March 23, 2026·10 min read

Token refresh on mobile without random logouts

Mobile apps nap, lose time, and resume with expired JWTs. A small state machine around refresh—single-flight, backoff, and clear logout on hard failure—keeps users from rage-quitting. Treat auth as async infrastructure, not something you handle ad hoc in each screen.

Single-flight refresh

Ten parallel 401s should trigger one refresh, not ten. Queue in-flight API calls or retry after refresh completes.

Watch for refresh token rotation invalidating older refresh tokens.

Clock skew

Devices with wrong time break exp claims. Prefer server-issued absolute expiry metadata when you can.

Log auth errors with categories: network vs invalid_grant vs unknown.

Secure storage

Refresh tokens belong in secure storage, not AsyncStorage, if your threat model says so. Document logout wiping both.

Biometric re-prompt on resume is a product choice, not just security.

User-visible behavior to decide up front

On hard auth failure: show a clear message, route to login, and preserve deep-link intent if possible. On transient network failure: retry with backoff before you panic the user.

Session expiry during background: some apps silently refresh; others show a lightweight re-auth sheet—pick one and make it consistent across tabs.

Concurrency and request serialization

Parallel 401 responses should not trigger parallel refreshes. Implement a single-flight mutex or queue: the first refresh wins; others await the same promise. Deduplicate refresh token use—some servers invalidate old refresh tokens on rotation. For GraphQL and REST mixed environments, centralize auth headers in your fetch layer so every client benefits.

Clock skew and token semantics

Prefer short-lived access tokens with server-issued absolute expiry when possible. Client-side JWT parsing can drift if device time is wrong—surface user-visible clock warnings if your backend detects skew. Log categorized auth errors without leaking tokens. For biometric-gated reauth, define product rules clearly—security versus friction tradeoffs vary by domain.

Storage and key rotation

Secure storage for refresh tokens when threat model demands. Clear both access and refresh on logout; verify no background tasks resurrect old sessions unexpectedly. Handle OS backup exclusions if required by policy. When rotating encryption keys, plan migration windows carefully.

Foreground, background, and push interactions

Push notifications may arrive near token expiry boundaries; ensure handlers do not assume fresh tokens without checks. Background fetch may refresh tokens—coordinate with rate limits. If user returns after long idle, prefer silent refresh before showing sensitive UI.

Multi-account and device transfer edge cases

Switching accounts must wipe prior tokens cleanly. Device backups restoring old tokens can confuse servers—coordinate with backend on invalidation strategies. Enterprise policies may require shorter sessions—surface session timeouts in UX copy if users ask.

Testing strategies

Simulate 401 storms, refresh failures, and slow networks in automated tests. Monkey-test clock changes on devices. Verify single-flight behavior under load tests for chatty screens. Include logout-in-another-tab scenarios if applicable on web-shared code.

Operational monitoring

Dashboards for auth error rates, refresh failures, and logout spikes. Alert on anomalies after releases. Pair metrics with version and OS segmentation. Auth regressions are revenue-critical—treat them as such.

Shipping and reliability habits (1)

Accessibility is compatibility. Labels, focus order, and dynamic type are not polish—they determine whether users can complete tasks at all. Test with VoiceOver and TalkBack on hardware; simulators miss focus bugs. When designs prioritize minimalism, negotiate text alternatives for icon-only controls. Accessibility regressions often follow navigation redesigns—add checklist items to those PRs specifically.

Internationalization is a product feature, not a string swap. Plural rules, RTL layout, and locale-aware formatting change behavior—not just copy length. Pseudolocale helps find clipping early, but real Arabic and German QA catches nuance. Avoid concatenating translated fragments; context matters. Document glossary terms so translators do not invent inconsistent product names.

Platform differences worth rehearsing (2)

Images and maps look simple in mocks and expensive in production. Decode sizes should match display sizes; static map thumbnails are not interchangeable with interactive MapView gestures. Quotas, API keys, and offline behavior need explicit fallbacks—addresses as text, retry buttons, and calm error copy. Monitor vendor dashboards for spikes that indicate bugs or abuse.

Error boundaries catch render failures, not native crashes or async mistakes. Pair them with platform crash reporting and structured client logs. Fallback UI should include build identifiers and humane copy—never raw stack traces for end users. Test fallbacks with screen readers; a broken error screen is still broken UX.

Security, privacy, and data handling (3)

Keyboard and form UX separate polished apps from ‘works on desktop simulators.’ Platform differences in soft input modes matter; test smallest phones and Android gesture navigation. Primary actions must remain reachable when the keyboard is visible—scroll containers and keyboard controllers exist because this problem is universal.

Type-safe navigation pays off when routes multiply. Keep param lists near navigators, validate external URLs, and avoid serializing non-JSON-safe values through params. Renaming routes is a cross-cutting change—update analytics, push payloads, and E2E selectors in the same release train.

Performance and measurement discipline (4)

Privacy nutrition labels and Play Data Safety forms should reflect actual SDK behavior—inventory dependencies each release and remove dead code. Drift between claims and telemetry is legal and store risk, not just embarrassment. Involve legal early when adding analytics or ads.

Expo SDK upgrades are integration projects: `expo doctor`, aligned community packages, regenerated native projects, and device smoke tests for camera, push, and IAP. Freeze unrelated native refactors during the upgrade window and keep rollback paths hot. Document surprises for the next upgrade while memory is fresh.

Team process and long-term maintenance (5)

Background execution policies change with OS updates—revalidate after major iOS and Android releases. Misused background modes invite rejection. Persist user work frequently; the OS can kill you anytime after backgrounding. Uploads and timers should tolerate pause and resume without corrupting state.

Design tokens and semantic colors make dark mode and rebrands feasible. Mixing three styling systems doubles migration cost—pick a primary approach and draw boundaries. Runtime CSS-in-JS can cost frame time on hot screens—profile before adopting wholesale.

Shipping and reliability habits (6)

Helper modules concentrate glue code—storage, navigation, permissions—so screens stay readable. Split helpers by topic before files become merge-conflict magnets, and document each module’s contract. Good helpers answer ‘where do we save tokens?’ in one glance—not ‘ask Sarah.’

Shipping React Native features is less about any single API and more about the system around it: typed boundaries, predictable navigation, and telemetry that tells you what broke in production. Prefer boring, explicit modules over clever metaprogramming that the next hire cannot grep. When platform vendors change behavior in point releases, your defense is automated smoke tests on real devices and a short internal changelog of native assumptions you rely on.

Platform differences worth rehearsing (7)

Monorepos amplify both leverage and failure modes: duplicate React versions cause mysterious hook errors, and Metro misconfiguration blocks local packages from resolving. Invest in workspace discipline—single React version, documented `watchFolders`, and lint rules preventing packages from importing app navigators accidentally. CI must mirror local installs; ‘works on my laptop’ with different package managers is a time bomb.

Native modules are product decisions disguised as engineering tasks. You inherit Xcode and Gradle upgrades, store review scrutiny, and security obligations. Prefer maintained Expo modules and config plugins before writing JNI or Swift glue from scratch. When you must go native, budget pairing time with platform specialists and write runbooks for on-call—crashes in native code bypass many JS safeguards.

Security, privacy, and data handling (8)

Storage is not a database. AsyncStorage and MMKV excel at key-value preferences; SQLite or remote APIs belong elsewhere for relational data. Migrations should be incremental, logged, and non-blocking for UI. Secure tokens need secure storage when your model demands it—speed is not a substitute for correctness on auth material.

WebViews are untrusted browsers inside your app. Validate `postMessage` payloads, lock navigation to expected hosts, and prefer system-browser auth flows when OAuth security demands it. Third-party JavaScript can change without your deploy—treat XSS in web as bridge compromise risk. Clear storage on logout and rate-limit message handlers.

Performance and measurement discipline (9)

FlatList performance is configuration as much as code. Stable keys, reasonable `windowSize`, and memoized rows beat switching to a different list primitive blindly. Nested virtualized lists are a last resort—redesign first. Profile with production-like data volumes; dev placeholders lie.

Splash screens and launch gates should reflect honest readiness: fonts, theme, session, critical remote config—not every SDK under the sun. Infinite splash is worse than a slightly longer branded hold. Match native and JS background colors to avoid flashes; respect reduced motion for animations.

Team process and long-term maintenance (10)

Hermes versus JSC is not a lifestyle choice—profile your app. Hermes usually wins on startup; some libraries still assume JSC quirks. Engine toggles are not substitutes for fixing quadratic renders in your own code. Upgrade notes matter: Intl support and debugging tooling evolve.

Reanimated and gesture libraries earn their place when profiling proves UI-thread work and your team can maintain native upgrades. Worklets have constraints—read errors carefully. Respect reduced motion and test Android timing differences—identical JS does not guarantee identical feel.

Shipping and reliability habits (11)

Platform differences worth rehearsing (12)

JWT and session refresh flows need single-flight refresh, clear logout semantics, and secure storage for refresh tokens when appropriate. Parallel 401s should not stampede refresh endpoints. Clock skew and biometrics policies belong in explicit product decisions, not accidental implementation details.

Security, privacy, and data handling (13)

Testing onboarding changes with funnel metrics beats debating opinions. Segment by acquisition channel and platform; back behavior differs. Skip paths must be genuine—dark patterns may win short metrics and destroy brand trust. Localization length tests prevent clipped CTAs in verbose languages.

Performance and measurement discipline (14)

Performance work should start with measurement, not instinct. Watch JS thread versus UI thread separately; they bottleneck differently. Lists, images, and animations dominate most regressions—optimize those before micro-optimizing pure functions. Hermes, JSC, and bridge internals evolve; re-profile after every major upgrade instead of trusting last year’s numbers. Battery and thermal throttling on mid devices reveal issues flagship phones hide.

Team process and long-term maintenance (15)

Push notifications walk a line between helpful and intrusive. Prime users with context, respect notification channels on Android, and measure opt-outs after campaigns—spikes mean copy or frequency problems. Payload design affects background behavior; test killed and locked-device states. Tokens belong server-side with rotation strategies; never treat the client as authoritative for subscription state.

Neweri18n: plurals, RTL, and the strings you forgot OlderReanimated: when the dependency is worth it

Project structure → · App utilities →