# Implement Expo Authentication Flows

Expo authentication often fails because OAuth redirects, token storage, and route guards must align across app and backend. This skill provides concrete React Native patterns for Google sign-in, secure token handling, protected routes, and backend token verification.

## Install

```bash
npx skillstore add cjharmath/rn-auth
```

## Metadata

- Status: approved
- Slug: cjharmath-rn-auth
- Skillstore revision: r1
- Version status: missing
- Tree hash: 40ad645af8c14407330b64edf8a5aa2b592491fdd8622d33f158b48f9caeab6d
- Author: CJHarmath
- GitHub username: CJHarmath
- License: MIT
- Repository: https://github.com/CJHarmath/claude-agents-skills/tree/main/skills/rn-auth
- Ref: dd4a3ef9f20ddf38830950b4bb713df96b431fd6
- Supported tools: Claude, Codex, Claude Code
- Audit status: complete
- Agent install advisory: allowed
- Manual install advisory: allowed
- Artifact signature: available
- Audit attestation: unavailable
- Human verification: not\_verified
- Risk factors: external\_commands, network, env\_access
- Quality score: 78
- Quality tier: bronze
- Public page: https://skillstore.pages.dev/skills/cjharmath-rn-auth
- Manifest: https://skillstore.pages.dev/api/skills/cjharmath-rn-auth/manifest

## Capabilities

- Shows Expo AuthSession setup for Google OAuth in React Native apps.
- Recommends expo-secure-store for access and refresh token storage.
- Outlines an AuthProvider and useAuth context pattern for session state.
- Demonstrates Expo Router redirects for authenticated and unauthenticated routes.
- Shows how to attach bearer tokens to backend API requests.
- Includes FastAPI guidance for verifying Google ID tokens server-side.

## Use Cases

- Add Google Sign-In to Expo: Use the AuthSession pattern to configure client IDs, scopes, and redirect handling for an Expo app.
- Protect App Routes: Apply the auth context and Expo Router examples to redirect users based on session state.
- Verify Tokens on the Backend: Use the FastAPI reference to validate Google ID tokens with the correct web client ID.

## Prompt Templates

### Set Up Basic Login

```
Use this skill to outline the files and steps needed for Google login in my Expo React Native app.
```

### Design Token Storage

```
Use this skill to design secure access token and refresh token storage for my Expo app using expo-secure-store.
```

### Debug Redirect Failures

```
Use this skill to diagnose why my Expo Google sign-in opens the browser but does not return to the app.
```

### Review Full Auth Architecture

```
Use this skill to review my Expo auth flow, protected routes, token refresh plan, and backend Google token verification approach.
```

## Limitations

- It is guidance, not a complete authentication service or package.
- Client IDs, redirect schemes, and backend endpoints must be supplied by each project.
- Refresh token rotation and revocation are mentioned but not fully implemented.
- It focuses on Expo and Google sign-in, not every identity provider.

## Best Practices

- Store tokens with expo-secure-store instead of AsyncStorage.
- Validate saved tokens with the backend before restoring a session.
- Keep OAuth client IDs and redirect schemes aligned across Expo and provider settings.

## Anti Patterns

- Using the iOS client ID for backend Google token verification.
- Trusting a stored token without checking it against the backend.
- Testing only in Expo Go while ignoring standalone build redirect URIs.

## Security Audit

- Audited at: 2026-07-06T05:29:41.617\+00:00
- Summary: The static findings are false positives caused by Markdown inline code, fenced code examples, JavaScript template literals, and normal sample networking patterns. I found no prompt injection, malicious intent, credential exfiltration, or skill-executed commands in SKILL.md.

## Stats

- Views: 277
- Downloads: 10
- Favorites: 0
- Popularity score: 0