Skip to content

feat(expo-native-components): opt-in Restore Credentials for the Android AuthView - #10233

Draft
swolfand wants to merge 2 commits into
mainfrom
sam/mobile-667-expo-restore-credentials
Draft

swolfand wants to merge 2 commits into
mainfrom
sam/mobile-667-expo-restore-credentials

Conversation

@swolfand

@swolfand swolfand commented Oct 14, 2026 •

Copy link
Copy Markdown
Contributor

Description

Linear: MOBILE-667 (Expo part). Android side: clerk/clerk-android#1097.

From April 2027, Google Play requires apps with sign-in to keep users signed in when they move to a new Android device (Restore Credentials). Expo apps that use the prebuilt native AuthView had no way to turn this on.

This adds an opt-in enableRestoreCredentials?: boolean prop (default false) to AuthView:

<AuthView enableRestoreCredentials />
  • JS/TS: the prop is declared and documented on AuthViewProps (Android only, opt-in, needs passkeys enabled on the instance, needs clerk-android with fix(clerk-js): Form errors not displayed when form submitted with enter #1097). @clerk/expo/native-components re-exports these types, so it needs no change.
  • Android: ClerkAuthViewModule gets an enableRestoreCredentials view prop and passes it to the Compose AuthView(enableRestoreCredentials = ...) from clerk-android fix(clerk-js): Form errors not displayed when form submitted with enter #1097. With it on, a signed-out AuthView tries the restore credential that device setup transferred, but only on the first launch after the app is installed or restored onto a device. After sign-in or sign-up it creates a restore credential for the signed-in user in the background. That replaces the one this device created for the same user before, and the device's single restore credential belongs to the most recent user. It needs passkeys enabled as a first factor.
  • JS sign-out: a sign-out from JS doesn't go through the native SDK's sign-out, so before this it left the device's restore key in place. With fix(clerk-js): Form errors not displayed when form submitted with enter #1097's first-launch-only restore, that no longer leads to a silent re-sign-in on the same install. Still, syncClientStateFromJs in ClerkExpoModule now calls Clerk.restoreCredentials.clear() when a JS-originated sync takes the client from having sessions to none, which matches a native sign-out. RestoreCredentials.clear() is already in clerk-android 1.1.11. The check is a small clientSignedOut(previous, current) helper with a Robolectric-free unit test (ClientSignedOutTest). The module's Kotlin tests need an Expo host project and aren't run in CI (only expo-biometrics tests are), and this module won't compile against 1.1.11 anyway until the version bump, so I haven't run that test.
  • iOS: the prop is accepted and ignored. AuthView only forwards it to the native view on Android, so the iOS view definition is unchanged.

Blocked on a clerk-android release. enableRestoreCredentials only exists on the clerk-android AuthView once #1097 is merged and released; the latest release is 1.1.11, which doesn't have it. The Android pins in android/build.gradle (clerkAndroidApiVersion / clerkAndroidUiVersion = 1.1.11) are left as they are, so the Kotlin in this PR won't compile until they are bumped to the release that contains #1097. Opening as a draft until then.

Possible follow-up: standalone JS APIs for restore credentials (create / sign in / clear) outside of AuthView. Those need a design for syncing auth state between the native SDK and the JS client, so they're not in this PR.

Checklist

  • pnpm test runs as expected.
  • pnpm build runs as expected.
  • (If applicable) JSDoc comments have been added or updated for any package exports
  • (If applicable) Documentation has been updated

Type of change

  • 🐛 Bug fix
  • 🌟 New feature
  • 🔨 Breaking change
  • 📖 Refactoring / dependency upgrade / documentation
  • other:

@vercel

vercel Bot commented Oct 14, 2026 •

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
clerk-js-sandbox Ready Ready Preview Oct 14, 2026 7:42pm UTC
swingset Ready Ready Preview Oct 14, 2026 7:42pm UTC

Request Review

@changeset-bot

changeset-bot Bot commented Oct 14, 2026 •

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: b666673

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 2 packages
Name Type
@clerk/expo-native-components Minor
@clerk/expo Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@coderabbitai

coderabbitai Bot commented Oct 14, 2026

Copy link
Copy Markdown
Contributor

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

  • Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Comment @coderabbitai help to get the list of available commands.

@pkg-pr-new

pkg-pr-new Bot commented Oct 14, 2026

Copy link
Copy Markdown

Open in StackBlitz

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@10233

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@10233

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@10233

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@10233

@clerk/electron

npm i https://pkg.pr.new/@clerk/electron@10233

@clerk/electron-passkeys

npm i https://pkg.pr.new/@clerk/electron-passkeys@10233

@clerk/eslint-plugin

npm i https://pkg.pr.new/@clerk/eslint-plugin@10233

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@10233

@clerk/expo-biometrics

npm i https://pkg.pr.new/@clerk/expo-biometrics@10233

@clerk/expo-google-signin

npm i https://pkg.pr.new/@clerk/expo-google-signin@10233

@clerk/expo-native-components

npm i https://pkg.pr.new/@clerk/expo-native-components@10233

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@10233

@clerk/express

npm i https://pkg.pr.new/@clerk/express@10233

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@10233

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@10233

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@10233

@clerk/mosaic

npm i https://pkg.pr.new/@clerk/mosaic@10233

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@10233

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@10233

@clerk/react

npm i https://pkg.pr.new/@clerk/react@10233

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@10233

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@10233

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@10233

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@10233

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@10233

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@10233

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@10233

commit: bcbfe7c

…the restore key on JS sign-out

Match the final clerk/clerk-android#1097 behaviour in the AuthView TSDoc and the changeset: restore is tried only on the first launch after install or restore, the device's restore key belongs to the most recent user and replaces that user's previous one, and passkeys must be a first factor.

When a JS-originated client sync takes the client from having sessions to none, call Clerk.restoreCredentials.clear() so a JS sign-out deletes the device's restore key like a native sign-out does.

This branch was successfully deployed

2 active deployments
Preview – swingset — b6666739 Deployed Oct 14, 2026 by vercel[bot]
Preview – clerk-js-sandbox — b6666739 Deployed Oct 14, 2026 by vercel[bot]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant