Secure token storage in Expo stops leaking sessions attackers can replay

UpdatedSeptember 10, 2026

Storing an auth token in AsyncStorage feels harmless during development. The login works, the session persists across restarts, and nothing complains. Then your app ships, and that same token sits in plaintext in your app's sandbox, readable to anything with backup access, device dumps, or a rooted phone. On iOS it can end up inside unencrypted iTunes backups. On Android it sits in shared preferences XML. This is the single most common credential-storage mistake in shipped Expo apps, and fixing it after launch means forcing every user to log in again.

Expo's answer is expo-secure-store: a thin wrapper over iOS Keychain Services and Android's EncryptedSharedPreferences backed by the Android Keystore. Small API, serious protection.

This is an excerpt. Read the full post at otf-kit.dev/blog/expo-secure-store-tokens-production — full-stack kits your AI coding agent can actually ship to production. Browse the kits →

#react-native #supabase #cross-platform

Comments

Join the discussion

No comments yet. Be the first to comment.

More from this blog

Prompt-to-Vercel with v0 is not the same as owning a production kit

v0 by Vercel turns a prompt, wireframe, or mockup into a high-fidelity UI you can preview live, connect to a backend, and either deploy to Vercel or open as a pull request. That is a different product

Sep 10, 20261 min read

Prompt-to-Vercel with v0 is not the same as owning a production kit

Emergent ships fast previews; a kit owns the production repo you keep

Sandboxed agents ship demos. Production needs a repo you own. Emergent is an AI app builder in the same sandboxed-agent class as Lovable, Bolt, and Rork. You describe a product in natural language; th

Sep 10, 20261 min read

Emergent ships fast previews; a kit owns the production repo you keep

Cal.com and Calendly schedule meetings; a booking kit owns the client app

Scheduling products are not your booking product Cal.com and Calendly are excellent at one job: putting a bookable calendar in front of a human. You publish availability, a visitor picks a slot, and t

Sep 10, 20261 min read

Cal.com and Calendly schedule meetings; a booking kit owns the client app

Retool and Appsmith fit internal tools; a SaaS dashboard kit owns the product repo

Two different jobs get collapsed into one shopping cart Retool and Appsmith are built to ship internal tools: admin panels, ops dashboards, and data-backed screens that sit on top of databases and API

Sep 10, 20261 min read

Retool and Appsmith fit internal tools; a SaaS dashboard kit owns the product repo

GitHub Actions triggers EAS builds when EXPO_TOKEN and non-interactive flags are set

Local builds must succeed before CI can be honest GitHub Actions cannot invent EAS credentials, bundle identifiers, or build profiles for you. Expo's own CI guide starts with a blunt prerequisite: run

Sep 10, 20261 min read

GitHub Actions triggers EAS builds when EXPO_TOKEN and non-interactive flags are set

OTF — kits your AI coding agent can ship to production

551 posts

Engineering notes on shipping production apps with AI coding tools — Claude Code, Cursor, Codex, Lovable, Bolt — and the stack underneath: React Native, Expo, Next.js, Supabase. Honest takes on what works, what breaks, and the full-stack kits that get you to production faster. By OTF.

Command Palette

Comments

More from this blog