[GH-ISSUE #5426] [Expo] SecureStore fails with "Invalid key" error - storage keys use colons #10240

New Issue

GiteaMirror · 2026-04-13T06:13:55-05:00

GiteaMirror commented

2026-04-13 06:13:55 -05:00

Originally created by @ingokpp on GitHub (Oct 20, 2025).
Original GitHub issue: https://github.com/better-auth/better-auth/issues/5426

Is this suited for github?

Yes, this is suited for github

To Reproduce

The @better-auth/expo plugin generates storage keys with colon separators (e.g., prefix:cookie), but expo-secure-store only accepts alphanumeric characters, ., -, and _. This
causes silent storage failures and session persistence issues.

Current vs. Expected behavior

Better Auth creates storage keys like:
myprefix:cookie
myprefix:session_data

But SecureStore throws:
Error: Invalid key provided to SecureStore.
Keys must not be empty and contain only alphanumeric characters, ".", "-", and "_".

import * as SecureStore from "expo-secure-store";
import { expoClient } from "@better-auth/expo/client";

expoClient({
  storagePrefix: "myapp",
  storage: SecureStore,
});

// After sign-in, Better Auth tries:
// SecureStore.setItemAsync("myapp:cookie", value)
// ❌ Fails: Invalid key error

🎯 Expected Behavior

Storage keys should be compatible with SecureStore's key requirements without requiring custom adapters.

What version of Better Auth are you using?

1.3.28

System info

{
  "system": {
    "platform": "darwin",
    "arch": "arm64",
    "version": "Darwin Kernel Version 25.0.0: Wed Sep 17 21:41:26 PDT 2025; root:xnu-12377.1.9~141/RELEASE_ARM64_T6041",
    "release": "25.0.0",
    "cpuCount": 14,
    "cpuModel": "Apple M4 Pro",
    "totalMemory": "24.00 GB",
    "freeMemory": "0.20 GB"
  },
  "node": {
    "version": "v23.10.0",
    "env": "development"
  },
  "packageManager": {
    "name": "npm",
    "version": "11.4.0"
  },
  "frameworks": [
    {
      "name": "react",
      "version": "19.0.0"
    }
  ],
  "databases": null,
  "betterAuth": {
    "version": "^1.3.28",
    "config": null
  }
}

Which area(s) are affected? (Select all that apply)

Client

Auth config (if applicable)

import { expoClient } from "@better-auth/expo/client";
import { createAuthClient } from "better-auth/react";
import Constants from "expo-constants";
import { secureStoreAdapter } from "./secure-store-adapter";

const BASE_URL = process.env.EXPO_PUBLIC_AUTH_URL || "http://localhost:8081";

const scheme = Constants.expoConfig?.scheme as string;

export const authClient = createAuthClient({
  baseURL: BASE_URL,
  plugins: [
    expoClient({
      scheme: scheme,
      storagePrefix: scheme,
      cookiePrefix: "mycookieprefix", // MUST match backend's cookiePrefix
      storage: secureStoreAdapter, // REQUIRED: sync adapter with colon fix
    }),
  ],
});

Additional context

Replace colons with underscores in storage keys:

  const secureStoreAdapter = {
    getItem: (key: string) => {
      const normalized = key.replace(/:/g, '_');
      return SecureStore.getItemAsync(normalized);
    },
    setItem: (key: string, value: string) => {
      const normalized = key.replace(/:/g, '_');
      return SecureStore.setItemAsync(normalized, value);
    },
    removeItem: (key: string) => {
      const normalized = key.replace(/:/g, '_');
      return SecureStore.deleteItemAsync(normalized);
    },
  };

Originally created by @ingokpp on GitHub (Oct 20, 2025). Original GitHub issue: https://github.com/better-auth/better-auth/issues/5426 ### Is this suited for github? - [x] Yes, this is suited for github ### To Reproduce The @better-auth/expo plugin generates storage keys with colon separators (e.g., prefix:cookie), but expo-secure-store only accepts alphanumeric characters, ., -, and _. This causes silent storage failures and session persistence issues. ### Current vs. Expected behavior Better Auth creates storage keys like: myprefix:cookie myprefix:session_data But SecureStore throws: Error: Invalid key provided to SecureStore. Keys must not be empty and contain only alphanumeric characters, ".", "-", and "_". ```typescript import * as SecureStore from "expo-secure-store"; import { expoClient } from "@better-auth/expo/client"; expoClient({ storagePrefix: "myapp", storage: SecureStore, }); // After sign-in, Better Auth tries: // SecureStore.setItemAsync("myapp:cookie", value) // ❌ Fails: Invalid key error ``` ## 🎯 Expected Behavior Storage keys should be compatible with SecureStore's key requirements without requiring custom adapters. ### What version of Better Auth are you using? 1.3.28 ### System info ```bash { "system": { "platform": "darwin", "arch": "arm64", "version": "Darwin Kernel Version 25.0.0: Wed Sep 17 21:41:26 PDT 2025; root:xnu-12377.1.9~141/RELEASE_ARM64_T6041", "release": "25.0.0", "cpuCount": 14, "cpuModel": "Apple M4 Pro", "totalMemory": "24.00 GB", "freeMemory": "0.20 GB" }, "node": { "version": "v23.10.0", "env": "development" }, "packageManager": { "name": "npm", "version": "11.4.0" }, "frameworks": [ { "name": "react", "version": "19.0.0" } ], "databases": null, "betterAuth": { "version": "^1.3.28", "config": null } } ``` ### Which area(s) are affected? (Select all that apply) Client ### Auth config (if applicable) ```typescript import { expoClient } from "@better-auth/expo/client"; import { createAuthClient } from "better-auth/react"; import Constants from "expo-constants"; import { secureStoreAdapter } from "./secure-store-adapter"; const BASE_URL = process.env.EXPO_PUBLIC_AUTH_URL || "http://localhost:8081"; const scheme = Constants.expoConfig?.scheme as string; export const authClient = createAuthClient({ baseURL: BASE_URL, plugins: [ expoClient({ scheme: scheme, storagePrefix: scheme, cookiePrefix: "mycookieprefix", // MUST match backend's cookiePrefix storage: secureStoreAdapter, // REQUIRED: sync adapter with colon fix }), ], }); ``` ### Additional context Replace colons with underscores in storage keys: ```typescript const secureStoreAdapter = { getItem: (key: string) => { const normalized = key.replace(/:/g, '_'); return SecureStore.getItemAsync(normalized); }, setItem: (key: string, value: string) => { const normalized = key.replace(/:/g, '_'); return SecureStore.setItemAsync(normalized, value); }, removeItem: (key: string) => { const normalized = key.replace(/:/g, '_'); return SecureStore.deleteItemAsync(normalized); }, }; ```

GiteaMirror added the locked label 2026-04-13 06:13:55 -05:00

GiteaMirror closed this issue

2026-04-13 06:13:57 -05:00

GiteaMirror commented

2026-04-13 06:13:59 -05:00

@dosubot[bot] commented on GitHub (Oct 20, 2025):

This issue with colons in storage keys is known and has been discussed by other users. In Better Auth v1.3.28, storage keys for the Expo client may use colons, which are incompatible with expo-secure-store and cause silent failures. The recommended solution is to use a custom adapter that replaces colons with underscores before passing keys to SecureStore, as you’ve already implemented. There are no reported side effects with this approach, but make sure all storage operations consistently normalize keys.

Recent updates to the @better-auth/expo plugin have changed the default key separator from colon to underscore, making storage keys like myapp_cookie and myapp_session_data compatible with SecureStore out of the box. If you upgrade to the latest version, you should no longer need a custom adapter for key normalization—just use the default configuration and ensure your storagePrefix does not include any unsupported characters. For more details, see the relevant pull request and code reference.

If you’re staying on v1.3.28, keep using your adapter. If you upgrade, you can remove it and use SecureStore directly.

To reply, just mention @dosu.

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}

@dosubot[bot] commented on GitHub (Oct 20, 2025):  This issue with colons in storage keys is known and has been discussed by other users. In Better Auth v1.3.28, storage keys for the Expo client may use colons, which are incompatible with expo-secure-store and cause silent failures. The recommended solution is to use a custom adapter that replaces colons with underscores before passing keys to SecureStore, as you’ve already implemented. There are no reported side effects with this approach, but make sure all storage operations consistently normalize keys. Recent updates to the @better-auth/expo plugin have changed the default key separator from colon to underscore, making storage keys like `myapp_cookie` and `myapp_session_data` compatible with SecureStore out of the box. If you upgrade to the latest version, you should no longer need a custom adapter for key normalization—just use the default configuration and ensure your `storagePrefix` does not include any unsupported characters. For more details, see the relevant [pull request](https://github.com/better-auth/better-auth/pull/5393) and [code reference](https://github.com/better-auth/better-auth/blob/e6088121726f55a88a4c97e941449356d03834a5/packages/expo/src/client.ts). If you’re staying on v1.3.28, keep using your adapter. If you upgrade, you can remove it and use SecureStore directly.  *To reply, just mention [@dosu](https://go.dosu.dev/dosubot).* --- <sup>How did I do? [Good](https://app.dosu.dev/response-feedback/d8f26b01-19cd-4a53-9f7f-9ad4f12fbe12?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/d8f26b01-19cd-4a53-9f7f-9ad4f12fbe12?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/d8f26b01-19cd-4a53-9f7f-9ad4f12fbe12?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/d8f26b01-19cd-4a53-9f7f-9ad4f12fbe12?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/d8f26b01-19cd-4a53-9f7f-9ad4f12fbe12?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/d8f26b01-19cd-4a53-9f7f-9ad4f12fbe12?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/d8f26b01-19cd-4a53-9f7f-9ad4f12fbe12?feedback_type=other)</sup>  [![Chat with Dosu](https://dosu.dev/dosu-chat-badge.svg)](https://app.dosu.dev/cdda13d9-dd27-4d31-b09a-5d8bec92de21/ask?utm_source=github) [![Join Discord](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&label=)](https://go.dosu.dev/discord-bot) [![Share on X](https://img.shields.io/badge/X-share-black)](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/better-auth/better-auth/issues/5426)

GiteaMirror commented

2026-04-13 06:14:00 -05:00

@ping-maxwell commented on GitHub (Oct 20, 2025):

Hey are you aware of what case specifically was adding the colon? Like what the cookie name was
(We'll still implement the normalization like you suggested, was just curious what case caused this)

@ping-maxwell commented on GitHub (Oct 20, 2025): Hey are you aware of what case specifically was adding the colon? Like what the cookie name was (We'll still implement the normalization like you suggested, was just curious what case caused this)

GiteaMirror commented

2026-04-13 06:14:01 -05:00

@ingokpp commented on GitHub (Oct 20, 2025):

The cookie prefix is "elterngeldbuddy", so nothing special actually.

@ingokpp commented on GitHub (Oct 20, 2025): The cookie prefix is "elterngeldbuddy", so nothing special actually.

GiteaMirror commented

2026-04-13 06:14:02 -05:00

@ping-maxwell commented on GitHub (Oct 20, 2025):

And that was followed by a colon? Did you catch what was after the colon?

@ping-maxwell commented on GitHub (Oct 20, 2025): And that was followed by a colon? Did you catch what was after the colon?

GiteaMirror commented

2026-04-13 06:14:02 -05:00

@ingokpp commented on GitHub (Oct 20, 2025):

@ping-maxwell Yes! Better Auth was generating storage keys with this pattern:

${storagePrefix}:${keyName}

With storagePrefix: "elterngeldbuddy", it created:

Keys that failed:

elterngeldbuddy:cookie
elterngeldbuddy:session_data

SecureStore rejected these with:
Error: Invalid key provided to SecureStore.
Keys must not be empty and contain only alphanumeric characters, ".", "-", and "_".

After normalization (colons → underscores):

elterngeldbuddy_cookie ✅
elterngeldbuddy_session_data ✅

So it's not the cookie name that had the issue (those are like elterngeldbuddy.session_token), but the storage keys used to save them in SecureStore.

The colon separator appears to be how @better-auth/expo constructs storage keys internally, regardless of the prefix you choose.

@ingokpp commented on GitHub (Oct 20, 2025): @ping-maxwell Yes! Better Auth was generating storage keys with this pattern: ${storagePrefix}:${keyName} With storagePrefix: "elterngeldbuddy", it created: Keys that failed: - elterngeldbuddy:cookie - elterngeldbuddy:session_data SecureStore rejected these with: Error: Invalid key provided to SecureStore. Keys must not be empty and contain only alphanumeric characters, ".", "-", and "_". After normalization (colons → underscores): - elterngeldbuddy_cookie ✅ - elterngeldbuddy_session_data ✅ So it's not the cookie name that had the issue (those are like elterngeldbuddy.session_token), but the storage keys used to save them in SecureStore. The colon separator appears to be how @better-auth/expo constructs storage keys internally, regardless of the prefix you choose.

GiteaMirror commented

2026-04-13 06:14:03 -05:00

@ingokpp commented on GitHub (Oct 20, 2025):

This is the custom adapter i build which does the normalization:

import * as SecureStore from 'expo-secure-store';

/**
 * SecureStore adapter for Better Auth
 *
 * SecureStore doesn't allow colons in key names, but Better Auth uses
 * keys like "prefix:keyName". This adapter replaces colons with underscores.
 *
 * Valid SecureStore key characters: alphanumeric, ".", "-", "_"
 *
 * NOTE: Better Auth expects synchronous storage, but SecureStore is async.
 * This adapter uses an in-memory cache to provide sync access.
 */

const normalizeKey = (key: string): string => {
  // Replace colons with underscores to make keys compatible with SecureStore
  const normalized = key.replace(/:/g, '_');
  return normalized;
};

// In-memory cache for sync access
// Security Note: This cache stores tokens in plain memory for performance.
// The cache is:
// - Isolated to app's memory space (other apps cannot access)
// - Backed up to encrypted SecureStore
// - Cleared on logout (via removeItem)
// This is a recommended pattern for React Native auth tokens.
const cache = new Map<string, string | null>();

// Initialize cache from SecureStore on startup
const STORAGE_PREFIX = 'elterngeldbuddy'; // Must match storagePrefix in auth-client
const COOKIE_KEY = `${STORAGE_PREFIX}_cookie`;
const SESSION_DATA_KEY = `${STORAGE_PREFIX}_session_data`;

// Pre-load critical keys into cache
(async () => {
  try {
    const cookie = await SecureStore.getItemAsync(COOKIE_KEY);
    const sessionData = await SecureStore.getItemAsync(SESSION_DATA_KEY);

    if (cookie) {
      cache.set(COOKIE_KEY, cookie);
    }
    if (sessionData) {
      cache.set(SESSION_DATA_KEY, sessionData);
    }
  } catch (error) {
    console.error('[SecureStore Adapter] Error pre-loading cache:', error);
  }
})();

export const secureStoreAdapter = {
  // Sync method that reads from cache (Better Auth expects sync)
  getItem: (key: string): string | null => {
    const normalizedKey = normalizeKey(key);
    return cache.get(normalizedKey) ?? null;
  },

  // Sync method that writes to cache AND async to SecureStore
  setItem: (key: string, value: string): void => {
    const normalizedKey = normalizeKey(key);

    // Update cache immediately (sync)
    cache.set(normalizedKey, value);

    // Persist to SecureStore in background (async)
    SecureStore.setItemAsync(normalizedKey, value).catch(error => {
      console.error('[SecureStore Adapter] Error persisting to SecureStore:', error);
    });
  },

  // Sync method that removes from cache AND async from SecureStore
  removeItem: (key: string): void => {
    const normalizedKey = normalizeKey(key);

    // Remove from cache immediately (sync)
    cache.delete(normalizedKey);

    // Remove from SecureStore in background (async)
    SecureStore.deleteItemAsync(normalizedKey).catch(error => {
      console.error('[SecureStore Adapter] Error removing from SecureStore:', error);
    });
  },
};

/**
 * Security utility: Clear all cached auth data from memory
 * Call this on logout or when auth is no longer needed
 */
export const clearAuthCache = () => {
  cache.clear();
};

@ingokpp commented on GitHub (Oct 20, 2025): This is the custom adapter i build which does the normalization: ```typescript import * as SecureStore from 'expo-secure-store'; /** * SecureStore adapter for Better Auth * * SecureStore doesn't allow colons in key names, but Better Auth uses * keys like "prefix:keyName". This adapter replaces colons with underscores. * * Valid SecureStore key characters: alphanumeric, ".", "-", "_" * * NOTE: Better Auth expects synchronous storage, but SecureStore is async. * This adapter uses an in-memory cache to provide sync access. */ const normalizeKey = (key: string): string => { // Replace colons with underscores to make keys compatible with SecureStore const normalized = key.replace(/:/g, '_'); return normalized; }; // In-memory cache for sync access // Security Note: This cache stores tokens in plain memory for performance. // The cache is: // - Isolated to app's memory space (other apps cannot access) // - Backed up to encrypted SecureStore // - Cleared on logout (via removeItem) // This is a recommended pattern for React Native auth tokens. const cache = new Map<string, string | null>(); // Initialize cache from SecureStore on startup const STORAGE_PREFIX = 'elterngeldbuddy'; // Must match storagePrefix in auth-client const COOKIE_KEY = `${STORAGE_PREFIX}_cookie`; const SESSION_DATA_KEY = `${STORAGE_PREFIX}_session_data`; // Pre-load critical keys into cache (async () => { try { const cookie = await SecureStore.getItemAsync(COOKIE_KEY); const sessionData = await SecureStore.getItemAsync(SESSION_DATA_KEY); if (cookie) { cache.set(COOKIE_KEY, cookie); } if (sessionData) { cache.set(SESSION_DATA_KEY, sessionData); } } catch (error) { console.error('[SecureStore Adapter] Error pre-loading cache:', error); } })(); export const secureStoreAdapter = { // Sync method that reads from cache (Better Auth expects sync) getItem: (key: string): string | null => { const normalizedKey = normalizeKey(key); return cache.get(normalizedKey) ?? null; }, // Sync method that writes to cache AND async to SecureStore setItem: (key: string, value: string): void => { const normalizedKey = normalizeKey(key); // Update cache immediately (sync) cache.set(normalizedKey, value); // Persist to SecureStore in background (async) SecureStore.setItemAsync(normalizedKey, value).catch(error => { console.error('[SecureStore Adapter] Error persisting to SecureStore:', error); }); }, // Sync method that removes from cache AND async from SecureStore removeItem: (key: string): void => { const normalizedKey = normalizeKey(key); // Remove from cache immediately (sync) cache.delete(normalizedKey); // Remove from SecureStore in background (async) SecureStore.deleteItemAsync(normalizedKey).catch(error => { console.error('[SecureStore Adapter] Error removing from SecureStore:', error); }); }, }; /** * Security utility: Clear all cached auth data from memory * Call this on logout or when auth is no longer needed */ export const clearAuthCache = () => { cache.clear(); }; ```

GiteaMirror commented

2026-04-13 06:14:04 -05:00

@ping-maxwell commented on GitHub (Oct 20, 2025):

Okay got it, thanks for the detailed response!

@ping-maxwell commented on GitHub (Oct 20, 2025): Okay got it, thanks for the detailed response!

Sign in to join this conversation.

Branches Tags

dependabot/npm_and_yarn/demo/electron/demo-minor-patch-227a091249

dependabot/github_actions/github-actions-98f3470200

2026-05-13/ci/stabilize-docker-startup

dependabot/npm_and_yarn/samlify-2.13.0

changeset-release/main

main

2026-05-22/chore/adopt-agents-md

2026-05-22/refactor/string-case-utils

2026-05-14/fix/passkey-verify-error-and-claim

changeset-release/next

client-assertions-main

2026-05-15/ci/fix-sqlite-abi-mismatch

2026-05-15/fix/organization-team-add-cascade

2026-05-15/fix/parse-set-cookie-value-validation

2026-05-13/feat/captcha-wildcard-endpoints

fix/i18n-before-hook-translation

fix/disable-migration-generate

2026-05-07/fix/admin-set-password-upsert

2026-05-10/fix/cookie-drain-order

2026-05-10/feat/hooks-finally

2026-05-09/fix/cookie-drain-order

2026-05-09/feat/hooks-finally

2026-05-08/feat/register-before-send

fix/stripe/subscription-data-merge

2026-05-01/chore/pnpm-v11-harden

chore/pnpm-v11

2026-04-29/feat/google-include-granted-scopes

2026-04-29/fix/oauth-account-scope-semantics

2026-04-27/fix/nextcookies-idempotent-writes

2026-04-26/fix/harden-proxy-host-validation

2026-04-26/refactor/stripe-callback-signature-cleanup

2026-04-26/fix/stripe-subscription-callback-timing

2026-04-11/fix/sveltekit-app-modules

feat/open-api-zod-contract

feat/oauth-provider-backchannel-logout-next

feat/oauth-idp-initiated-bounce

refactor/sign-in-challenges

2026-04-21/fix/oauth-rfc-input-validation

fix/release-notes-new-packages

fix/two-factor-identity-guard

fix/resource

feat/emailpassword-authorize

2026-04-12/security/dynamic-baseurl-proxy-trust-default

feat/oauth-provider-at-hash-v2

fix/release-grep-fallback

claude/address-review-comments-JhFLr

claude/slack-update-stripe-docs-consistency-8Sc0w

feat/async-auth

fix/two-factor-totp-verified-enrollment

feat/plugin-ui

codex/blog-1-6-release-post

2026-04-06/fix/type-any-guards

2026-04-05/chore/downgrade-better-call

2026-04-04/ci/skip-vercel-fork-prs

2026-03-28/ci/add-autofix-ci

chore/release-preview-script

himself65/2026/02/19/role

2026-03-24/fix/update-user-info-on-link

2026-03-20/docs/improve-website

2026-03-20/fix/anonymous-onlinkaccount-expo

2026-02-17/fix/anonymous-link-state

fix/8607-saml-inresponseto

fix/8549-scim-patch-noop

v1.4.x

refactor/migration-snapshot-tests

worktree-magic-link-additional-data

chore/migrate-build-to-rollup

worktree-fix-dynamic-baseurl-8447

2026-03-06/chore/public-api-check

fix/close-8156-regression-test

fix/secondary-storage-json-error-handling

himself65/verification-namespace

cursor/issue-8307-validation-79a3

himself65/2026/01/30/error-mdx

v1.4.x-staging

fix/email-otp-user

fix/restrict-full-organization-access-roles

himself65/2026/02/12/count

himself65/2026/02/04/define-plugin

2026-02-04/feat/add-pluralize

cursor/better-auth-js-integration-ec21

cursor/expo-state-mismatch-394c

2026-02-01/fix/org-update-role-sync-members

cursor/issue-7607-investigation-e146

cursor/email-generation-helper-0ff6

himself65/2026/01/21/avoid-spread-operator

himself65/2026/01/14/cli

claude/slack-add-docs-pr-NMvgO

claude/slack-add-advanced-useplural-WHKYL

feat/hooks-pos

feat/2fa-phone

feat/2fa

fix/rotation

fix/username-check

v1.3.x

refactor/organization

feat/multiple-client-ids-social-providers

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/better-auth#10240