Where do I store the auth token in a React Native app?

[darrylyoung]

Hi, everyone!

When setting up Sentry for React Native with npx @sentry/wizard -i reactNative -p ios android, config files are generated for iOS and Android (example below). In there, the auth token is stored. Are these files only needed locally, for uploading source maps, or should they be committed to source control and bundled in the (React Native) app? It doesn't feel right putting the auth token in the app, but I'm not sure if it's needed there. I see this comment saying that they're not needed, but it's ~5 years old, so I wanted to check.

Example generated properties file:

defaults.url=https://sentry.io/
defaults.org=org-name
defaults.project=project-name
auth.token=fjdslkfjhdsklfjdfkldsjhfklsdfhldskfhdjkfdshfjksd

Thanks!

[marandaneto]

Dupe of #1096 (comment)

[darrylyoung]

Thanks, @marandaneto. Has the information been documented yet? I'm wondering if I simply missed it.

To confirm, though, it's only needed during build/release, right? That is, I should put it in a SENTRY_AUTH_TOKEN environment variable. Should I then read that from the sentry.properties files, or take a different approach?

[darrylyoung]

Ah, it looks like just setting the SENTRY_AUTH_TOKEN environment variable, and removing auth.token=... from the properties file is all that's needed. If there's anything I'm missing, please let me know. Thanks.

[marandaneto]

No, the issue is still open, PRs are welcome as well.
As my comment states, the SENTRY_AUTH_TOKEN env. var./removing auth.token would do.

[ys-sherzad]

@darrylyoung @marandaneto
I have come across this issue. I'm using react-native-config for environment variables. but even that is not a secure place to add sensitive info. so how do I go about this?

[kezike]

No, the issue is still open, PRs are welcome as well. As my comment states, the SENTRY_AUTH_TOKEN env. var./removing auth.token would do.

@marandaneto I interpreted this statement to mean that if I run a release bundle on a machine (whether on my computer or in a CI/CD environment) where the SENTRY_AUTH_TOKEN environment variable is set, then I can remove the auth.token line from sentry.properties, and Sentry will properly pick up the value. Is that correct?

Also, does this only apply to Expo apps or will this work with vanilla React Native apps as well? I ask because I only see reference to this environment variable in the Expo tutorial.

[krystofwoldrich]

Yes @kezike, that's correct SENTRY_AUTH_TOKEN can be used instead of auth.token from sentry.properties.

It works in both bare React Native apps and Expo projects.