Environment variables
Learn how to configure environment variables.
Environment variables are defined in the .env
file in the root of the repository and in the root of the apps/mobile
package.
- Shared environment variables: Defined in the root
.env
file. These are shared between environments (e.g., development, staging, production) and apps (e.g., web, mobile). - Environment-specific variables: Defined in
.env.development
and.env.production
files. These are specific to the development and production environments. - App-specific variables: Defined in the app-specific directory (e.g.,
apps/web
). These are specific to the app and are not shared between apps. - Build environment variables: Not stored in the
.env
file. Instead, they are stored ineas.json
file used to build app on Expo Application Services. - Secret keys: They're not stored on mobile side, instead they're defined on the web side.
Shared variables
Here you can add all the environment variables that are shared across all the apps.
To override these variables in a specific environment, please add them to the specific environment file (e.g. .env.development
, .env.production
).
App-specific variables
Here you can add all the environment variables that are specific to the app (e.g. apps/mobile
).
You can also override the shared variables defined in the root .env
file.
EXPO_PUBLIC_ prefix
To make environment variables available in the Plasmo app code, you need to prefix them with EXPO_PUBLIC_
. They will be injected to the code during the build process.
Only environment variables prefixed with EXPO_PUBLIC_
will be injected.
Build environment variables
To allow your app to build properly on EAS you need to define your environment variables in eas.json
file under corresponding profile (e.g. preview
or production
).
Here is an example of correctly filled eas.json
for one of the profiles:
Then, when you trigger production
build correct environment variables will be injected to your mobile app code ensuring that everything is working correctly.
Secret keys
Secret keys and sensitive information are to be never stored on the mobile app code.
What does this mean?
It means that you will need to add the secret keys to the web app, where the API is deployed.
The mobile app should only communicate with the backend API, which is typically part of the web app. The web app is responsible for handling sensitive operations and storing secret keys securely.
See web documentation for more details.
This is not a TurboStarter-specific requirement, but a best practice for security for any application. Ultimately, it's your choice.
Last updated on