Repository navigation
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
🦋 Changeset detectedLatest commit: b666673 The changes in this PR will be included in the next version bump. This PR includes changesets to release 2 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
Contributor
|
Important Draft PR not reviewedDraft PRs are not automatically reviewed by default.
To automatically review draft PRs, update your CodeRabbit configuration: reviews:
auto_review:
drafts: true
Comment |
@clerk/astro
@clerk/backend
@clerk/chrome-extension
@clerk/clerk-js
@clerk/electron
@clerk/electron-passkeys
@clerk/eslint-plugin
@clerk/expo
@clerk/expo-biometrics
@clerk/expo-google-signin
@clerk/expo-native-components
@clerk/expo-passkeys
@clerk/express
@clerk/fastify
@clerk/hono
@clerk/localizations
@clerk/mosaic
@clerk/nextjs
@clerk/nuxt
@clerk/react
@clerk/react-router
@clerk/shared
@clerk/tanstack-react-start
@clerk/testing
@clerk/ui
@clerk/upgrade
@clerk/vue
commit: |
…the restore key on JS sign-out Match the final clerk/clerk-android#1097 behaviour in the AuthView TSDoc and the changeset: restore is tried only on the first launch after install or restore, the device's restore key belongs to the most recent user and replaces that user's previous one, and passkeys must be a first factor. When a JS-originated client sync takes the client from having sessions to none, call Clerk.restoreCredentials.clear() so a JS sign-out deletes the device's restore key like a native sign-out does.
mikepitre
self-requested a review
October 14, 2026 21:54
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Linear: MOBILE-667 (Expo part). Android side: clerk/clerk-android#1097.
From April 2027, Google Play requires apps with sign-in to keep users signed in when they move to a new Android device (Restore Credentials). Expo apps that use the prebuilt native
AuthViewhad no way to turn this on.This adds an opt-in
enableRestoreCredentials?: booleanprop (defaultfalse) toAuthView:AuthViewProps(Android only, opt-in, needs passkeys enabled on the instance, needs clerk-android with fix(clerk-js): Form errors not displayed when form submitted with enter #1097).@clerk/expo/native-componentsre-exports these types, so it needs no change.ClerkAuthViewModulegets anenableRestoreCredentialsview prop and passes it to the ComposeAuthView(enableRestoreCredentials = ...)from clerk-android fix(clerk-js): Form errors not displayed when form submitted with enter #1097. With it on, a signed-outAuthViewtries the restore credential that device setup transferred, but only on the first launch after the app is installed or restored onto a device. After sign-in or sign-up it creates a restore credential for the signed-in user in the background. That replaces the one this device created for the same user before, and the device's single restore credential belongs to the most recent user. It needs passkeys enabled as a first factor.syncClientStateFromJsinClerkExpoModulenow callsClerk.restoreCredentials.clear()when a JS-originated sync takes the client from having sessions to none, which matches a native sign-out.RestoreCredentials.clear()is already in clerk-android 1.1.11. The check is a smallclientSignedOut(previous, current)helper with a Robolectric-free unit test (ClientSignedOutTest). The module's Kotlin tests need an Expo host project and aren't run in CI (onlyexpo-biometricstests are), and this module won't compile against 1.1.11 anyway until the version bump, so I haven't run that test.AuthViewonly forwards it to the native view on Android, so the iOS view definition is unchanged.Blocked on a clerk-android release.
enableRestoreCredentialsonly exists on the clerk-androidAuthViewonce #1097 is merged and released; the latest release is 1.1.11, which doesn't have it. The Android pins inandroid/build.gradle(clerkAndroidApiVersion/clerkAndroidUiVersion=1.1.11) are left as they are, so the Kotlin in this PR won't compile until they are bumped to the release that contains #1097. Opening as a draft until then.Possible follow-up: standalone JS APIs for restore credentials (create / sign in / clear) outside of
AuthView. Those need a design for syncing auth state between the native SDK and the JS client, so they're not in this PR.Checklist
pnpm testruns as expected.pnpm buildruns as expected.Type of change