version: "1.0.2"
Store authentication tokens in the platform secure keychain/keystore, for example through react-native-keychain, not AsyncStorage. Use biometric protection when the product requires it, keep access behind a small auth-storage abstraction, and use short-lived access tokens with a refresh strategy where possible.
Never hardcode secrets or log tokens. Treat the client as untrusted and enforce authorization on the backend; AsyncStorage is suitable only for non-sensitive preferences.