expo-api-routes

Use API routes when you need: Avoid API routes when: API routes live in the app directory with +api.ts suffix: Export named functions for each HTTP method: Use process.env for server-side secrets: Set environment variables: Add CORS for web clients: Start the development server with API routes: This starts a local server at with full API route support. Test with curl: This builds and deploys your API routes to EAS Hosting (Cloudflare Workers). Configure in eas.json or Expo dashboard. API routes run on Cloudflare Workers. Key limitations: Since filesystem is unavailable, use cloud databases: Example with Turso: - Server-side secrets — API keys, database credentials, or tokens that must never reach the client - Database operations — Direct database queries that shouldn't be exposed - Third-party API proxies — Hide API keys when calling external services (OpenAI, Stripe, etc.) - Server-side validation — Validate data before database writes - Webhook endpoints — Receive callbacks from services like Stripe or GitHub - Rate limiting — Control access at the server level - Heavy computation — Offload processing that would be slow on mobile - Data is already public — Use direct fetch to public APIs instead - No secrets required — Static data or client-safe operations - Real-time updates needed — Use WebSockets or services like Supabase Realtime - Simple CRUD — Consider Firebase,...