This documentation is available as Markdown for AI agents and LLMs. See the full Markdown index or append .md to any documentation URL.

Learn how to restrict who can interact with sensitive Expo Services resources, such as the update channel your production app uses.

You can mark some Expo Services resources as protected. Only members with the Release Manager, Admin, or Owner role can take protected actions on these resources. This is similar to the concept of protected branches on Git hosting services like GitHub, where only members with elevated permissions can push to them.

Protected channels

When you protect an Expo Update channel, only Release Managers, Admins, and Owners can:

• Publish updates to a branch the channel points to. This includes eas update, republishing, and rollbacks.
• Rename or delete a branch the channel points to.
• Edit the channel. This includes changing which branch it points to, starting or ending a rollout, and pausing or resuming updates.
• Delete the channel.
• Remove protection from the channel.

Members with other roles can still view a protected channel and its branches. Developers can publish to branches that no protected channel points to.

Protect or unprotect a channel

Only Release Managers, Admins, and Owners can run these commands. Run either command without a channel name to pick one from a list. Both commands require EAS CLI 24.0.0 or later.

When you transfer a project to another account, Expo Services removes protection from all of its channels. Protect them again in the new account if needed.

Expo Workflows and protected channels

Expo Workflows jobs run with at most Developer-level permissions. Jobs therefore can't interact with protected channels, such as publishing to a branch that a protected channel points to or starting or completing a rollout on one, even when the run is started by a Release Manager, Admin, Owner, or robot with one of those roles. We're exploring a way to let you opt specific jobs into higher permissions.

If your workflow interacts with a protected channel, remove protection from that channel with eas channel:unprotect, or run those commands, such as eas update, outside Expo Workflows with an access token for a user or robot with the Release Manager role or higher.

Protected credentials

When you turn on credentials protection for an account, only Release Managers, Admins, and Owners can view, create, change, or delete build, submission, and push credentials stored on Expo servers. Protection applies to every project in the account. Developers lose access to these credentials.

To turn credentials protection on or off, go to Credentials in your account and use the Protect credentials switch. Only Admins and Owners can change this setting.

Expo Workflows and protected credentials

Expo Workflows jobs run with at most Developer-level permissions. When credentials protection is on, builds and submissions that run in workflows or from GitHub can fail when they use credentials stored on Expo servers.

Coming soon

Protection for other resource types is in progress.