Authentication

Scope

Authentication is an Account-profile feature. Guest projects keep the shared screens in the source tree for maintainability, but the runtime clears auth state, blocks account routes, and disables account API calls.

Supported flows

The Expo template includes:

• Email/password registration and login.
• Email verification and verification resend.
• Forgot-password and reset-password flows.
• Google sign-in and registration.
• Apple sign-in and registration.
• Connected Google/Apple accounts for an authenticated user.
• Logout, password change, session listing/revocation, login history, and account deletion.

The backend endpoints are centralized in services/endpoints.ts. Laravel owns token issuance and destructive account operations; the Go service validates the same Sanctum tokens for protected mobile resource reads/writes.

Token lifecycle

store/auth-store.ts stores the bearer token in expo-secure-store under auth_token. services/api.ts adds Authorization: Bearer <token> to requests and clears the auth store on a 401 response. The root layout redirects after initialization when the token is absent or invalid.

The token is not a JWT generated by the mobile app. It is a Laravel Sanctum personal access token issued by the Account backend.

Google sign-in setup

Google sign-in uses @react-native-google-signin/google-signin and requires:

1. A Web Client ID in EXPO_PUBLIC_GOOGLE_WEB_CLIENT_ID.
2. google-services.json in the mobile project root for Android.
3. GoogleService-Info.plist in the mobile project root for iOS.
4. A native development/release build; Expo Go is not enough for this native module.

Apple sign-in setup

Apple sign-in uses expo-apple-authentication on supported Apple devices/builds. Configure the Apple capability and backend credentials for the generated bundle identifier before testing in a release-like build.

API URL

Set EXPO_PUBLIC_API_URL to the API host root, for example:

EXPO_PUBLIC_API_URL=http://10.0.2.2:8000

The client appends /api/v1 and then the endpoint path. Do not include /api/v1 in the environment variable.

Security UI caveat

The security screen provides working session listing/revocation, login history, password change, and account deletion. The Biometric Login and Two-Factor Authentication switches are currently presentation/state toggles; they do not enable a native biometric lock or a server-side 2FA challenge by themselves.

Relevant files

• store/auth-store.ts — secure token and user state.
• services/api.ts — bearer injection and 401 handling.
• mutations/use-auth-mutations.ts and social mutation files — auth operations.
• queries/use-auth.ts — current-user validation.
• app/_layout.tsx — profile-aware route protection.