This documentation is available as Markdown for AI agents and LLMs. See the full Markdown index or append .md to any documentation URL.

Learn who can start and view Expo Simulators sessions, how to protect session tokens and preview links, and how long EAS keeps recordings, screenshots, and logs.

Expo Simulators is a limited-access preview. It is not included with paid or free plans and is currently available only to select partners. Join the waitlist if you are interested in trying it.

An Expo Simulators session belongs to an EAS project. Account roles control who can start, view, and stop sessions. Session tokens and preview links give direct access to the remote device, so treat them as secrets.

For how long EAS keeps job logs and artifacts, see Retention and deletion.

For how the parts connect, see Expo Simulators security model.

Permissions

Read access to a session includes its connection details while the session runs. A member with the View Only role can read the controller tokens of a running session through the REST API or the Expo GraphQL API.

For automation, create a robot user with the Developer role. Developer is the minimum role that can create and stop sessions.

If the user who started a session is deleted, EAS stops the session.

Session tokens

The connection details of a session include tokens for the controller. EAS stores the connection details encrypted.

The REST API returns remoteConfig only while the session is in-progress. After the session stops or fails, remoteConfig is null. EAS CLI (eas simulator:get) and the Expo GraphQL API still return the stored connection details after the session stops. By then, the remote device and its controller endpoints no longer exist. Session responses include Cache-Control: private, no-store and Pragma: no-cache.

The session page on expo.dev masks the token values by default. Anyone who can view the session page can reveal or copy them.

Browser preview links

The browser preview does not require an Expo login. When the preview is gated, the link contains a session token, and the page needs that token to show the preview.

Treat a preview link as a secret. Anyone with the link can see and use the simulator while the session runs. Share it only with the people who need it, and set a maximum duration on the session.

Network access

• Metro tunnel: a Metro URL from npx expo start --tunnel is public while the tunnel runs. It does not require authentication. Stop Metro when you finish.
• Default egress: without local egress, all traffic from the simulator exits from EAS infrastructure.
• Local egress: with --egress local, device traffic exits from your computer: all TCP traffic on Android, and traffic that honors the system proxy on iOS. The egress client refuses local, private, link-local, and multicast addresses. Only the exact host:port entries that you pass with --egress-allow are exceptions.

See Network traffic and local egress in Expo Simulators.

Data that EAS stores

One artifact can be up to about 5 GiB.

EAS records the request origin and agent identifiers that a client sends when it creates a session. EAS uses these values for analytics only, not for authorization.

Artifact downloads

eas simulator:get --json returns a downloadUrl for each artifact. The download URL contains a long random key and does not require authentication. Treat it as a secret.

The downloadUrl does not change. Each request to it redirects to a new signed storage URL, which expires after one hour. To download the artifact again later, request the same downloadUrl again.

Retention and deletion

• Job logs on the session page are available for 30 days after the session is created.
• EAS keeps session artifacts, such as screenshots and recordings, until you delete the session.
• You can delete a session after it finishes. You cannot delete a running session.
• When you delete a session, EAS also deletes its recordings and screenshots. You cannot undo this.
• When you delete the project, EAS also deletes its sessions and their artifacts.

Common questions