Auth sits behind one adapter. Your screens call useAuth() and useOptionalAuth() and never know which provider is underneath.
What is wired today
# apps/mobile/.env
EXPO_PUBLIC_AUTH_PROVIDER=customCustom JWT is the one that works out of the box. It talks to the bundled backend, or to any backend that implements the documented contract, and gives you email and password sign-in, refresh-token rotation, forgot and reset password, social sign-in, and account deletion.
Clerk and Better Auth are slots, not switches
In apps/mobile/lib/auth.ts the clerk and better-auth branches are commented out. Setting EXPO_PUBLIC_AUTH_PROVIDER=clerk today does not raise an error and does not switch providers. It falls through to the default and you keep using Custom JWT, silently. We tested this and signed in against the bundled backend with the provider set to clerk.
Switching for real means three steps, not one:
pnpm --filter mobile add @clerk/clerk-expo- uncomment the import and the
case 'clerk':branch inapps/mobile/lib/auth.ts - set
EXPO_PUBLIC_AUTH_PROVIDER=clerkand your publishable key
Budget an hour. The value of the adapter is that your screens do not change, not that the swap is free.
packages/auth/src/adapters/better-auth.ts is further back still: it is a stub that throws until you finish it. The file tells you what to do.
Social sign-in
Sign in with Apple and Google are wired for Custom JWT. The backend verifies the identity token against Apple's and Google's public keys with jose. That is real server-side verification, not trusting whatever the client sends.
Both need developer accounts and client IDs, and both need a development build. Expo Go cannot include the native modules.
Apple requires account deletion
Any app that lets users create an account must let them delete it (App Store guideline 5.1.1(v)). The boilerplate ships DELETE /me and a delete-account flow, so you pass that check.
No-login apps
Building a calculator, a habit tracker, or an offline tool?
EXPO_PUBLIC_AUTH_ENABLED=falseRestart the dev server. The sign-in wall is gone, the account controls disappear from the home screen, and the (auth) folder is safe to delete. Everything else, offline, analytics, payments, native APIs, keeps working. This one really is a single env var, and we verified it.