the full post at [otf-kit.dev/blog/expo-router-protected-routes-gate](https://otf-kit.dev/blog/expo-router-protected-routes-gate) — full-stack kits your AI coding agent can actually ship to production. [Browse the kits →](https://otf-kit.dev)*