Expo and React Native

The JavaScript SDK runs in React Native as it is. A few helpers make it a good phone citizen: the session lives in the device keychain, provider sign-in goes through the system browser and comes back to your app, and push uses the phone’s own FCM / APNs token. The SDK has no native dependency: you pass the Expo modules in.

#Install

npx expo install expo-secure-store expo-web-browser expo-notifications expo-linking
npm install @sovaria/sdk

#Keep the session in the keychain

import * as SecureStore from 'expo-secure-store'
import { createClient, secureStoreAdapter } from '@sovaria/sdk'

export const sovaria = createClient(process.env.EXPO_PUBLIC_SOVARIA_URL!, process.env.EXPO_PUBLIC_SOVARIA_ANON_KEY!, {
  persistSession: { storage: secureStoreAdapter(SecureStore) },
})

SecureStore entries are size-limited, so the adapter splits a session into chunks and writes the index last: an app killed mid-write keeps the previous session, and a missing chunk reads as signed out, never as half a token. Never keep sessions in AsyncStorage (plain files).

#Sign in with Google, Apple, GitHub…

import * as WebBrowser from 'expo-web-browser'

const { data, error } = await sovaria.auth.signInWithOAuthNative({
  provider: 'google',
  redirectTo: 'myapp://auth/callback',          // app.json "scheme": "myapp"
  openAuthSession: WebBrowser.openAuthSessionAsync,
})
// A link that reopened the app instead (app killed meanwhile): app/auth/callback.tsx
await sovaria.auth.completeOAuthNative(url, 'myapp://auth/callback')

• Add myapp://auth/callback to Authentication › URL configuration (and register the app under Mobile › Apps).
• Only the exact redirect is accepted back; http:, javascript:, data:, file: and intent: redirects are refused before anything is sent.
• The code in the link is useless without this app’s PKCE verifier, so another app that grabs or forges the link can’t sign anyone in.
• An iOS app that offers other social sign-in must offer Sign in with Apple too (App Store guideline 4.8).

#Push notifications

import * as Notifications from 'expo-notifications'

await sovaria.push.registerNative(await Notifications.getDevicePushTokenAsync(), { appId: 'com.acme.app' })
// on sign-out
await sovaria.push.unregisterNative(await Notifications.getDevicePushTokenAsync())

Use the device token (getDevicePushTokenAsync), not an Expo push token: Sovaria sends to FCM and APNs directly with your credentials (Push notifications). A token belongs to the signed-in user.

#App attestation and offline data

nativeAttestation({ url, anonKey, appId, getEvidence }) asks for a challenge, lets your Play Integrity / App Attest module sign it and exchanges it for the attestation token (App attestation). Offline documents take keyValueStorage(AsyncStorage) (Offline-first apps).

#Build it with Sovariq

Ask Sovariq for a phone app (“an iOS and Android app for my book club”) or create one under Frontends with Phone app (Expo). The starter has expo-router screens, a small native kit, sign-in, an Items list on your tables, push and the store settings.

• Web preview: the studio renders the app with react-native-web; screenshots, test-drives and design review work as for web apps.
• On your phone: Preview in Expo Go publishes an EAS Update; open its expo.dev page and scan the QR code with Expo Go. Sovaria never ships its own app that runs your code (App Store guideline 2.5.2).
• Store builds and submission run on EAS with your own Expo, Apple and Google accounts and bill your Expo plan. Save an Expo access token in the app’s Phone app view (kept as the encrypted project secret EXPO_TOKEN), put the EAS project id in app.json › extra.eas.projectId, push the app to GitHub and link that repository to the EAS project. Apple and Google credentials stay in EAS.
• Store check: the Phone app view lists what review needs: your own bundle id, icons, privacy policy and account-deletion links, Sign in with Apple, iOS purpose strings and privacy manifest, EAS profiles, no service keys. Submitting is refused until it passes.

#Coming from Firebase or Supabase?

Moving an existing app? Migrate from Supabase or Firebase imports users (with their passwords), data, files and rules.