Kembo blog
Weekly notes on building Kembo and shipping mobile apps — product updates, auth, store releases, and whatever we are learning along the way.
The gap between a working prototype and a shippable app is full of unglamorous, easy-to-forget work — auth on real devices, account deletion, store disclosures, analytics. Here is the complete pre-launch checklist for mobile, with the order that saves you a week.
Sooner or later a customer asks to manage their own team inside your app — invite people, see who's in, remove someone. Building secure role-based access on mobile is trickier than it looks. Here is how to do it without leaking admin powers to every device.
GDPR sounds like a legal project that stalls your launch. For most mobile apps it comes down to a handful of concrete decisions about data, consent, and deletion. Here is a practical checklist that keeps you compliant without grinding development to a halt.
Most mobile users decide whether to stay in the first session — often the first minute. The biggest, most-overlooked leak in that flow is the sign-in screen. Here is how to design onboarding that gets users to their activation moment instead of bouncing.
Flutter gives you the sign-in widgets, but the hard parts — verifying tokens, minting sessions, secure storage, and per-platform OAuth config — are still yours. Here is how Flutter authentication really works and how to skip the repetitive plumbing.
Adding Google and Apple sign-in to an Expo app means dev builds, redirect schemes, secure storage, and a pile of native config. Here is the practical, current path to social login in Expo — what to use, what trips people up, and how to skip the boilerplate.
Both Apple and Google require apps with account sign-up to offer in-app account deletion — and reviewers reject builds that don't. Here is exactly what the policies demand, the traps that fail review, and how to implement deletion the right way.
Sign-in is the easy part. Keeping a mobile user logged in safely — short-lived access tokens, rotating refresh tokens, and storage that survives an offline week without leaking — is where real apps get it wrong. Here is how mobile sessions actually work.
redirect_uri_mismatch. Error 10. DEVELOPER_ERROR. Google sign-in on mobile fails in ways that make no sense until you understand OAuth client types, SHA-1 fingerprints, and Play App Signing. Here is the mental model that makes all of it click.
Sign in with Apple is mandatory the moment you offer Google login — and it is the auth that quietly breaks during App Review. Here is every gotcha that bites mobile teams, from the relay email to the name you only get once, and how to get it right on Expo, Flutter, and Capacitor.
Most mobile analytics SDKs track individuals, trip up App Store and Play review, and drown you in vanity metrics. Here is how to measure what actually grows a mobile app — by cohort, not by person — with no cookies and no ad trackers.
Apple and Google sign-in are not a nice-to-have — they are the hidden gate between “works on my phone” and “live on the App Store or Google Play.” Here is why that week always eats your roadmap.
Building something with Kembo? Read the docs or start free.