Authentication

NativeExpress uses Supabase Auth  for email and password, Apple and Google sign-in, password reset, and account deletion.

Prerequisites

Complete the Supabase project setup.

Email confirmation and password reset

Email sign-up supports Supabase’s Confirm email setting. When it is enabled, a new account goes to the check-email screen, which includes a resend action. When it is disabled, sign-up creates a session immediately.

Configure Supabase’s redirect URLs  for the scheme in config.js → general.scheme. Add <your-scheme>://** to the allow list. The initial sign-up email targets /auth/confirmed, and password-reset emails target /update-password.

Use a Site URL you control for fallback redirects, and configure custom SMTP  before sending auth emails to your customers. Test confirmation, resend and password reset with your email settings and a development build.

How routes are protected

Expo Router’s Stack.Protected controls which route groups are available, in src/app/_layout.tsx:

<Stack.Protected guard={!!session}>
  {/* (protected) */}
</Stack.Protected>
<Stack.Protected guard={!session}>
  {/* (public) */}
</Stack.Protected>

src/app/index.tsx chooses the landing screen:

The confirmation and password-recovery routes sit outside both groups so email links can open them while the session is being established.

Files

• src
  • app
    • (public)
      • welcome.tsx
      • sign-in.tsx
      • sign-up.tsx
      • check-email.tsx - Confirmation and resend
      • forgot-password.tsx
    • auth/confirmed.tsx - Confirmation link destination
    • update-password.tsx - Password recovery
    • (protected)/change-password.tsx - Change a known password
  • hooks/auth
    • useSignUp.ts
    • useResendConfirmation.ts
    • useResetPassword.ts
    • useUpdatePassword.ts
    • useChangePassword.ts
    • useDeleteAccount.ts
  • hooks/useDeepLink.ts - Handles auth email links
  • provider/SessionProvider.tsx - Session state
  • lib/secure-storage.ts - Keychain and Keystore storage
• supabase/functions/delete-account
  • index.ts - Account and storage deletion

Each auth action is a hook in src/hooks/auth/, including sign-in, sign-out, profile updates and password changes. The app stores Supabase session tokens through expo-secure-store and restores the session on launch.

Account deletion

The profile screen calls the delete-account edge function, which removes the user’s avatar and chat media before deleting the Auth user. Deploy it as part of edge-function setup. It uses the service-role key on the server; that key does not belong in the app.