How should a mobile app store the user's auth token securely?

No. AsyncStorage and SharedPreferences are unencrypted and readable on rooted/jailbroken devices and through some backups. Store tokens in the platform's secure storage instead: iOS Keychain and the Android Keystore-backed encrypted storage.

- Expo / React Native: expo-secure-store or react-native-keychain.

import * as SecureStore from 'expo-secure-store';
await SecureStore.setItemAsync('refresh_token', token);

- Flutter: flutter_secure_storage.

Good token design on top of that: - Short-lived access token (minutes), kept in memory where possible, plus a refresh token in secure storage. - Rotate refresh tokens on use, and support server-side revocation ("log out all devices"). - Never put secrets like API keys for third-party services in the app binary. Anything shipped in the app can be extracted. Proxy those calls through your backend.