test(expo): read the Platform API key from MOBILE_VERIFICATION_PLATFORM_API_KEY

.changeset/expo-native-mobile-verification-key.md

@@ -0,0 +1,2 @@
+---
+---

.claude/skills/verify-clerk-expo/SKILL.md

@@ -21,7 +21,7 @@ Set up each machine once.
 
 1. Install Node 24, at 24.15.0 or newer, which the `pnpm install` below needs. For a local iOS device, install Xcode with an iOS simulator runtime. For a local Android device, install Android Studio with the SDK, the emulator, and Java 21. The CLI looks for the SDK in `ANDROID_HOME`, `ANDROID_SDK_ROOT`, and `~/Library/Android/sdk`.
 2. Create the iOS template simulator, which the CLI clones to make each simulator it drives, with `xcrun simctl create "Clerk Verify Template iOS" "iPhone Air"`. That makes a new simulator that holds only the system's apps. Do not clone a simulator you already use: a clone holds every app of the original, and those apps show on the home screen at the start of a video. Boot the template once and shut it down: a clone of a template that never booted takes about twenty seconds longer to boot. `doctor` says when a system HTTPS proxy needs its CA trusted there. Android needs no template: the first `up --platform android` writes the `Clerk_Verify_Pixel` AVD.
-3. Give the machine the team's Clerk Platform API key. Set `CLERK_PLATFORM_API_KEY` to the key. Or set `CLERK_PLATFORM_API_KEY_FILE` to a file that holds it and that only you can read (mode 0600). Or set `VERIFY_PLATFORM_KEY_REFERENCE` to the key's 1Password secret reference, which the 1Password CLI reads once a person approves the request in the 1Password app, within 60 seconds. Never put the key or the reference in a file inside a repository.
+3. Give the machine the team's Clerk Platform API key. Set `MOBILE_VERIFICATION_PLATFORM_API_KEY` to the key. Or set `MOBILE_VERIFICATION_PLATFORM_API_KEY_FILE` to a file that holds it and that only you can read (mode 0600). Or set `MOBILE_VERIFICATION_PLATFORM_API_KEY_REFERENCE` to the key's 1Password secret reference, which the 1Password CLI reads once a person approves the request in the 1Password app, within 60 seconds. Never put the key or the reference in a file inside a repository.
 4. Install ffmpeg (`brew install ffmpeg`), which `attach --video` uses to cut the video to the part that `host.evidence` marks. Without it, `attach` posts the whole video and says that ffmpeg is not installed.
 5. Install simslim (`brew install mobai-app/tap/simslim`), so that each local iOS simulator boots without its background services and uses about a quarter of the memory. `doctor` says whether it is installed. Set `VERIFY_SIMSLIM=0` to boot stock simulators.
 

.claude/skills/verify-clerk-expo/references/instances.md

@@ -85,7 +85,7 @@ An array leaf is set whole: name every value it keeps. The standard values are i
 
 ## The credential
 
-One team key creates, changes, and deletes the application, and reads its secret key. The key needs four scopes: `applications:read`, `applications:manage`, `applications:delete`, and `application_secret_keys:read`. The CLI reads `CLERK_PLATFORM_API_KEY` first, then the file that `CLERK_PLATFORM_API_KEY_FILE` names. A variable that is set and does not work is an error. With neither variable set, the CLI reads the key's 1Password secret reference from `VERIFY_PLATFORM_KEY_REFERENCE` and asks the 1Password CLI for the key. The 1Password app then asks a person to approve, and a refused or unanswered request is an error.
+One team key creates, changes, and deletes the application, and reads its secret key. The key needs four scopes: `applications:read`, `applications:manage`, `applications:delete`, and `application_secret_keys:read`. The CLI reads `MOBILE_VERIFICATION_PLATFORM_API_KEY` first, then the file that `MOBILE_VERIFICATION_PLATFORM_API_KEY_FILE` names. A variable that is set and does not work is an error. With neither variable set, the CLI reads the key's 1Password secret reference from `MOBILE_VERIFICATION_PLATFORM_API_KEY_REFERENCE` and asks the 1Password CLI for the key. The 1Password app then asks a person to approve, and a refused or unanswered request is an error.
 
 Before it asks 1Password, the CLI sends one request with no key. In a cloud environment that holds the key as an API credential for `api.clerk.com`, the environment adds the key after the request leaves the machine, so that request succeeds and no key is ever in the session. The output then names the source as `a key attached outside this machine (no key is in this process)`. [Remote devices](remote.md) has the setup.
 

.github/workflows/verify-e2e.yml

@@ -138,7 +138,7 @@ jobs:
       - name: Build the fixture and boot a device
         timeout-minutes: 30
         env:
-          CLERK_PLATFORM_API_KEY: ${{ secrets.MOBILE_VERIFICATION_PLATFORM_API_KEY }}
+          MOBILE_VERIFICATION_PLATFORM_API_KEY: ${{ secrets.MOBILE_VERIFICATION_PLATFORM_API_KEY }}
           VERIFY_SIMSLIM: ${{ matrix.platform == 'ios' && '1' || '' }}
           SIMSLIM_BOOT_TIMEOUT: 15m
           SIMSLIM_SPAWN_TIMEOUT: 5m
@@ -182,15 +182,15 @@ jobs:
       - name: Run the end-to-end tests
         timeout-minutes: 30
         env:
-          CLERK_PLATFORM_API_KEY: ${{ secrets.MOBILE_VERIFICATION_PLATFORM_API_KEY }}
+          MOBILE_VERIFICATION_PLATFORM_API_KEY: ${{ secrets.MOBILE_VERIFICATION_PLATFORM_API_KEY }}
           GITHUB_TOKEN: ${{ github.token }}
         run: |
           "$CLI" run --all --platform "$PLATFORM" --backend local --retries 1 --max-failures 5 --github-report
 
       - name: Release the device and delete the Clerk application
         if: always() && steps.install.outcome == 'success'
         env:
-          CLERK_PLATFORM_API_KEY: ${{ secrets.MOBILE_VERIFICATION_PLATFORM_API_KEY }}
+          MOBILE_VERIFICATION_PLATFORM_API_KEY: ${{ secrets.MOBILE_VERIFICATION_PLATFORM_API_KEY }}
         run: |
           "$CLI" down
 

integration/expo-native/package.json

@@ -7,7 +7,7 @@
     "typecheck": "tsc -p ."
   },
   "devDependencies": {
-    "@clerk/internal-mobile-e2e": "github:clerk/internal-mobile-e2e#6db71a0aaa96eb6436ee63104ad22a9a70ebf55d",
+    "@clerk/internal-mobile-e2e": "github:clerk/internal-mobile-e2e#0889a2d95f23f0bb43a615a931d4dca742f9acba",
     "@types/node": "24.19.1",
     "typescript": "7.0.2"
   },

integration/expo-native/test/host.test.ts

@@ -99,9 +99,9 @@ describe('a step of the test app build', () => {
     const scratch = mkdtempSync(join(tmpdir(), 'verify-build-step-'));
     const before = { ...process.env };
     const set = {
-      CLERK_PLATFORM_API_KEY: 'ak_platform',
-      CLERK_PLATFORM_API_KEY_FILE: '/home/x/key',
-      VERIFY_PLATFORM_KEY_REFERENCE: 'op://vault/item',
+      MOBILE_VERIFICATION_PLATFORM_API_KEY: 'ak_platform',
+      MOBILE_VERIFICATION_PLATFORM_API_KEY_FILE: '/home/x/key',
+      MOBILE_VERIFICATION_PLATFORM_API_KEY_REFERENCE: 'op://vault/item',
       CLERK_SECRET_KEY: 'sk_test_instance',
       AI_GATEWAY_API_KEY: 'vck_gateway',
       AI_GATEWAY_API_KEY_FILE: '/home/x/gateway',