How do you manage environment variables safely and reliably in Expo?

Short answer

Use the EXPO_PUBLIC_ prefix for variables allowed to be exposed on the client, and store secrets in EAS variables with secret visibility for use during cloud builds only.

Explanation

In modern Expo, any variable that starts with EXPO_PUBLIC_ (such as EXPO_PUBLIC_API_URL) is included in JavaScript code and visible to anyone inspecting the bundle. Private, sensitive keys must not use this prefix. Create them as secret EAS variables with eas env:create (which replaced the old eas secret:create command) so the server build can use them without leaking them into client files.

Code example

# .env
EXPO_PUBLIC_API_URL=https://api.example.com        # inlined into the JS bundle → visible to everyone
PRIVATE_DEPLOY_KEY=secret_not_exposed_to_client    # no EXPO_PUBLIC_ prefix → never bundled

# Store real secrets on EAS instead of the repo:
#   eas env:create --name PRIVATE_DEPLOY_KEY --value "..." --visibility secret --environment production

// In app code
const apiUrl = process.env.EXPO_PUBLIC_API_URL; // safe: it is meant to be public

Common mistakes

• Naming secret encryption keys and payment API tokens with the EXPO_PUBLIC_ prefix, making them extractable from JavaScript files.

Follow-up questions

• How do you diagnose and analyze crash reports with Sentry in Expo apps?
• What is EAS Build, and how does it differ from building locally on a developer's machine?

Sources

• Expo docs — Environment variables