This documentation is available as Markdown for AI agents and LLMs. See the full Markdown index or append .md to any documentation URL.
Expo Simulators security model
Edit page
Learn who can create, view, and control an Expo Simulators session, which secrets a session uses, and which URLs grant access with or without an Expo login.
Expo Simulators is a limited-access preview. It is not included with paid or free plans and is currently available only to select partners. Join the waitlist if you are interested in trying it.
Access to an Expo Simulators session comes from two sources: your Expo account role and secret values that the session creates. Your role controls who can create, read, and stop sessions. The secret values, such as controller tokens and preview tokens, let a program or a browser reach the running device. Anyone who has a secret value can use what it unlocks, so treat each one as a password.
This page explains the model. For the exact values and limits, see Expo Simulators security, permissions, and data retention.
Trust boundaries
Account permissions
Expo Simulators checks your role on the account that owns the project:
- To create, stop, or delete a session, you need the Developer role or higher.
- To read a session, you need access to view the project.
A read of a session in progress returns its connection details. Because of this, a person who can view the project can get the controller tokens of a running session.
For CI and services, use a robot user with the Developer role. Store its token in a secret store.
Controller tokens
When a session starts, the controller creates a URL and a token. Expo Simulators stores them encrypted. The REST API returns them only while the session is in progress. The output of eas simulator:get --json can still include the stored values after the session stops. After the session stops, the remote device and its controller endpoints no longer exist.
EAS CLI writes the URL and token to .env.eas-simulator. Keep the file out of Git and out of CI logs and artifacts. While the session runs, the expo.dev session page shows the connection details. It masks the token by default, but anyone who can view the session page can show or copy it.
The browser preview
A browser preview link can be private or public:
New sessions use private links by default. EAS CLI prints the private link, and the Share button in the preview copies it. To use public links, pass --public-link to eas simulator:start, or set publicPreview to true when you create a session with the REST API. Expo Simulators saves this setting with the session.
A session with private links still has a preview token. The REST API returns it as webPreviewToken to any member who can read the session. Keep the preview token secret, even when the session uses private links. Anyone who has the token can make a public link.
If a session starts with --frame-ancestor or --cors-origin, EAS CLI prints the preview host URL with the preview token. For a session that you create with frameAncestors or corsOrigins, the REST API returns the URL as previewApiUrl and the token as webPreviewToken. Web pages on the allowed origins use the token to show the session. Anyone who can read such a page can get the token and control the device. See Show an Expo Simulators session on your own web page.
When a public link opens, the page moves the token out of the address bar. Share a public link only with people who should control the device.
Artifact download URLs
Each artifact has a download URL that contains a random key. The URL does not require an Expo login, so anyone who has the URL can download the file. The URL redirects to a signed storage URL that expires after one hour. If the account is disabled, Expo Simulators blocks the download.
Metro tunnels
For live edits, you start Metro with a public tunnel. The tunnel URL is random, which makes it hard to guess, but the URL does not require authentication. Anyone who has the URL can fetch your JavaScript bundle while the tunnel runs. Stop Metro when the session ends.
Network traffic
By default, all network traffic from the remote device exits from Expo infrastructure. With local egress, device traffic exits from your computer instead: all TCP traffic on Android, and traffic that honors the system proxy on iOS. The local egress client refuses connections to local, private, link-local, and multicast addresses on your network. To let the simulator reach a server on your computer or your network, list each destination as an exact host:port with --egress-allow. See Network traffic and local egress in Expo Simulators.
What Expo Simulators does when a user is deleted
If the user who started a session is deleted, Expo Simulators stops the session.
Common questions
Can another account see my session?
No, unless someone outside the account has one of the session's secret URLs or tokens. A session belongs to an Expo Services project, and Expo Simulators checks permissions on the account that owns the project.
What should I do if a token leaks?
Stop the session. After the session stops, the remote device and its controller endpoints no longer exist, so the token no longer controls a device. Start a new session to get new tokens.
Is the app I install private?
Yes, within the session. The app installs only on the remote device for the session. Anyone who has the controller token, the preview token, or a public preview link can use the app while the session runs. A private preview link also requires access to the project. Anyone who has the download URL of an artifact, such as a screenshot, can download it. See Expo Simulators security, permissions, and data retention for retention.