# react-native-auth0: the Auth0 SDK for React Native, and the redirect plumbing behind it > The react-native-auth0 package handles the Auth0 login flow in a React Native app, and most of its documentation is about the plumbing rather than the API: manifest placeholders on Android, an AppDelegate hook on iOS, and a minimum deployment target you have to raise. Version 5 requires React 19 and React Native 0.78. **auth0/react-native-auth0** — React Native toolkit for Auth0 API - Repository: https://github.com/auth0/react-native-auth0 - Website: https://auth0.com - Stars: 552 · Forks: 244 - Language: TypeScript - License: MIT - Published: 2026-10-22 · Updated: 2026-10-22 · Language: en - Canonical page: https://hysenlabs.com/projects/auth0-react-native-auth0 ## What the SDK actually wraps react-native-auth0 is the React Native toolkit for the Auth0 API, and the shape of the thing is a browser based authentication flow with a redirect back into the app. The documentation index in the README is a good map of the surface. There is a Quickstart for React Native and a separate Expo Quickstart, sample apps hosted in the auth0-samples organisation for both the login-hooks example and the Expo example, a React Native Web Setup guide, an FAQ, and Examples files for native and for web. What makes this package more than an API wrapper is the redirect handling, and that is where the README spends most of its length. You need to make your Android, iOS or Expo application aware that an authentication result will be received from the browser, and the SDK makes use of the Android Package Name and its analogous iOS Product Bundle Identifier to generate the redirect URL. Each platform has its own set of instructions, and the mechanism is different on each, so you are configuring two things that must agree with each other and with the Auth0 application settings. The package is MIT licensed, written in TypeScript, published to npm as react-native-auth0, and the release history shows active work: v5.11.2 on 2026-10-14, a v6.0.0-beta.0 in September 2026, and v5.11.1 before that. The last push was on 2026-10-14. ## Version 5 raised the floor on React, React Native and Expo The migration notice is the first thing in the README, and it is about compatibility rather than features. Version 5.0.0 requires React 19 and React Native 0.78.0 or higher, and if you are using Expo it requires Expo 53 or higher. There is a migration guide linked for the compatibility requirements and the upgrade instructions. The Requirements section repeats it from the other direction. This SDK targets apps that are using React Native SDK version 0.78.0 and up, and if you are using an older React Native version the README points at a compatibility matrix. The SDK fully supports React Native New Architecture and Expo 53 and above. The Expo warning is worth reading twice because it is phrased as a version trap. If you are using Expo version less than 53, you need to use react-native-auth0 version 4.x or earlier. Version 5.x supports Expo 53 and above. So there are two compatibility axes to check, the React Native version and the Expo version, and a project on Expo 52 is not merely a slightly old Expo, it needs a different major line of the SDK. The platform table then gives the minimums for the devices themselves: iOS 14.0 and Android 35. The SDK requires a minimum iOS deployment target of 14.0, and in your project's ios/Podfile you ensure your platform target is set to 14.0, with the line shown being platform :ios, '14.0'. Android 35 is a high floor, and it is the kind of number that quietly rules out older devices. ## The Android redirect is built from two manifest placeholders The Android configuration is the more mechanical of the two, and the README gives it in full. You open your app's build.gradle file, typically at android/app/build.gradle, and add the manifest placeholders: ```groovy android { defaultConfig { // Add the next line manifestPlaceholders = [auth0Domain: "YOUR_AUTH0_DOMAIN", auth0Scheme: "${applicationId}.auth0"] } ... } ``` The auth0Domain value must be replaced with your Auth0 domain value, and the example shows a concrete one: ```groovy android { defaultConfig { manifestPlaceholders = [auth0Domain: "samples.us.auth0.com", auth0Scheme: "${applicationId}.auth0"] } ... } ``` The applicationId value is auto-replaced at runtime with the package name or ID of your application, and you can change it from the build.gradle file. The other thing you can do is check it at the top of your AndroidManifest.xml file. Two details follow from this. If your application uses product flavors, you might need to specify different manifest placeholders for each flavor. And if you use a value other than applicationId in auth0Scheme, you also need to pass it as the customScheme option parameter of the authorize and clearSession methods, and to take note of that value because you will be requiring it to define the callback URLs. There is also a migration note for anyone arriving from an older SDK. Before version 2.9.0 the SDK required you to add an intent filter to the Activity receiving the authentication result and to use the singleTask launchMode in that activity. To migrate to 2.9.0 or later, you remove both and continue with the instructions above, and a sample migration diff is linked. ## iOS needs an AppDelegate hook and nothing else The iOS side is smaller, and the README gives both language variants. Inside the ios folder you find the AppDelegate file, and you add the open URL handler to it. For Objective-C: ```objc #import - (BOOL)application:(UIApplication *)app openURL:(NSURL *)url options:(NSDictionary *)options { return [RCTLinkingManager application:app openURL:url options:options]; } ``` The whole point of that method is to hand the incoming URL to React Native's linking manager, which is the component that knows how to route a deep link back to the screen that asked for it. Without it, the browser completes the login and the app never hears about it. The Swift version does the same thing with the modern app delegate signature, and the README shows it alongside the Objective-C one so you can pick whichever your project uses. The Swift and Objective-C paths are the only difference, and the underlying mechanism is identical. What differs from Android is that there are no placeholders to fill in. The bundle identifier is read from the project, and the SDK uses the Android Package Name and its analogous iOS Product Bundle Identifier to generate the redirect URL, so the iOS side is a single method and the Android side is a configuration block plus the platform's own build file. ## If you skip web authentication, you remove the activity There is a section on skipping the Web Authentication setup, and it exists because the library always ships a RedirectActivity whether you use it or not. If you don't plan to use Web Authentication, you will notice that the compiler will still prompt you to provide the manifestPlaceholders values, since the RedirectActivity included in this library will require them, and the Gradle tasks will not be able to run without them. The fix is to re-declare the activity manually with tools:node="remove" in your app's Android Manifest, so that the manifest merger removes it from the final manifest file. One more unused activity can be removed from the final APK by using the same process: ```xml ``` The reason this needs documenting at all is that the manifest merger works in the opposite direction from what you want here. The library declares the activity, and the app is the one that has to cancel it out with an explicit removal marker. A team that did not know this would either supply meaningless placeholder values to satisfy the build or end up shipping an activity it does not use. The manifest merger approach is the right one, since it operates at build time and produces a smaller APK, but it is worth knowing that you are overriding a declaration that the library makes on your behalf. ## How the package is built and what it ships The package manifest shows what goes into the published tarball, and the file list is long enough to be worth reading. The package name is react-native-auth0 at version 5.11.2, described as a React Native toolkit for the Auth0 API, with MIT licensing and the author listed in the manifest. The main entry is lib/commonjs/index.js, the module field is lib/module/index.js, the types are lib/typescript/src/index.d.ts, and both the react-native and source fields point at src/index.ts, which is the convention for React Native libraries so that the bundler can consume the TypeScript source directly. The files list includes src, lib, android, ios and cpp, along with the podspec pattern and app.plugin.js, and then a series of exclusions. The example's TypeScript build is excluded, the ios/build and android/build directories are excluded, the gradle directory and the gradlew wrapper files are excluded, and local.properties is excluded because that file holds a machine-specific SDK path. Test directories, fixtures and mocks are excluded too. The scripts tell you the build shape. The build runs lint, then a prebuild step that calls scripts/replace-telemetry-version.js, then bob build, and prepare runs husky and the build. The prebuild script is interesting: it rewrites a telemetry version at build time, which is the mechanism by which the SDK reports which version of the Auth0 telemetry layer it is using. Testing is jest, with a coverage variant for CI, and typechecking is tsc --noEmit. The docs script runs typedoc with the typedoc.json options, and releases go through release-it. The CI script is a yarn install with the immutable flag followed by yarn prepare, which is the Yarn 2 style lockfile enforcement. ## Conclusion Adopt react-native-auth0 if you are putting Auth0 into a React Native app and want the browser based login flow and token handling handled for you, and you are on React Native 0.78 or newer with React 19 and Expo 53 or above. Do not adopt it on an older React Native, because version 5 dropped support for that range and the manifest and AppDelegate steps changed with it. Before you start, set your iOS deployment target to 14.0 and your Android minimum to 35, and read the manifest placeholder section, because the redirect URL is derived from your package name and your Auth0 domain. ## FAQ ### What are the requirements for react-native-auth0 version 5? React 19 and React Native 0.78.0 or higher, and Expo 53 or above if you use Expo. The platform minimums are iOS 14.0 and Android 35, and the New Architecture is fully supported. If you are on Expo below 53 you need version 4.x or earlier. ### How do I configure the Android redirect for react-native-auth0? Add manifest placeholders to the defaultConfig block of your android/app/build.gradle, setting auth0Domain to your Auth0 domain and auth0Scheme to ${applicationId}.auth0. The applicationId is replaced at runtime with your package name, and the SDK uses these values to generate the redirect URL. ### What do I have to change on iOS for react-native-auth0? In the ios folder you add the open URL handler to the AppDelegate file so that the incoming URL is passed to React Native's linking manager. Both an Objective-C and a Swift version of the method are given, and nothing else is required on that platform. ### Can I use react-native-auth0 without web authentication? Yes, but the RedirectActivity shipped in the library still requires the manifest placeholder values, so the Gradle build fails without them. The documented workaround is to re-declare the activity with tools:node="remove" in the Android Manifest so the manifest merger drops it from the final manifest, and the same process can remove the other unused activity. ## Sources - [auth0/react-native-auth0 on GitHub](https://github.com/auth0/react-native-auth0) - [License: MIT](https://github.com/auth0/react-native-auth0/blob/master/LICENSE) - [Project website](https://auth0.com) - [README](https://github.com/auth0/react-native-auth0/blob/master/README.md) - [Releases](https://github.com/auth0/react-native-auth0/releases) --- Hysen Labs editorial analysis, written from the project's own repository and release notes. Cite the canonical page: https://hysenlabs.com/projects/auth0-react-native-auth0