eas build

335 notes in this subject, read out of this brain and free to use. This is page 1 of 6.

EAS CLI commands with access tokens require linked EAS project

Commands run with an access token require the project to already be linked to an EAS project. If extra.eas.projectId is not set in the app config, commands such as eas build fail with an 'EAS project not configured' error. To configure it, run EXPO_TOKEN=my_token eas init --force --non-interactive first.

First step: set up credentials as local credentials

The first step for using existing credentials is to set them up as local credentials in credentials.json, regardless of which credential management option you choose.

Two ways to supply signing credentials to EAS Build

EAS Build provides two options for supplying app signing credentials to build jobs: automatically managed credentials, where EAS hosts the credentials and manages sharing with teammates who have necessary permissions, or local credentials, where you create a credentials.json file in your project that points to your keystore for Android and/or provisioning profile and distribution certificate for iOS, along with associated passwords, which is uploaded from your local machine at build time and disposed of after the build job completes.

Upload credentials.json to EAS for managed hosting

After configuring the credentials.json file, you can run 'eas credentials', choose a platform, and select 'Update credentials on Expo servers with values from credentials.json' to upload them to be hosted and managed by EAS.

EAS Submit with Federated Apple Developer accounts

EAS Submit uses the ASC API token for submitting to TestFlight. If you have a Federated Apple Developer account, you can follow the standard EAS Submit setup, which lets you automatically submit your builds using 'eas build --auto-submit'.

EAS credentials command to create and sync app signing credentials

With EAS CLI, credentials can be created and synced automatically with the Apple Developer account by running 'eas credentials' after logging in with 'eas login'. The CLI will prompt for selecting a build profile to use for the EAS Build. For production builds, create a distribution provisioning profile. For developer builds, create an ad hoc provisioning profile.

Team developers can skip Apple account login in EAS Build

When running 'eas build -p ios', team developers without Apple Developer account access can press N to skip logging into an Apple Developer account. The EAS Build will use the last provisioning profile and other credentials that were previously updated by the Apple Developer account's authorized user in the organization's Expo account.

Required iOS app signing credentials for EAS Build

When using EAS Build to create iOS device builds, the following credentials are required: Distribution signing certificate (required to sign development and release builds that are installed on an iOS device), Ad hoc provisioning profile (required to sign builds that are installed on a device outside of the Apple App Store), Distribution provisioning profile (required to sign the build that is submitted to the Apple App Store), and Push key (required when using a push notification service).

Federated Apple Developer account limitations for EAS Build

EAS CLI can only accept an Apple account's email and password to login into your Apple Developer account. You cannot login into a Federated Apple Developer account to update the distribution certificate or provisioning profile. If build credentials do not require changes, you can skip logging in and proceed with the build using currently uploaded credentials. Alternatively, you can provide an Apple Store Connect (ASC) API token with Admin access to check and update Apple credentials when running 'eas build' command.

Provisioning profile update requirements

The associated provisioning profile needs to be updated if iOS capabilities such as entitlements are added or removed, or at the annual expiry of the profile. This step is handled by the Apple Developer account's authorized user.

Apple Developer account roles and app signing credential generation

On individual Apple Developer accounts, only the Account Holder role can generate app signing credentials such as certificates, identifiers, and provisioning profiles. On organization Apple Developer accounts, both Account Holder and Admin roles can always generate app signing credentials. The App Manager role can generate credentials when the user has 'Access to Certificates, Identifiers, and Profiles' enabled in their App Store Connect user permissions.

Uploading pre-generated Apple credentials to EAS

Pre-generated distribution certificates and provisioning profiles can be added by any EAS user with Developer or higher permissions using 'eas credentials' or through the EAS dashboard under Select your project > Project settings > Configuration > Credentials. When uploading credentials, the .p12 and .mobileprovision files are required, along with any passwords set when generating the distribution certificate.

Export Android keystore to pem format using keytool

To export an Android keystore to pem format: (1) Find the key alias in your credentials.json file under the 'keyAlias' key. (2) Use keytool to export the certificate with: keytool -export -rfc -alias alias_from_step_1 -file certificate_for_google.pem -keystore ./path/to/keystore.jks

Three primary iOS credentials required

The three primary iOS credentials, all associated with your Apple Developer account, are: Distribution Certificate, Provisioning Profiles, and Push Notification Keys.

How to reset Android upload key: download credentials from EAS

To sync your Expo keystore with Google after losing it, run 'eas credentials' command, select Android and your profile, select 'credentials.json: Upload/Download credentials between EAS servers and your local json', then select 'Download credentials from EAS to credentials.json'. Your application's keystore should be kept private and never checked into your repository. Debug keystores are the only exception.

iOS Distribution Certificate: one per account, used for all apps

The distribution certificate is about the developer and not about any particular app. You may only have one distribution certificate associated with your Apple Developer account, and it will be used for all of your apps. If this certificate expires, your apps in production will not be affected, but you will need to generate a new certificate if you want to upload new apps to the App Store or update any existing apps. Deleting a distribution certificate has no effect on any apps already on the App Store. You can clear the distribution certificate Expo currently has stored by running 'eas credentials'.

App signing by Google Play is default behavior

When you upload your first release to Google Play, you will see a notice about 'App signing by Google Play' and 'Google is protecting your app signing key'. This is the default behavior and requires no action except to press 'Continue'.

Android app signing: upload certificate vs app signing certificate

Google requires all Android apps to be digitally signed with a certificate before installation or update. Historically, apps were signed with an app signing certificate. Now you can opt-in to App Signing by Google Play and upload an APK signed with an upload certificate, and Google Play will automatically replace it with the app signing certificate. If the upload keystore is lost or compromised, you can contact Google Play support to reset the key. From EAS build's perspective, there is no difference between upload certificate or app signing key—eas build will generate an .apk or .aab signed with the keystore currently associated with your application.

EAS Build requires signed applications for store distribution

EAS Build can generate signed or unsigned applications. However, to distribute your application through the stores, the application must be signed.

iOS Provisioning Profiles: app-specific, expire after 12 months

Each iOS provisioning profile is app-specific, meaning you will have a provisioning profile for every app you submit to the App Store. Provisioning profiles are associated with your distribution certificate, so if that is revoked or expired, you'll need to regenerate the app's provisioning profile as well. Revoking your app's provisioning profile will not affect apps already on the App Store. Provisioning profiles expire after 12 months, but this won't affect apps in production. You will just need to create a new one the next time you build your app by running 'eas build -p ios' or manually with 'eas credentials'.

iOS Push Notification Keys: maximum 2 per account, not app-specific

Apple Push Notification Keys (APN keys) allow associated apps to send and receive push notifications. You can have a maximum of 2 APN keys associated with your Apple Developer account, and a single key can be used with any number of apps. If you revoke an APN key, all apps that rely on that key will no longer be able to send or receive push notifications until you upload a new key. Uploading a new APN key will not change your users' Expo Push Tokens. Push notification keys do not expire. You can clear the APN key Expo currently has stored by running 'eas credentials'.

Clearing credentials with eas credentials only removes from Expo servers

When you use the 'eas credentials' command to delete your credentials, this only removes those credentials from Expo's servers. It does not delete the credentials from Apple's perspective. To fully delete your credentials, you need to do so from the Apple Developer Console.

iOS credentials summary table

iOS Credentials Summary: | Credential | Limit per account | App-specific? | Can be revoked with no production side effects? | Used at | |---|---|---|---|---| | Distribution Certificate | 2 | No | Yes | Build time | | Push Notification Key | 2 | No | No | Run time | | Provisioning Profile | Unlimited | Yes | Yes | Build time |

Local credentials in CI with base64 encoding

To use local credentials in CI, encode credentials.json to base64 using 'base64 credentials.json', set the output as a CREDENTIALS_JSON_BASE64 environment variable, and restore it in CI with 'echo $CREDENTIALS_JSON_BASE64 | base64 -d > credentials.json'. Similarly encode keystore, provisioning profile, and distribution certificate files, and ensure all credentials exist at the same file system locations as defined in credentials.json.

credentials.json must be git-ignored

You must add credentials.json and all credential files to .gitignore to avoid accidentally committing them to the repository and leaking secrets.

credentials.json file location and purpose

The credentials.json file must be created at the root of your project. It is used by EAS Build when local credentials are configured to access relative paths to credentials on your local file system and their associated passwords.

Android keystore configuration in credentials.json

Android keystore credentials are configured under the 'android.keystore' object with the following fields: keystorePath (string, path to keystore file), keystorePassword (string), keyAlias (string), and keyPassword (string). Both relative paths to project root and absolute paths are supported.

credentialsSource build profile setting

In eas.json build profiles, set 'credentialsSource' to either 'local' (to use credentials.json) or 'remote' (to use credentials from EAS servers). If not specified, it defaults to 'remote'.

iOS multi-target app extensions credentials configuration

For iOS apps using App Extensions (Share Extension, Widget Extension, etc.), you must provide separate credentials for each target in credentials.json. Each target is identified by an individual bundle identifier. Configure credentials under 'ios' with the target name as the key, containing provisioningProfilePath and distributionCertificate fields. Multiple targets can share the same distribution certificate or use separate certificates.

iOS credentials directory recommendation

It is recommended to keep iOS Distribution Certificate and Provisioning Profile in the ios/certs directory within your project.

Android keystore file directory recommendation

It is recommended to keep Android keystores in the android/keystores directory within your project.

Generate Android keystore with keytool

Generate an Android keystore using keytool with the command: keytool -genkey -v -storetype JKS -keyalg RSA -keysize 2048 -validity 10000 -storepass KEYSTORE_PASSWORD -keypass KEY_PASSWORD -alias KEY_ALIAS -keystore release.keystore -dname "CN=com.expo.your.android.package,OU=,O=,L=,S=,C=US". Replace KEYSTORE_PASSWORD, KEY_PASSWORD, KEY_ALIAS, and com.expo.your.android.package with your values.

iOS credentials configuration in credentials.json

iOS credentials are configured under the 'ios' object with the following fields: provisioningProfilePath (string, path to .mobileprovision file) and distributionCertificate object containing path (string, path to .p12 file) and password (string). Both relative paths to project root and absolute paths are supported.

Configure Android push notifications with FCM

To set up Android push notification credentials for EAS Build, run 'eas credentials', select 'Android', then 'Push Notifications: Manage your FCM Api Key', and choose the appropriate option to set up the key.

Credentials stored on EAS servers

Generated app signing credentials are stored on EAS servers and can be reused on subsequent builds.

EAS Build prompts credential generation on first build

When you run 'eas build', you will be prompted to generate credentials if you have not done so already. Follow the simple instructions to generate your credentials. On subsequent builds of your app, these credentials will be re-used unless you specify otherwise.

iOS credentials require Apple Developer Program membership

Generating your iOS credentials (distribution certificate, provisioning profile, and push key) requires you to sign in with an Apple Developer Program membership.

Push notification credentials are separate from app signing

Other credentials such as FCM API Key and Apple Push Key are needed to send push notifications, but they are not involved in app signing.

Project collaboration requirement for team credential sharing

To give team members access to perform builds, ensure that your project is configured for collaboration and add teammates through your EAS dashboard. They will be able to run 'eas build' seamlessly if they have sufficient permissions.

Team members can run builds with Expo accounts after iOS credentials generated

After you have generated your iOS credentials, it is no longer necessary to have access to the Apple Developer team to start a build. Collaborators can start new iOS builds with only their Expo accounts, provided they have sufficient permissions and your project is configured for collaboration.

Configure iOS push notifications with eas credentials command

To set up iOS Push Notifications key, run 'eas credentials', select 'iOS', then 'Push Notifications: Manage your Apple Push Notifications Key', and choose the appropriate option to set up the key. EAS CLI will also ask you to set it up during the next 'eas build' run if you haven't set it up yet.

App signing requires digital credentials from EAS

For an app to be distributed in an app store, it needs to be digitally signed with credentials such as a keystore or a distribution certificate. This certifies the source of the app and ensures that it cannot be tampered with.

View and manage credentials with eas credentials command

You can view your currently configured app signing credentials by running 'eas credentials'. This command also lets you remove and modify credentials. Use this to sync credentials to your local machine for local builds or to migrate existing credentials to be automatically managed.

Download automatically managed credentials to local

To download automatically managed credentials hosted on EAS servers to your local machine, run `eas credentials` in the root of your project, pick a platform, choose "Credentials.json: Upload/Download credentials between EAS servers and your local json", and then "Download credentials from EAS to credentials.json".

Multiple platforms require separate upload/download commands

When syncing credentials for multiple platforms, the `eas credentials` command must be run separately for each platform.

iOS credentials require two setup steps after download

After downloading iOS credentials to credentials.json, two additional steps are required: first install the distribution certificate into your keychain, then open the project in Xcode, navigate to the "Signing & Capabilities" section, import the provisioning profile, and select it.

Android credentials ready after download

After downloading Android credentials to credentials.json using `eas credentials`, they are ready to use immediately because the project reads credentials from the credentials.json file.

Upload local credentials to EAS for management

To upload credentials from credentials.json to be managed by EAS, run `eas credentials` in the root of your project, pick a platform, choose "Credentials.json: Upload/Download credentials between EAS servers and your local json", and then "Upload credentials from credentials.json to EAS".

EAS Build provides CI/CD workflow

EAS (Expo Application Services) can be used to set up a professional CI/CD workflow for building, reviewing, deploying, and updating apps in existing React Native projects.

EAS is recommended but not required

Although EAS (Expo Application Services) is recommended for smooth team collaboration and fast distribution, you can compile your app locally, on your own CI system, or any other way you prefer. EAS is optional.

Build concurrency add-ons availability

If already subscribed to a paid EAS plan, additional concurrencies can be purchased in the Add-ons section under Billing. If on the Free plan, a paid subscription must be set up first, then additional concurrencies can be selected on the checkout page. Each plan has a different number of concurrencies included. If more than 5 additional concurrencies are needed, contact Expo.

Expo Application Services (EAS) provides cloud services

Expo Application Services (EAS) is a suite of deeply integrated cloud services for building, submitting, and updating React Native apps. EAS can be used with any React Native app, regardless of whether it uses the expo package or not.

VS Code extension for EAS Metadata

The Expo Tools extension for VS Code provides auto-complete, suggestions, and warnings in store.config.json files.

eas metadata:push command

To push the store.config.json to the app stores, run the command 'eas metadata:push'. If there are any issues, EAS Metadata will warn you. You can confirm to push even with possible issues, and it will try to upload as much as possible. You can re-use this command when modifying store.config.json to push the latest changes.

configVersion property in store.config.json

The configVersion property in store.config.json helps with versioning changes that are not backward compatible. The example shown uses configVersion 0.

store.config.json structure for Apple App Store

The store.config.json file contains a configVersion property and an apple object. The apple object contains an info object with language-specific properties (like 'en-US'). Each language entry includes: title, subtitle, description, keywords (array), marketingUrl, supportUrl, and privacyPolicyUrl.

store.config.json file location

The store.config.json file is located at the root of your Expo project and holds all the information you want to upload to the app stores.

Prerequisite for uploading store config

Before pushing the store.config.json to the app stores, you must upload a new binary of your app. After the binary is submitted and processed, you can continue with pushing the store config.

EAS Metadata purpose and benefits

EAS Metadata enables you to automate and maintain app store metadata information from the command line instead of using app store dashboards. It can instantly identify well-known app store restrictions that could trigger a rejection after review.

EAS Metadata beta status and App Store support

EAS Metadata is in beta and subject to breaking changes. The service currently only supports the Apple App Store.

Give your agent this brain