React Native interview question · Most asked
How do you handle authentication tokens in a mobile app?
Summary
Use a short-lived access token and a refresh token, store both in secure storage, attach the access token to API calls, refresh once on 401 (single-flight) and retry, and sign out if the refresh fails.
Longer Answer
Single-flight refresh matters when several requests fail together: without it, parallel refreshes race and, with rotating refresh tokens, invalidate each other. On sign-out, delete tokens, clear cached data and local databases, and unregister push tokens. For social sign-in use the platform SDKs or expo-auth-session with PKCE; never embed client secrets in the app.
Key Points
- Access + refresh tokens in SecureStore.
- Refresh once on 401, then retry.
- Full cleanup on sign-out.
- No secrets in the app bundle.
Deep dive: Mobile Apps with React Native and Expo: Sign-In and Secure Tokens
Explanation
What interviewers look for
Secure storage, refresh race handling and cleanup.
Follow-up questions
- Why can't a mobile app keep an OAuth client secret?
More most-asked React Native questions
- What is React Native, and how does it differ from a hybrid (WebView) app?
- Explain the React Native threading model.
- What is the React Native New Architecture?
- When would you use FlatList instead of ScrollView, and how do you make long lists fast?
- Where should you store data on the device, and what should never go in AsyncStorage?
- How would you make a React Native app work offline?
- A screen in your React Native app is slow. How do you investigate and fix it?
- What can be shipped with an over-the-air (OTA) update, and what can't?