The TestFlight curse strikes again. Your Expo app works perfectly in development. The login flow is smooth. Users tap a link, the app opens, they're logged in. Beautiful. Then you submit to TestFlight. Suddenly: - Login links open Safari instead of your app - Deep links work sometimes, not others - Users report "it just spins forever" - You have no idea why This is the universal Expo authentication experience. Let's fix it. ## Why TestFlight Breaks Auth ### The Development Environment Lie In Expo Go or a development build, deep links are forgiving: - Custom schemes (`myapp://`) just work - No verification required - Instant updates when you change config In TestFlight: - Universal Links require server verification - Custom schemes need proper entitlements - Link handling is cached aggressively - Apple reviews your associated domains ### The OAuth Redirect Problem OAuth providers add another layer: - Callback URLs must be pre-registered - Some providers block mobile redirects - The OAuth state parameter can get lost - WebView-based OAuth often fails silently ### The Timing Issue TestFlight users don't have your app pre-installed when they click the first login link. The flow becomes: 1. User taps link 2. iOS doesn't recognize the scheme (app not installed yet) 3. Link opens in Safari 4. User installs app from TestFlight 5. User needs to tap the link again 6. Now it works (maybe) ## The Turalogin Solution Email-based authentication sidesteps most of these issues. The flow: 1. User enters email in your app 2. Your backend calls Turalogin 3. User receives email with login link 4. User taps link (in Apple Mail or Gmail) 5. iOS routes to your app 6. Your app verifies the token 7. Session created The key difference: email apps handle the link, not Safari. And you control the entire flow. ## Complete Expo Setup ### 1. Configure app.json ```json { "expo": { "name": "My App", "slug": "my-app", "scheme": "myapp", "ios": { "bundleIdentifier": "com.example.myapp", "associatedDomains": [ "applinks:myapp.com", "applinks:www.myapp.com" ] }, "android": { "package": "com.example.myapp", "intentFilters": [ { "action": "VIEW", "autoVerify": true, "data": [ { "scheme": "https", "host": "myapp.com", "pathPrefix": "/auth" }, { "scheme": "myapp" } ], "category": ["BROWSABLE", "DEFAULT"] } ] } } } ``` ### 2. Host the Apple App Site Association Create `/.well-known/apple-app-site-association` on your domain: ```json { "applinks": { "apps": [], "details": [ { "appIDs": ["TEAMID.com.example.myapp"], "components": [ { "/": "/auth/*", "comment": "Auth verification routes" } ] } ] } } ``` ### 3. Handle Deep Links in Your App ```typescript // App.tsx import * as Linking from 'expo-linking'; import { useEffect, useState } from 'react'; import { useRouter } from 'expo-router'; export default function App() { const router = useRouter(); const [initialUrl, setInitialUrl] = useState(null); useEffect(() => { // Handle link when app is already open const subscription = Linking.addEventListener('url', ({ url }) => { handleAuthLink(url); }); // Handle link that opened the app Linking.getInitialURL().then((url) => { if (url) { setInitialUrl(url); handleAuthLink(url); } }); return () => subscription.remove(); }, []); const handleAuthLink = async (url: string) => { const parsed = Linking.parse(url); if (parsed.path === 'auth/verify' && parsed.queryParams?.token) { try { const response = await fetch(`${API_URL}/auth/verify`, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ token: parsed.queryParams.token }), }); if (response.ok) { const { email, sessionToken } = await response.json(); await SecureStore.setItemAsync('session', sessionToken); router.replace('/home'); } else { router.replace('/login?error=invalid'); } } catch (error) { router.replace('/login?error=network'); } } }; return ; } ``` ### 4. Create the Login Screen ```typescript // app/login.tsx import { useState } from 'react'; import { View, TextInput, Button, Text } from 'react-native'; export default function Login() { const [email, setEmail] = useState(''); const [sent, setSent] = useState(false); const [error, setError] = useState(''); const handleLogin = async () => { try { const response = await fetch(`${API_URL}/auth/login`, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ email }), }); if (response.ok) { setSent(true); } else { setError('Failed to send login email'); } } catch { setError('Network error'); } }; if (sent) { return ( Check your email! Tap the link to log in. ); } return (