Configuration
The app has two distinct config surfaces — and the difference matters for security, because one of them is compiled into the shipped binary.
Runtime config — root .env (react-native-config)
react-native-config reads the project-root .env and exposes values to both
JS (Config.X) and the native build. These values are bundled into the app
binary, so this file is only for non-secret runtime config, e.g.:
- API base URL,
WEB_APP_URL ENV(controls Sentryenabled/ sample rates)SENTRY_DSN(a DSN is a public client key — fine to ship)INACTIVITY_TIMEOUT_MINUTES
[!WARNING] Never put a build/upload secret (App Store API key, Play JSON key, Sentry auth token, keystore passwords) in the root
.env. It’s compiled into the app and tracked in git in this project.
Build-time secrets — fastlane/.env
Fastlane auto-loads fastlane/.env (dotenv) into the build environment, and it’s
gitignored. This is where build/upload credentials go:
| Variable | Used for |
|---|---|
APP_STORE_CONNECT_API_KEY_KEY_ID / _ISSUER_ID / _KEY_FILEPATH | iOS upload auth |
GOOGLE_PLAY_JSON_KEY | Play Store upload |
ANDROID_APP_PRIVATE_KEY / ANDROID_APP_ALIAS / store + key passwords | Android release signing |
SENTRY_AUTH_TOKEN | Source-map upload (org token, org:ci scope) |
fastlane/.env.example is the committed template — copy it to fastlane/.env
and fill in real values.
[!NOTE] In CI, set these as pipeline secrets/env vars rather than relying on the file. For a one-off non-Fastlane local release build,
exportthe needed vars in that shell (fastlane/.envis only loaded by Fastlane).
Quick reference: where does X go?
- Runtime, non-secret, needed by the app at runtime → root
.env. - Build/upload secret, never shipped →
fastlane/.env(local) or CI secret. - Sentry DSN → root
.env(public). Sentry auth token →fastlane/.env/ CI.