Kembo blog
Weekly notes on building Kembo and shipping mobile apps — product updates, auth, store releases, and whatever we are learning along the way.
Both Apple and Google require apps with account sign-up to offer in-app account deletion — and reviewers reject builds that don't. Here is exactly what the policies demand, the traps that fail review, and how to implement deletion the right way.
Sign-in is the easy part. Keeping a mobile user logged in safely — short-lived access tokens, rotating refresh tokens, and storage that survives an offline week without leaking — is where real apps get it wrong. Here is how mobile sessions actually work.
redirect_uri_mismatch. Error 10. DEVELOPER_ERROR. Google sign-in on mobile fails in ways that make no sense until you understand OAuth client types, SHA-1 fingerprints, and Play App Signing. Here is the mental model that makes all of it click.
Sign in with Apple is mandatory the moment you offer Google login — and it is the auth that quietly breaks during App Review. Here is every gotcha that bites mobile teams, from the relay email to the name you only get once, and how to get it right on Expo, Flutter, and Capacitor.
Most mobile analytics SDKs track individuals, trip up App Store and Play review, and drown you in vanity metrics. Here is how to measure what actually grows a mobile app — by cohort, not by person — with no cookies and no ad trackers.
Apple and Google sign-in are not a nice-to-have — they are the hidden gate between “works on my phone” and “live on the App Store or Google Play.” Here is why that week always eats your roadmap.
Building something with Kembo? Read the docs or start free.