ExpoDeploy
Back to Documentation

Authentication & Security

Understand how ExpoDeploy handles authentication and learn best practices for keeping your account and credentials secure.

GitHub OAuth Authentication

Secure sign-in using your GitHub account

ExpoDeploy uses GitHub OAuth 2.0 for authentication, eliminating the need for separate passwords. When you click "Sign In", you're redirected to GitHub to authorize ExpoDeploy. We request minimal permissions: read-only repository access to detect code pushes and manage webhooks. Your GitHub credentials are never stored - we only receive an access token.

Session Management

Secure, long-lasting sessions

After authentication, ExpoDeploy creates a secure session using HTTP-only cookies. Sessions remain active for 30 days of inactivity, so you won't need to sign in frequently. You can sign out at any time from your profile menu, which immediately invalidates your session. All sessions are encrypted and protected against common attacks like CSRF.

API Token Authentication

Programmatic access for integrations

For API access and CI/CD integrations, generate API tokens from Dashboard → Settings → API Tokens. Each token is scoped to your account and can be revoked independently. Include tokens in the Authorization header as: Authorization: Bearer YOUR_API_TOKEN. Tokens never expire but should be rotated periodically for security.

Security Best Practices

Follow these guidelines to keep your ExpoDeploy account secure:

  • Protect API Tokens - Never commit tokens to Git or share them publicly. Use environment variables or secret management tools.
  • Rotate Credentials Regularly - Update your Expo Access Token, App Store API keys, and Google Play Service Accounts every 90 days.
  • Review Access Periodically - Check GitHub OAuth permissions and revoke access for unused integrations or team members who no longer need it.
  • Use Minimal Permissions - Grant only the permissions needed. For example, App Store API keys should use Admin role, not Account Holder.
  • Monitor Activity - Regularly review build logs and deployment history for any suspicious activity or unauthorized access.