Integrating Clerk Expo

Clerk authentication in Expo (React Native)

Key constraints (read first)

• Expo native apps do not support Clerk email links. Prefer email verification codes (email_code) or other strategies.
• Clerk prebuilt UI components are not supported on Expo native. Use custom flows (your own screens) plus the control components:

<ClerkLoaded>, <ClerkLoading>, <SignedIn>, <SignedOut>, <Protect>.

• Default session tokens are in-memory; for native apps you almost always want a secure token cache (Expo SecureStore).

What this skill does

When implementing Clerk in an Expo app, follow these workflows to:

• Install and configure @clerk/clerk-expo and environment keys
• Wrap the app in <ClerkProvider> with a secure tokenCache
• Build custom sign-in/sign-up screens (email + password, email codes)
• Protect routes/screens in Expo Router or React Navigation
• Add OAuth / Enterprise SSO flows via useSSO() (and fix redirect/deeplink pitfalls)
• Add native Sign in with Apple (iOS, native build) via useSignInWithApple()
• Add optional biometric re-auth via useLocalCredentials()
• Optionally enable experimental offline bootstrapping via __experimental_resourceCache
• Prepare for production deployment (domain + allowlisted redirect URLs)

Fast checklist (default: Expo Router)

Copy/paste and tick off:

• [ ] In Clerk Dashboard, enable Native API for the application.
• [ ] Install: @clerk/clerk-expo
• [ ] Add .env: EXPO_PUBLIC_CLERK_PUBLISHABLE_KEY=...
• [ ] Wrap the root with <ClerkProvider tokenCache={tokenCache}>
• [ ] Install SecureStore and use Clerk’s tokenCache helper
• [ ] Create (auth) route group with sign-in.tsx, sign-up.tsx, and an (auth)/_layout.tsx redirect guard
• [ ] Add a sign-out button using useClerk().signOut()
• [ ] Protect signed-in content using <SignedIn> / <SignedOut> / <Protect> or useAuth() + redirects
• [ ] If using OAuth/SSO: implement useSSO() + expo-auth-session redirect URL + WebBrowser.maybeCompleteAuthSession()
• [ ] If iOS Apple sign-in is required: native build + useSignInWithApple()
• [ ] If you need resilience offline: __experimental_resourceCache={resourceCache} and handle network_error
• [ ] Production: acquire a domain and allowlist mobile SSO redirect URLs

If you need full code examples, open:

• `references/QUICKSTART.md`
• `references/CUSTOM_FLOWS.md`
• `references/SSO_OAUTH.md`
• `references/HOOKS_AND_COMPONENTS.md`

---

Decide the routing setup

If the project uses Expo Router

Signals:

• expo-router dependency
• an app/ directory with route files like app/_layout.tsx

➡️ Follow: Expo Router workflow (below).

If the project uses React Navigation directly (no Expo Router)

Signals:

• App.tsx with NavigationContainer and stacks
• no app/ directory

➡️ Follow: React Navigation workflow (below).

---

Workflow A — Expo Router (recommended default)

1) Install + env key

• Install @clerk/clerk-expo
• Set EXPO_PUBLIC_CLERK_PUBLISHABLE_KEY in .env

2) Root layout: ClerkProvider + secure token cache

In app/_layout.tsx (or the project’s root layout), wrap your app:

import { ClerkProvider } from '@clerk/clerk-expo'
import { tokenCache } from '@clerk/clerk-expo/token-cache'
import { Slot } from 'expo-router'

export default function RootLayout() {
  return (
    <ClerkProvider tokenCache={tokenCache}>
      <Slot />
    </ClerkProvider>
  )
}

Notes:

• Ensure expo-secure-store is installed (required by the tokenCache helper).
• Keep only the publishable key in the client.

3) Auth route group + redirect guard

Create app/(auth)/_layout.tsx that redirects signed-in users away from auth screens:

import { Redirect, Stack } from 'expo-router'
import { useAuth } from '@clerk/clerk-expo'

export default function AuthLayout() {
  const { isSignedIn } = useAuth()
  if (isSignedIn) return <Redirect href="/" />
  return <Stack />
}

4) Build custom sign-in / sign-up screens

Use Clerk hooks (useSignIn, useSignUp) and prefer email_code verification.

See:

• `references/CUSTOM_FLOWS.md`

5) Protect signed-in routes

Options (pick one, don’t mix randomly):

• Declarative: Wrap signed-in areas with <SignedIn> and <SignedOut>.
• Gate a subtree: Use <Protect> around content that requires auth.
• Imperative: In a layout, check useAuth() and <Redirect> to /sign-in.

See:

• `references/ROUTING.md`

---

Workflow B — React Navigation (no Expo Router)

1) Wrap the root

Wrap your NavigationContainer (or your app root) with <ClerkProvider tokenCache={tokenCache}>.

2) Split navigation by auth state

• While !isLoaded: render a splash/loading screen
• When isSignedIn: render your “app” stack
• Else: render your “auth” stack

See:

• `references/ROUTING.md`

---

OAuth / Enterprise SSO in Expo (useSSO)

Use useSSO() for OAuth + enterprise SSO. In native, you must provide a valid redirect URL (often via AuthSession.makeRedirectUri(...)) and ensure your redirect URLs are allowlisted for production.

See:

• `references/SSO_OAUTH.md`
• `references/DEPLOYMENT.md`

---

Sign in with Apple (iOS native build)

useSignInWithApple() is iOS-only and requires a native build (won’t work in Expo Go). Always handle ERR_REQUEST_CANCELED.

See:

• `references/APPLE_SIGNIN.md`

---

Biometrics (store local credentials)

useLocalCredentials() can store password credentials on-device and allow biometric sign-in later (Face ID / fingerprint). Only works for password-based sign-in attempts.

See:

• `references/BIOMETRICS.md`

Passkeys

Clerk supports passkeys (WebAuthn). In Expo apps, you’ll integrate passkeys through custom flows; follow Clerk’s passkeys reference for the latest supported strategies and platform constraints.

See:

• `references/PASSKEYS.md`

---

Offline support (experimental)

You can enable experimental offline bootstrapping via __experimental_resourceCache. Treat as experimental; add good error handling for network_error.

See:

• `references/OFFLINE_SUPPORT.md`

---

Validation loop (recommended)

1) Run the setup verifier:

python scripts/verify_expo_clerk_setup.py .

2) Start Expo with a clean cache:

npx expo start -c

3) Test flows:

• fresh install → sign up → verify code → app screen
• app restart → user still signed in (token cache working)
• sign out → user returns to auth stack (token cleared)

---

THE EXACT PROMPT — Implement Clerk in an Expo app

Use this when delegating to another coding agent:

You are implementing Clerk authentication in a React Native Expo app.

1) Detect whether this app uses Expo Router (app/ directory) or React Navigation.
2) Install and configure @clerk/clerk-expo with EXPO_PUBLIC_CLERK_PUBLISHABLE_KEY.
3) Wrap the root with <ClerkProvider tokenCache={tokenCache}> and ensure expo-secure-store is installed.
4) Implement custom sign-in and sign-up screens (email + password, with email verification code strategy 'email_code').
5) Protect signed-in routes appropriately for the chosen router.
6) If OAuth/SSO is requested, implement useSSO() with expo-auth-session redirectUrl and WebBrowser.maybeCompleteAuthSession().
7) Add sign-out.
8) Provide a short test plan and run scripts/verify_expo_clerk_setup.py.

Be precise and keep changes minimal. Do not use email link flows on native.

---

Quick search (when reading bundled references)

grep -Rni "useSSO" references/
grep -Rni "tokenCache" references/
grep -Rni "enterprise_sso" references/
grep -Rni "__experimental_resourceCache" references/

Sign in with Apple (Expo) — useSignInWithApple()

Requirements

• iOS only.
• Requires a native build (won’t work in Expo Go).
• You must add native Sign in with Apple support for Expo (including expo-apple-authentication).

Hook API

useSignInWithApple() returns startAppleAuthenticationFlow(params?).

Returned value includes:

• createdSessionId (string | null)
• setActive(params) (to activate session)
• optional signIn / signUp resources (for remaining requirements)

Minimal button component

import { useSignInWithApple } from '@clerk/clerk-expo'
import { useRouter } from 'expo-router'
import { Alert, Platform, TouchableOpacity, Text } from 'react-native'

export function AppleSignInButton() {
  const { startAppleAuthenticationFlow } = useSignInWithApple()
  const router = useRouter()

  if (Platform.OS !== 'ios') return null

  const onPress = async () => {
    try {
      const { createdSessionId, setActive } = await startAppleAuthenticationFlow()
      if (createdSessionId && setActive) {
        await setActive({ session: createdSessionId })
        router.replace('/')
      }
    } catch (err: any) {
      // User cancelled the system prompt
      if (err.code === 'ERR_REQUEST_CANCELED') return
      Alert.alert('Apple Sign-In failed', err.message ?? 'Unknown error')
    }
  }

  return (
    <TouchableOpacity onPress={onPress}>
      <Text>Sign in with Apple</Text>
    </TouchableOpacity>
  )
}

Unsafe metadata during sign-up

You can pass unsafeMetadata to startAppleAuthenticationFlow({ unsafeMetadata: ... }). It’s copied to the created user’s User.unsafeMetadata after completion.

Error handling must-dos

• Always wrap startAppleAuthenticationFlow() in try/catch.
• Handle ERR_REQUEST_CANCELED separately (don’t show an error UI).
• If you see “missing package” errors, ensure expo-apple-authentication is installed and you’re on a native build.

Biometrics / local credentials (useLocalCredentials)

useLocalCredentials() lets you store a user’s password credentials on-device and later sign them in using biometrics (Face ID / fingerprint).

Constraints

• Native only (not supported on web).
• Requires @clerk/clerk-expo >= 2.2.0.
• Works only for password sign-in attempts.
• Credentials are removed if the device passcode is removed.

Returned fields/methods (high level)

• hasCredentials: boolean — any credentials stored?
• userOwnsCredentials: boolean — do stored creds belong to the signed-in user?
• biometricType: 'face-recognition' | 'fingerprint' | null
• setCredentials({ identifier?, password })
• clearCredentials()
• authenticate() — reads stored creds and starts a password sign-in attempt (returns SignInResource)

Suggested UX pattern

After a successful password sign-in

Offer a “Enable Face ID / Touch ID” toggle:

import { useLocalCredentials } from '@clerk/clerk-expo'

const { setCredentials } = useLocalCredentials()

await setCredentials({ identifier: email, password })

On the next app launch (signed out)

Show a “Sign in with Face ID” button if hasCredentials is true:

import { useLocalCredentials } from '@clerk/clerk-expo'
import { useSignIn } from '@clerk/clerk-expo'

const { authenticate, hasCredentials } = useLocalCredentials()
const { setActive } = useSignIn()

const onBiometricPress = async () => {
  const signInAttempt = await authenticate()
  if (signInAttempt.status === 'complete') {
    await setActive({ session: signInAttempt.createdSessionId })
  } else {
    // handle other states (MFA etc)
  }
}

Signing out

If you want to remove local creds on sign-out, call clearCredentials() explicitly (this is an app decision).

Custom auth flows for Expo native (no prebuilt UI)

Expo native apps require you to build your own UI using Clerk hooks/resources.

Core rules

• Always check isLoaded before calling Clerk resource methods.
• Expo native does not support email links → prefer email_code verification.
• Treat Clerk resource status as a state machine; branch on status.

---

Email + password sign-up with email code verification

High-level state machine:

1) Collect emailAddress + password 2) signUp.create({ emailAddress, password }) 3) signUp.prepareEmailAddressVerification({ strategy: 'email_code' }) 4) Collect code input 5) signUp.attemptEmailAddressVerification({ code }) 6) If status === 'complete', call setActive({ session: createdSessionId }) 7) If session.currentTask exists, route to a “tasks” screen

Minimal skeleton:

import * as React from 'react'
import { useSignUp } from '@clerk/clerk-expo'

export function SignUpScreen() {
  const { isLoaded, signUp, setActive } = useSignUp()

  const [emailAddress, setEmailAddress] = React.useState('')
  const [password, setPassword] = React.useState('')
  const [code, setCode] = React.useState('')
  const [pendingVerification, setPendingVerification] = React.useState(false)

  const onSignUpPress = async () => {
    if (!isLoaded) return
    await signUp.create({ emailAddress, password })
    await signUp.prepareEmailAddressVerification({ strategy: 'email_code' })
    setPendingVerification(true)
  }

  const onVerifyPress = async () => {
    if (!isLoaded) return
    const attempt = await signUp.attemptEmailAddressVerification({ code })
    if (attempt.status === 'complete') {
      await setActive({ session: attempt.createdSessionId })
    }
  }

  // render based on pendingVerification...
}

---

Email + password sign-in

High-level flow:

1) signIn.create({ identifier, password }) 2) If status === 'complete', call setActive({ session: createdSessionId }) 3) Otherwise, branch based on status:

• needs_first_factor
• needs_second_factor
• needs_identifier
• etc

Minimal skeleton:

import * as React from 'react'
import { useSignIn } from '@clerk/clerk-expo'

export function SignInScreen() {
  const { isLoaded, signIn, setActive } = useSignIn()
  const [identifier, setIdentifier] = React.useState('')
  const [password, setPassword] = React.useState('')

  const onSignInPress = async () => {
    if (!isLoaded) return
    const attempt = await signIn.create({ identifier, password })
    if (attempt.status === 'complete') {
      await setActive({ session: attempt.createdSessionId })
    } else {
      // handle MFA / other requirements based on attempt.status
    }
  }
}

---

Sign out

Use useClerk():

import { useClerk } from '@clerk/clerk-expo'

export function SignOutButton() {
  const { signOut } = useClerk()
  return <Button title="Sign out" onPress={() => signOut()} />
}

---

Error handling

• Wrap resource calls in try/catch.
• Prefer displaying Clerk errors to the user (mapped to form fields).
• For offline support, specifically detect network_error (see references/OFFLINE_SUPPORT.md).

---

Session tasks

Some sign-in/up flows may require session tasks after authentication. When you call setActive(), you can provide a navigate callback and route users to a custom “tasks” UI if session.currentTask exists.

See references/SSO_OAUTH.md for a concrete setActive({ navigate }) pattern.

Deploying an Expo app with Clerk (production notes)

1) You still need a domain

Even if your product is “mobile-only”, Clerk production instances require a domain.

2) Allowlist redirect URLs for mobile SSO

Clerk ensures security-critical nonces are only passed to allowlisted URLs when SSO completes in native browsers/webviews. For production you should allowlist your mobile redirect URLs.

Where:

• Clerk Dashboard → Native applications
• Section: “Allowlist for mobile SSO redirect”

Default:

• Clerk typically uses {bundleIdentifier}://callback as the redirect URL.

3) Build and release

After domain + allowlists are configured, proceed with your normal Expo release pipeline (EAS builds / store submission).

4) OTA updates (recommended)

Expo over-the-air updates make it easier to ship Clerk SDK updates (security patches, behaviour changes) without resubmitting binaries.

Hooks + components you can rely on (Expo SDK)

Expo-specific hooks

• useSSO() — OAuth + enterprise SSO flows via startSSOFlow().
• useSignInWithApple() — native Sign in with Apple on iOS (native build).
• useLocalCredentials() — store password creds locally and use biometrics to sign in later.

Common hooks inherited from Clerk React SDK

These work in Expo because the Expo SDK is built on top of Clerk’s React SDK:

• useAuth() — auth state + getToken() for calling your backend
• useUser() — current user object (profile data, unsafe metadata, etc)
• useClerk() — access Clerk methods like signOut()
• useSignIn() — sign-in resource for custom sign-in flows
• useSignUp() — sign-up resource for custom sign-up flows
• useSession() / useSessionList() — session info
• useOrganization() / useOrganizationList() — organisations (B2B)

Control components (native-safe)

Use these for gating render based on auth/load state:

• <ClerkLoaded> / <ClerkLoading> — render based on SDK load state
• <SignedIn> / <SignedOut> — render based on auth state
• <Protect> — protect a subtree that requires auth

Note: Prebuilt auth UI components (e.g. “SignIn”, “SignUp” screens) are web-only. For native, build your own screens.

Offline support (experimental) for Expo Clerk SDK

This is based on Clerk’s experimental offline support for Expo.

What it does (conceptually)

• Lets the Clerk SDK bootstrap offline using cached resources.
• Makes isLoaded resolve more reliably when offline (one fetch attempt, then fallback).
• Allows useAuth().getToken() to return cached tokens when offline.
• Surfaces network errors (so you can handle them in custom flows).

Enable: tokenCache + __experimental_resourceCache

import { ClerkProvider } from '@clerk/clerk-expo'
import { tokenCache } from '@clerk/clerk-expo/token-cache'
import { resourceCache } from '@clerk/clerk-expo/resource-cache'
import { Slot } from 'expo-router'

export default function RootLayout() {
  return (
    <ClerkProvider
      tokenCache={tokenCache}
      __experimental_resourceCache={resourceCache}
    >
      <Slot />
    </ClerkProvider>
  )
}

Notes:

• Requires expo-secure-store.
• Treat as experimental: test thoroughly and watch Clerk changelogs.

Handle network errors in custom flows

When offline, calls like signIn.create() can throw a Clerk runtime error with code === 'network_error'.

import { useSignIn, isClerkRuntimeError } from '@clerk/clerk-expo'

try {
  await signIn.create({ identifier, password })
} catch (err) {
  if (isClerkRuntimeError(err) && err.code === 'network_error') {
    // Show “You appear to be offline” UI
  }
  // Log / show other errors
}

Passkeys (high-level notes)

Clerk supports passkeys (built on the WebAuthn standard). Passkeys are intended as a more secure, user-friendly alternative to passwords.

When to consider passkeys in an Expo app

• You want phishing-resistant authentication
• You already support “email + password” and want a stronger/less-friction option
• You need to reduce password resets and improve conversion

Implementation approach

1) Enable/configure passkeys in Clerk (dashboard + instance settings). 2) Update your custom sign-in/sign-up flow to offer passkey registration and sign-in where supported. 3) Treat passkeys as a factor that may interact with other requirements (e.g. MFA/session tasks). 4) Ensure your testing matrix covers:

• iOS vs Android devices
• Expo Go vs native builds (some auth mechanisms require native builds)
• Offline/poor connectivity behaviour

Because passkey support details can evolve quickly, always follow the latest “Configure passkeys” page in Clerk docs when implementing.

Expo + Clerk quickstart (condensed)

This is a condensed checklist based on Clerk’s Expo quickstart.

Checklist

• [ ] In Clerk Dashboard, enable Native API (required for native integration).
• [ ] Install @clerk/clerk-expo
• [ ] Add .env with: EXPO_PUBLIC_CLERK_PUBLISHABLE_KEY=...
• [ ] Add <ClerkProvider> to the root of the app
• [ ] Add secure token caching via expo-secure-store + tokenCache
• [ ] Create custom auth screens (native uses custom flows)
• [ ] Add sign-out (useClerk().signOut())
• [ ] (Recommended) enable OTA updates so Clerk fixes can ship without a store resubmission

Root layout (Expo Router)

import { ClerkProvider } from '@clerk/clerk-expo'
import { tokenCache } from '@clerk/clerk-expo/token-cache'
import { Stack } from 'expo-router'

export default function RootLayout() {
  return (
    <ClerkProvider tokenCache={tokenCache}>
      <Stack>
        {/* route groups like (home), (auth), etc */}
      </Stack>
    </ClerkProvider>
  )
}

Auth route group layout guard

import { Redirect, Stack } from 'expo-router'
import { useAuth } from '@clerk/clerk-expo'

export default function AuthRoutesLayout() {
  const { isSignedIn } = useAuth()
  if (isSignedIn) return <Redirect href="/" />
  return <Stack />
}

Sign-up outline (email + password + email code)

High-level flow:

1) signUp.create({ emailAddress, password }) 2) signUp.prepareEmailAddressVerification({ strategy: 'email_code' }) 3) signUp.attemptEmailAddressVerification({ code }) 4) When status === 'complete', call setActive({ session: createdSessionId })

Sign-in outline (identifier + password)

High-level flow:

1) signIn.create({ identifier, password }) 2) If status === 'complete', call setActive({ session: createdSessionId }) 3) If additional steps are required (e.g. MFA), follow the object’s status / supportedFirstFactors.

Sign out

import { useClerk } from '@clerk/clerk-expo'

export function SignOutButton() {
  const { signOut } = useClerk()
  return <Button title="Sign out" onPress={() => signOut()} />
}

OTA updates (recommended)

Clerk recommends implementing over-the-air updates (Expo Updates) so security patches/feature updates can ship without resubmitting the app to marketplaces.

Routing + protection patterns (Expo Router and React Navigation)

Terminology

• Control components: <SignedIn>, <SignedOut>, <Protect>, <ClerkLoaded>, <ClerkLoading>
• Imperative guard: a layout/screen that checks useAuth() and redirects

Keep the app consistent: pick one main pattern and apply it everywhere.

---

Expo Router patterns

Pattern 1 — Gate a whole route group with a layout redirect

Example: protect everything under app/(home)/...:

app/(home)/_layout.tsx

import { Redirect, Stack } from 'expo-router'
import { useAuth } from '@clerk/clerk-expo'

export default function HomeLayout() {
  const { isLoaded, isSignedIn } = useAuth()
  if (!isLoaded) return null // or a splash component
  if (!isSignedIn) return <Redirect href="/(auth)/sign-in" />
  return <Stack />
}

Pros: simple mental model; works well for “signed-in areas”.

Pattern 2 — Declarative rendering with <SignedIn> / <SignedOut>

Example: a screen that shows different content based on auth:

import { SignedIn, SignedOut } from '@clerk/clerk-expo'

export default function Index() {
  return (
    <>
      <SignedIn>{/* signed-in UI */}</SignedIn>
      <SignedOut>{/* signed-out UI */}</SignedOut>
    </>
  )
}

Pros: great for landing screens that can be “both”.

Pattern 3 — Protect a component subtree with <Protect>

import { Protect } from '@clerk/clerk-expo'

export function BillingSection() {
  return (
    <Protect>
      {/* content that should only render for signed-in users */}
    </Protect>
  )
}

Pros: convenient for “small guarded areas”.

---

React Navigation patterns (no Expo Router)

Pattern — AuthStack vs AppStack

import { ClerkProvider, useAuth } from '@clerk/clerk-expo'
import { tokenCache } from '@clerk/clerk-expo/token-cache'
import { NavigationContainer } from '@react-navigation/native'
import { createNativeStackNavigator } from '@react-navigation/native-stack'

const Stack = createNativeStackNavigator()

function RootNavigator() {
  const { isLoaded, isSignedIn } = useAuth()

  if (!isLoaded) return null // splash/loading

  return (
    <Stack.Navigator>
      {isSignedIn ? (
        <>
          <Stack.Screen name="Home" component={HomeScreen} />
          {/* other signed-in screens */}
        </>
      ) : (
        <>
          <Stack.Screen name="SignIn" component={SignInScreen} />
          <Stack.Screen name="SignUp" component={SignUpScreen} />
        </>
      )}
    </Stack.Navigator>
  )
}

export default function App() {
  return (
    <ClerkProvider tokenCache={tokenCache}>
      <NavigationContainer>
        <RootNavigator />
      </NavigationContainer>
    </ClerkProvider>
  )
}

Notes:

• Always wait for isLoaded before rendering logic that depends on Clerk.
• Keep sign-in and sign-up screens “dumb” UI; centralise navigation logic in one place.

OAuth + Enterprise SSO in Expo (useSSO)

Prefer useSSO (useOAuth is deprecated)

If you see older code using useOAuth(), migrate to useSSO().

Required Expo packages (typical)

• expo-auth-session
• expo-web-browser

Universal setup: complete pending sessions and warm up Android browser

Put this in a module that is imported by the sign-in screen, or in the screen file itself:

import { Platform } from 'react-native'
import * as WebBrowser from 'expo-web-browser'
import { useEffect } from 'react'

// Handle any pending authentication sessions
WebBrowser.maybeCompleteAuthSession()

export const useWarmUpBrowser = () => {
  useEffect(() => {
    if (Platform.OS !== 'android') return
    void WebBrowser.warmUpAsync()
    return () => {
      void WebBrowser.coolDownAsync()
    }
  }, [])
}

OAuth connection example (e.g. Google)

import { useSSO } from '@clerk/clerk-expo'
import * as AuthSession from 'expo-auth-session'
import { useRouter } from 'expo-router'
import { useCallback } from 'react'

export function GoogleButton() {
  const router = useRouter()
  const { startSSOFlow } = useSSO()

  const onPress = useCallback(async () => {
    const { createdSessionId, setActive, signIn, signUp } = await startSSOFlow({
      strategy: 'oauth_google',
      // On native you must pass a redirectUrl (scheme-based).
      redirectUrl: AuthSession.makeRedirectUri(),
    })

    if (createdSessionId) {
      await setActive?.({
        session: createdSessionId,
        navigate: async ({ session }) => {
          if (session?.currentTask) {
            router.push('/sign-in/tasks')
            return
          }
          router.push('/')
        },
      })
    } else {
      // Missing requirements (e.g. MFA) — use signIn/signUp returned from startSSOFlow
      // and branch on their status.
    }
  }, [])

  return <Pressable onPress={onPress}><Text>Continue with Google</Text></Pressable>
}

Notes:

• startSSOFlow() can return signIn or signUp objects when requirements remain (MFA, missing fields).
• Centralise this into a reusable helper if you support multiple providers.

Enterprise SSO example

Same pattern, but pass:

• strategy: 'enterprise_sso'
• identifier: userEmail (the email the user typed)

Production allowlisting + redirect URLs

In production, Clerk requires allowlisted redirect URLs for mobile SSO completion.

• Acquire a domain for the production Clerk instance (required even for Expo apps).
• Allowlist your mobile SSO redirect URLs in Clerk Dashboard (Native applications).
• Clerk’s default redirect URL is typically {bundleIdentifier}://callback.

See: references/DEPLOYMENT.md.