EAS builds and the environment variable that was only on your laptop
Your local .env is not part of the cloud build. Here is how that mismatch shows up and how to avoid it.
Hammad Iqbal
Software Engineer
The app works perfectly in development. The cloud build finishes, the install works, and then every API call fails because the base URL is undefined. The cause is almost always the same: a variable that lived in a local .env file never reached the build server.
- A gitignored .env file is not uploaded with a cloud build.
- Keep build-time values in the build profile or the service's secret storage.
- Remember that anything bundled into a mobile app is readable by users.
Why it works locally and breaks in the cloud
Cloud builds work from your committed project, and files ignored by git are not included. So a value that exists only in an ignored .env file simply does not exist on the build machine, and the bundled code reads undefined.
Put values where the build can see them
Set non-secret values in the build profile for each environment, and use the platform's secret storage for sensitive ones. Having separate development, preview, and production profiles also stops a test build from quietly pointing at the production API.
Public means public
Variables that get inlined into the JavaScript bundle can be extracted from the installed app. That is fine for a public API URL and wrong for a private key. Real secrets belong on a server that your app calls.
Declare environment values in the build configuration, and never ship a secret inside a mobile bundle.
Have a project this kind of thinking applies to?
Tell me what you're building — I read every message myself.