Expo & EAS access for mobile builds

How Expo organisations and roles work, what EAS Build does with signing credentials, and why app store ownership is the thing to get right first.

Expo is a framework and toolchain for building React Native mobile apps. EAS (Expo Application Services) handles the parts that are painful to do yourself: compiling iOS and Android binaries in the cloud, managing signing credentials, and submitting to the app stores.

Quick summary

Create an Expo organisation (not a personal account) and invite people to it with the lowest role that works. EAS stores your signing credentials — the certificates and keystore that prove an app is genuinely yours. Most important of all: the Apple Developer and Google Play accounts must be registered to your business, not to an agency or an individual.

Get app store ownership right first

Everything else on this page is recoverable. This part often isn't.

The store accounts are the real asset

Your app's identity, its reviews, its ranking history, and its existing installs live in your Apple Developer and Google Play accounts. If those are registered to an agency or a departed employee, moving the app can mean a slow transfer process — or in the worst case publishing a brand-new listing and losing every review and install.

Register the Apple Developer Program membership to your organisation, and the Google Play Developer account to your company. Use a shared, monitored email address for both.

Apple's organisation enrolment asks for more than a card: your business has to be a legal entity that can contract with Apple (no DBAs or trade names), most organisations need a D-U-N-S Number so Apple can verify the entity, the person enrolling must have authority to sign for the business, and you need a working website on your own domain. Check whether you already have a D-U-N-S Number before you start — requesting one is an extra step, so begin early.

Expo organisations and roles

Create an organisation, rather than working under someone's personal Expo account. Expo's own advice is to always use an Organization account for team work; a personal account is for one person's own projects. If a project already started in a personal account, that account can be converted into an organisation from its User settings.

Invite members from Members under Organization settings in the EAS dashboard at expo.dev.

Assign roles. Expo has five, and each one can do everything the ones below it can. Owner can take any action, including deleting projects. Admin controls most account settings, including paid services, other people's permissions and programmatic access. Release Manager manages protected channels, which are still in private beta — until an account has them, this role has the same access as Developer. Developer can create projects, make builds, release updates and manage credentials. Viewer can only look at projects, not change them. Only Owners and Admins can invite people, and only an Owner can grant the Owner role — so keep Owner with your business.

Enable two-factor authentication. An account that can ship an app update to your users deserves it.

Signing credentials

Every mobile app is cryptographically signed. The store verifies the signature to confirm an update genuinely comes from the same publisher.

iOS — distribution certificates and provisioning profiles, issued through your Apple Developer account.
Android — an upload keystore, and an app signing key.

EAS can generate and store these for you, which is convenient and means they're backed up centrally rather than on one laptop.

Losing the Android signing key used to be fatal

Historically, an Android app signed with a lost key could never be updated — only republished as a new listing. App Signing by Google Play changes that: Google holds the app signing key on its side, you upload builds signed with an upload key instead, and if that upload key is lost or compromised you can ask Google Play support to reset it. Make sure Play App Signing is in use, and keep your own encrypted backup of credentials regardless.

Credentials EAS manages for you can be pulled back down with the eas credentials command, which also uploads local credentials the other way. Download them periodically and store the export in your password manager or secrets vault — it is part of your disaster recovery, not an optional extra.

Builds, submissions, and updates

EAS Build compiles your app in the cloud, so you don't need a Mac to produce an iOS build.
EAS Submit uploads the finished binary to App Store Connect or Google Play.
EAS Update sends an app's non-native pieces — JavaScript, styling, images — over the air, so a fix reaches users on their next app launch instead of waiting for a store release. Changes to native code or native dependencies still need a new build. And the store rules still apply: Expo's own guidance is that updates must follow App Store and Play Store policy, which usually means a change to how your app behaves is expected to go through review.

Build capacity is metered. The free plan includes a limited number of low-priority builds each month, and free accounts can't run up overage charges. Paid plans come with monthly build credits; once those are used up, further builds are billed as usage rather than blocked. Check Expo's own pricing page for what your plan includes.

Common questions

Can we move an app to a different Expo account later?

Yes, with two conditions. A project can only be moved by someone who holds the Owner or Admin role on both the source and the destination account (Expo's escrow guidance asks for Owner on the source), and Expo limits how many times a given project can be transferred. Where you don't have a role on the destination account, Expo's documented workaround is an escrow organisation: transfer into a new organisation, grant the recipient Owner there, and let them move it on from that account. Either way this is much easier than transferring the underlying app store listings, which is why the store accounts matter more.

Do we need an Apple Developer account even for testing?

For builds that go to real iOS devices or to the App Store — TestFlight included — yes. Expo's own note is that you can try EAS Build without any store membership if you target the iOS Simulator or an Android device, which is useful for a first look but not for handing anything to a tester on an iPhone. The Apple membership is charged per membership year; a Google Play Developer account is a one-off registration fee. Check Apple's and Google's own pages for current amounts.

What are the environment variables for a mobile app?

EAS supports build-time environment variables and secrets. Be careful: anything bundled into the app ships to every user's device and can be extracted, so a mobile app can hold publishable keys but never secret ones. Anything sensitive must live behind your own API. See environment variables & secrets.

How long does app review take?

Often quickly, but neither store promises it. Google Play warns that certain apps and certain developer accounts get extended reviews, which can run to seven days or longer in exceptional cases, and it doesn't say in advance which ones. Rejections happen too, and Apple's review guidelines are explicit about several things that are easy to miss: every app must link to a privacy policy, an app that lets people create an account must also let them delete it from inside the app, and each permission prompt has to explain what the data is for. Never schedule a launch that depends on same-day approval.

Need a hand?

If you're stuck, email support@chykalophia.com and we'll help. Include your website address and a screenshot if you can.

Learn more

Expo Documentation — Expo Application Services
Expo Documentation — Account types (organisations, member roles, project transfers)

Expo & EAS access for mobile builds

On this page