Where do I store the auth token in a React Native app?

[darrylyoung]

Hi, everyone!

When setting up Sentry for React Native with npx @sentry/wizard -i reactNative -p ios android, config files are generated for iOS and Android (example below). In there, the auth token is stored. Are these files only needed locally, for uploading source maps, or should they be committed to source control and bundled in the (React Native) app? It doesn't feel right putting the auth token in the app, but I'm not sure if it's needed there. I see this comment saying that they're not needed, but it's ~5 years old, so I wanted to check.

Example generated properties file:

defaults.url=https://sentry.io/
defaults.org=org-name
defaults.project=project-name
auth.token=fjdslkfjhdsklfjdfkldsjhfklsdfhldskfhdjkfdshfjksd

Thanks!

[marandaneto]

Dupe of #1096 (comment)

[darrylyoung]

Thanks, @marandaneto. Has the information been documented yet? I'm wondering if I simply missed it.

To confirm, though, it's only needed during build/release, right? That is, I should put it in a SENTRY_AUTH_TOKEN environment variable. Should I then read that from the sentry.properties files, or take a different approach?

[darrylyoung]

Ah, it looks like just setting the SENTRY_AUTH_TOKEN environment variable, and removing auth.token=... from the properties file is all that's needed. If there's anything I'm missing, please let me know. Thanks.

[marandaneto]

No, the issue is still open, PRs are welcome as well.
As my comment states, the SENTRY_AUTH_TOKEN env. var./removing auth.token would do.

[ys-sherzad]

@darrylyoung @marandaneto
I have come across this issue. I'm using react-native-config for environment variables. but even that is not a secure place to add sensitive info. so how do I go about this?