Secure token storage with Expo

The Mobile App Starter does not keep the session in AsyncStorage. It uses Expo SecureStore. The key is the string session.

Sign-in writes the token. Later requests read that key and send it as a bearer token. The client is described in Expo API client architecture. Sign-out deletes the key so the next launch has no session. The screen flow around that is Expo authentication architecture.

SecureStore is for a short credential, not for a database. The starter does not store the user profile, a refresh-token family, or a push token there. Push registration is not part of the kit.

If you add a second secret, give it a different key. Reusing session for anything else will log the user out the next time that value is replaced.