Device Features, Storage and Authentication

Storing data

import * as SecureStore from "expo-secure-store";
await SecureStore.setItemAsync("session_token", token);
const token = await SecureStore.getItemAsync("session_token");

Never store tokens in AsyncStorage: it is not encrypted.

Authentication

• For "Sign in with Google/GitHub/Apple", use OAuth with PKCE via expo-auth-session; the app never sees the user's password.
• For your own backend, exchange credentials for a short-lived access token plus a refresh token; store them in SecureStore.
• Apple requires Sign in with Apple if your iOS app offers other third-party social logins (check current App Store rules).

Camera and images

import * as ImagePicker from "expo-image-picker";

const result = await ImagePicker.launchImageLibraryAsync({
  mediaTypes: ["images"], allowsEditing: true, quality: 0.8,
});
if (!result.canceled) uploadAvatar(result.assets[0].uri);

Resize and compress before uploading to save data; validate type and size again on the server.

Permissions

Ask for permissions when the user tries the feature, with a clear reason, not at launch. If denied, explain how to enable it in settings and keep the rest of the app working. Declare usage descriptions in app.json (iOS rejects apps without them).

Push notifications

expo-notifications registers the device and receives a push token; your server sends notifications via Expo's push service (or directly via APNs/FCM). Ask permission after the user sees value ("Notify me when my build finishes"), let them control categories, and never spam.

Other device APIs

Location (expo-location), haptics, biometrics (expo-local-authentication for Face ID / fingerprint unlock), sharing, clipboard and file system. Each needs permissions and graceful fallbacks.

Exercise

Add sign-in that stores the token in SecureStore, a profile screen with avatar upload from the photo library (compressed), and an opt-in notification toggle that registers for push notifications.

Check yourself

• Where should auth tokens be stored on a device?
• When should you ask for a permission?
• Why compress images before upload?