# Add Expo Secure Store Keystore

> Add expo-secure-store backed by Android Keystore for storing auth tokens and secrets. Use when the user says 'secure store android', 'keystore android', 'store token secure'.

- **Type:** Skill
- **Install:** `agentstack add skill-khadinakbarlabs-expo-mobile-app-builder-add-expo-secure-store-keystore`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [khadinakbarlabs](https://agentstack.voostack.com/s/khadinakbarlabs)
- **Installs:** 0
- **Category:** [Security](https://agentstack.voostack.com/c/security)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [khadinakbarlabs](https://github.com/khadinakbarlabs)
- **Source:** https://github.com/khadinakbarlabs/expo-mobile-app-builder/tree/main/skills/add-expo-secure-store-keystore
- **Website:** https://khadinakbar.com

## Install

```sh
agentstack add skill-khadinakbarlabs-expo-mobile-app-builder-add-expo-secure-store-keystore
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Add Expo Secure Store (Android Keystore)

Hardware-backed encrypted key-value store. Uses Android Keystore on Android.

## Install
```bash
npx expo install expo-secure-store
```

## Basic use
```tsx
import * as SecureStore from 'expo-secure-store';

await SecureStore.setItemAsync('auth_token', 'jwt...');
const token = await SecureStore.getItemAsync('auth_token');
await SecureStore.deleteItemAsync('auth_token');
```

## Android-specific options

```tsx
// Require biometric or PIN to access (Android 6+)
await SecureStore.setItemAsync('sensitive', 'value', {
  requireAuthentication: true,
  authenticationPrompt: 'Verify to unlock',
});
```

## What it uses under the hood

- Android: EncryptedSharedPreferences + Android Keystore (hardware-backed on TEE/StrongBox devices)
- Each key encrypted with hardware-derived key
- Survives app data clear (but NOT uninstall)

## When NOT to use SecureStore

- Large data (use SQLite encrypted instead)
- Frequently-read values (slow ~5-10ms per read)
- Data that should survive uninstall (use cloud sync)

## When to use

- Auth tokens (access, refresh)
- API keys for the user's session
- Encryption keys for local SQLite
- Sensitive user inputs (PIN, recovery phrase)

## Gotcha: rooted devices

SecureStore relies on Android Keystore. On rooted devices, Keystore can be bypassed. For high-value apps, also implement:
- `add-app-attestation` (Play Integrity API)
- Server-side validation

## Pair with
- `add-supabase-auth-android` for token persistence
- Use MMKV (`add-zustand` persistence) for non-sensitive data

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [khadinakbarlabs](https://github.com/khadinakbarlabs)
- **Source:** [khadinakbarlabs/expo-mobile-app-builder](https://github.com/khadinakbarlabs/expo-mobile-app-builder)
- **License:** MIT
- **Homepage:** https://khadinakbar.com

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-khadinakbarlabs-expo-mobile-app-builder-add-expo-secure-store-keystore
- Seller: https://agentstack.voostack.com/s/khadinakbarlabs
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.