Do not put secrets in a React Native app, because anyone can inspect the bundle. Keep user tokens in Keychain on iOS and Keystore backed storage on Android, not in Async Storage. Keep real API keys on a server that calls the third party for you.
Tier 1: secrets that belong on a server
The React Native security guide is direct: never store sensitive API keys in app code, because they can be read in plain text by anyone inspecting the bundle. Config libraries are fine for environment specific values such as an API endpoint. They are not a vault.
If the app needs a protected resource, put an orchestration layer in front of it, such as a serverless function that adds the key and forwards the request. Secrets in server code cannot be extracted the way those in app code can. Pair it with user authentication and rate limits on that function, or you have only moved the problem.
Tier 2: user tokens and credentials
React Native has no built in secure storage. The guide points to platform features:
- iOS Keychain Services for tokens, certificates and passwords.
- Android Keystore for cryptographic keys, and encrypted shared preferences, since plain shared preferences are not encrypted.
You use them through your own native bridge or a wrapper such as expo-secure-store or react-native-keychain. The guide notes wrappers are used at your own risk, so review what you adopt.
Tier 3: non sensitive data
Async Storage is an unencrypted, asynchronous key value store, comparable to local storage on the web. Each app has its own sandbox, so other apps cannot read it, but it is the wrong place for tokens. It suits preferences, cached public data and persisted UI state.
Quiet leaks
The guide warns about accidental exposure. Persisting a whole Redux state tree can write sensitive form data to disk. Crash and monitoring tools may collect tokens or personal data if you do not scrub events. Review what you log and what you persist.
Do not forget backups and rotation
Short lived access tokens with server side revocation limit what a stolen device or backup gives away. See the post on mobile data leaks through backups, logs and screenshots for the other places data hides, and why an LLM key never belongs in a mobile app.
Try it yourself
Click through it at your own pace, or open it full screen.
Run the scan and look at the hardcoded credential style findings. Those are the ones that belong behind a server.
Quick check
Is an obfuscated or encoded key safe in the bundle?
No. Encoding only slows reading. A determined person can recover it, and your server cannot tell the real app from a copy of it.
Sources
Last reviewed: 19 October 2026.
