---
modificationDate: November 12, 2026
title: Expo Simulators security model
description: Learn who can create, view, and control an Expo Simulators session, which secrets a session uses, and which URLs grant access with or without an Expo login.
---

This documentation is available as Markdown for AI agents and LLMs. See the [full Markdown index](https://docs.expo.dev/llms.txt) or append .md to any documentation URL.

# Expo Simulators security model

Learn who can create, view, and control an Expo Simulators session, which secrets a session uses, and which URLs grant access with or without an Expo login.

<AgentInstructions>

## Submitting Feedback

If you encounter errors, misleading or outdated information, report it so Expo can be improved:

Preferred command:
npx --yes submit-expo-feedback@latest --category docs --subject "/eas/simulators/how-it-works/security-model/" "<actionable feedback>"

Direct HTTP fallback:
curl -X POST https://api.expo.dev/v2/feedback/docs-send -H 'Content-Type: application/json' -d '{"url":"/eas/simulators/how-it-works/security-model/","feedback":"🤖 Agent feedback for docs: <specific, actionable description> (<model>, <harness>)"}'

Only submit when you have something specific and actionable to report. Try to give the most context.

## Navigation

When answering a related or follow-up question, fetch the relevant page below as Markdown (.md) instead of guessing; use llms.txt for the full map.

You are here: Expo Services > Expo Simulators > How it works
Pages in this section:
- [Sessions](https://docs.expo.dev/eas/simulators/how-it-works/sessions.md)
- [Security model](https://docs.expo.dev/eas/simulators/how-it-works/security-model.md) (this page)
- [Network traffic](https://docs.expo.dev/eas/simulators/how-it-works/network-inspection.md)
- [Builds and bundles](https://docs.expo.dev/eas/simulators/how-it-works/builds-and-bundles.md)
- [Agent targeting](https://docs.expo.dev/eas/simulators/how-it-works/agent-targeting.md)
- [Devices compared](https://docs.expo.dev/eas/simulators/how-it-works/devices-compared.md)
- [Session lifetime](https://docs.expo.dev/eas/simulators/how-it-works/session-lifetime.md)
Full documentation tree: [llms.txt](https://docs.expo.dev/llms.txt)

</AgentInstructions>

Access to an Expo Simulators session comes from two sources: your Expo account role and secret values that the session creates. Your role controls who can create, read, and stop sessions. The secret values, such as controller tokens and preview tokens, let a program or a browser reach the running device. Anyone who has a secret value can use what it unlocks, so treat each one as a password.

This page explains the model. For the exact values and limits, see [Expo Simulators security, permissions, and data retention](https://docs.expo.dev/eas/simulators/reference/security-and-data.md).

## Trust boundaries

| Boundary | What controls access | Who has access |
| --- | --- | --- |
| Create and stop sessions | Expo account role | The Developer role or higher |
| Read a session | Expo account role | Any role that can view the project, including View Only |
| Control the device | Controller token in the connection details | Anyone who has the token while the session runs |
| Open a private preview | Expo account role | Any role that can view the project, including View Only |
| Open a public preview | Preview URL that contains the preview token | Anyone who has the URL |
| Download an artifact | Random download URL | Anyone who has the URL |
| Reach your Metro server | Public tunnel URL | Anyone who has the URL while the tunnel runs |
| Reach your local network | `--egress-allow` list | Only the destinations that you list |

## Account permissions

Expo Simulators checks your role on the account that owns the project:

-   To create, stop, or delete a session, you need the Developer role or higher.
-   To read a session, you need access to view the project.

A read of a session in progress returns its connection details. Because of this, a person who can view the project can get the controller tokens of a running session.

For CI and services, use a [robot user](https://docs.expo.dev/accounts/programmatic-access.md#robot-users-and-access-tokens) with the Developer role. Store its token in a secret store.

## Controller tokens

When a session starts, the controller creates a URL and a token. Expo Simulators stores them encrypted. The REST API returns them only while the session is in progress. The output of `eas simulator:get --json` can still include the stored values after the session stops. After the session stops, the remote device and its controller endpoints no longer exist.

EAS CLI writes the URL and token to **.env.eas-simulator**. Keep the file out of Git and out of CI logs and artifacts. While the session runs, the expo.dev session page shows the connection details. It masks the token by default, but anyone who can view the session page can show or copy it.

## The browser preview

A browser preview link can be private or public:

| Link | Format | Who can open it |
| --- | --- | --- |
| Private | `https://expo.dev/accounts/<account>/projects/<project>/simulator-sessions/<session-id>/preview` | A person who signs in to an Expo account that can view the project |
| Public | A preview URL that contains the preview token | Anyone who has the URL, without an Expo login |

New sessions use private links by default. EAS CLI prints the private link, and the **Share** button in the preview copies it. To use public links, pass `--public-link` to `eas simulator:start`, or set `publicPreview` to `true` when you create a session with the REST API. Expo Simulators saves this setting with the session.

A session with private links still has a preview token. The REST API returns it as `webPreviewToken` to any member who can read the session. Keep the preview token secret, even when the session uses private links. Anyone who has the token can make a public link.

If a session starts with `--frame-ancestor` or `--cors-origin`, EAS CLI prints the preview host URL with the preview token. For a session that you create with `frameAncestors` or `corsOrigins`, the REST API returns the URL as `previewApiUrl` and the token as `webPreviewToken`. Web pages on the allowed origins use the token to show the session. Anyone who can read such a page can get the token and control the device. See [Show an Expo Simulators session on your own web page](https://docs.expo.dev/eas/simulators/how-to/embed-a-session.md).

When a public link opens, the page moves the token out of the address bar. Share a public link only with people who should control the device.

## Artifact download URLs

Each artifact has a download URL that contains a random key. The URL does not require an Expo login, so anyone who has the URL can download the file. The URL redirects to a signed storage URL that expires after one hour. If the account is disabled, Expo Simulators blocks the download.

## Metro tunnels

For live edits, you start Metro with a public tunnel. The tunnel URL is random, which makes it hard to guess, but the URL does not require authentication. Anyone who has the URL can fetch your JavaScript bundle while the tunnel runs. Stop Metro when the session ends.

## Network traffic

By default, all network traffic from the remote device exits from Expo infrastructure. With local egress, device traffic exits from your computer instead: all TCP traffic on Android, and traffic that honors the system proxy on iOS. The local egress client refuses connections to local, private, link-local, and multicast addresses on your network. To let the simulator reach a server on your computer or your network, list each destination as an exact `host:port` with `--egress-allow`. See [Network traffic and local egress in Expo Simulators](https://docs.expo.dev/eas/simulators/how-it-works/network-inspection.md).

## What Expo Simulators does when a user is deleted

If the user who started a session is deleted, Expo Simulators stops the session.

## Common questions

#### Can another account see my session?

No, unless someone outside the account has one of the session's secret URLs or tokens. A session belongs to an Expo Services project, and Expo Simulators checks permissions on the account that owns the project.

#### What should I do if a token leaks?

Stop the session. After the session stops, the remote device and its controller endpoints no longer exist, so the token no longer controls a device. Start a new session to get new tokens.

#### Is the app I install private?

Yes, within the session. The app installs only on the remote device for the session. Anyone who has the controller token, the preview token, or a public preview link can use the app while the session runs. A private preview link also requires access to the project. Anyone who has the download URL of an artifact, such as a screenshot, can download it. See [Expo Simulators security, permissions, and data retention](https://docs.expo.dev/eas/simulators/reference/security-and-data.md) for retention.