Skip to content

Expo Push Token

Service Name: Expo Push Notifications

Service Description: Expo Push Notifications is a service that allows developers to send push notifications to mobile devices running Expo or React Native applications. It provides a simple way to engage with users through notifications even when they're not actively using the app.

Service Address: https://expo.dev/

Validation Type: -

IP Allow list: Does not exist

Secret Access Scope: Allows sending push notifications to specific devices that have registered with the Expo push notification service.

Secret Revokement URL: https://docs.expo.dev/push-notifications/sending-notifications/#credentials

Secret Example: ExponentPushToken[xxxxxxxxxxxxxxxxxxxxxx]

Suspicious Activity Investigation Instructions:

  • Review Expo notification logs for unauthorized notification sends
  • Check for unusual patterns in notification delivery or frequency
  • Monitor for notifications sent to users who haven't opted in
  • Verify if notifications contain suspicious content or links
  • Review application logs for unauthorized token generation or usage

Mitigation Instructions:

  • Rotate the compromised push notification credentials in the Expo dashboard
  • Revoke the specific token through the Expo API

  • Update your application to generate new tokens for affected users

  • Implement additional authentication for your notification sending service

  • Add rate limiting to your notification sending infrastructure
  • Notify users of potential unauthorized notifications
  • Review and strengthen your token storage security practices