Gate EAS Update

EAS CLI publishes with an Expo access token in the EXPO_TOKEN environment variable. Mocco holds that token and releases it to your publishing step after the gate. Set up Release a token to your pipeline first; this page covers the Expo side.

Create the token

Use a robot user rather than a person's token. A personal access token acts as that person across every Expo account they can reach, while a robot user belongs to one account, can't sign in, and gets only the role you give it. Give it the Developer role, which can publish updates. Then create an access token for it on the account's access token settings. See Expo's programmatic access and roles pages.

Expo doesn't let you limit a token to one project or one channel. On the Enterprise plan, protected channels limit publishing to production to the Release Manager role; without them the Release Manager role has the same access as Developer.

Store the token on Mocco's OTA updates page, on the Your OTA tool tab, with the tool EAS Update, for example as acme-production. Its provider id is ota-eas.

Publish

In the publishing job from the pipeline guide, export the released token as EXPO_TOKEN and run eas update without prompts. The project must already be linked to EAS (extra.eas.projectId in your app config):

      - name: Get the publishing token from Mocco
        run: |
          # … as in the pipeline guide …
          echo "EXPO_TOKEN=$secret" >> "$GITHUB_ENV"

      - uses: actions/setup-node@v4
        with: { node-version: 22 }
      - run: npm ci
      - run: npx eas-cli@latest update --channel production --environment production --message "${{ github.event.client_payload.commitSha }}" --non-interactive

--environment is required from Expo SDK 55. --rollout-percentage 10 publishes to a share of devices first, and -p ios or -p android limits the platform. See the EAS CLI reference.

Roll back

Run the rollback in your second pipeline (the one whose gate the on-call engineer approves alone), with the same released token:

npx eas-cli@latest update:rollback <update group id> --message "Roll back" --non-interactive

It republishes the update group before the one you name, or goes back to the build's embedded bundle when there is none. eas update:roll-back-to-embedded --channel production --runtime-version <version> --non-interactive goes straight to the embedded bundle.

Rotate

Create a new access token for the robot user, choose Rotate on the token's card in Mocco and paste it, then delete the old token in Expo. The fingerprint on the card changes.