Separate server state from screen presentation. A screen should express loading, empty, error, stale, and success states; a data module should own transport, validation, cancellation, caching, and authentication.
Fetch Predictably
- Start requests in a data layer or a focused hook, not across multiple child components.
- Cancel or ignore obsolete requests when parameters change or the screen unmounts.
- Check HTTP status before parsing success data.
- Validate untrusted responses at the boundary.
- Keep the last useful data visible during safe refreshes instead of replacing the whole screen with a spinner.
- Offer a retry action for recoverable errors.
For streaming responses, update at a cadence the UI can render smoothly. Buffer tiny chunks and stop the stream when the user leaves or starts another request.
Keep Secrets on the Server
Expo Router API routes can provide a server boundary for privileged operations. Never ship database service keys, AI provider secrets, payment secrets, or signing credentials in the app bundle. Environment variables embedded in client code are inspectable even when their names look private.
API routes should authenticate the caller, validate input, enforce authorization and rate limits, call the privileged service, and return the smallest useful response.
Model Supabase Access Explicitly
- Design tables and constraints before building screens around sample JSON.
- Enable row-level security and write policies for every client-accessible table.
- Use the authenticated user identity in policies; do not trust a user ID supplied by the client.
- Keep generated database types in sync with schema changes.
- Represent optimistic mutations with rollback or refetch behavior.
An application that “works” only while row-level security is disabled is not ready.
Deploy with Environment Separation
Use separate development, preview, and production projects or credentials. EAS Hosting is appropriate for Expo Router server output and web surfaces, but deployment does not replace database migrations, secret management, observability, or rollback planning.
Sources
Check data and deployment details against Expo's data-fetching guide, Router API routes, EAS Hosting, and Supabase's Expo React Native quickstart.