fix: persist mobile sessions by matching the API auth cookie prefix

[adelrodriguez]

Stacked on #151. Flagged there by review: the generated Expo auth client has never persisted a session, against either cookie prefix. @better-auth/expo gates all cookie storage behind a startsWith(cookiePrefix) check that defaults to "better-auth", and our expoClient wrapper never passed cookiePrefix — so every init.* (and now init-api.*) cookie the API issues was silently dropped and mobile users were signed out on every app restart.

The wrapper now passes the API's cookie prefix, since the generated mobile client targets apps/api (EXPO_PUBLIC_API_URL=http://localhost:3000). Callers can still override it via the options spread when pointing at a different backend.

Along the way the init-api prefix moved from an inline template literal in apps/api into AUTH_API_COOKIE_PREFIX in packages/auth/src/constants.ts, so both sites that must agree on it — the API's auth instance and the Expo client — read one constant.

Written by Claude Fable 5 via Claude Code.

🤖 Generated with Claude Code

[pullfrog]

Pullfrog stalled — likely cause: quota error

The agent stopped emitting events for 120s and was killed by the activity-timeout watchdog. 88 events were processed before the failure.

Recent agent stderr

timestamp=2026-08-23T16:20:45.846Z level=ERROR run=80ef9d06 message="stream error" providerID=opencode modelID=claude-opus-5 session.id=ses_fd0936035ffeSBoDC2yZi0QsBO small=false agent=build mode=primary error.error="AI_APICallError: Subscription quota exceeded. Retry in 7hr 40min."

  ^{｜ Rerun failed job ➔ ｜ View workflow run ｜ via Pullfrog ｜ Using Claude Opus ｜ 𝕏}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
init	Ready	Preview	Aug 27, 2026 5:03am
init-docs	Ready	Preview	Aug 27, 2026 5:03am

[pullfrog]

Important

The new shared default breaks session persistence for the generated Convex mobile client and must be corrected before merge.

Reviewed changes

Reviewed the complete rebased authentication change because no earlier Pullfrog review exists.

• Centralized the API prefix: Added AUTH_API_COOKIE_PREFIX and used it in the Hono API auth configuration.
• Changed Expo cookie filtering: Made the shared Expo client default to the Hono API's init-api cookie prefix while retaining caller overrides.

  ^{｜ Fix all ➔ ｜ Fix 👍s ➔ ｜ View workflow run ｜ Using GPT Sol ｜ 𝕏}

[adelrodriguez]

claude-fable-5 (on behalf of Adel):

Good catch — confirmed against packages/backend/src/functions/shared/auth.ts (Convex uses the un-namespaced AUTH_ADVANCED_OPTIONS, so it issues init.*) and the Convex mobile template, which relies on the wrapper default. Fixed in 8e712d4 with your suggested shape: the shared wrapper defaults to the backend-neutral AUTH_COOKIE_PREFIX, and the Hono mobile template passes cookiePrefix: AUTH_API_COOKIE_PREFIX explicitly. Both generated clients now match their backend's cookie names.

[pullfrog]

✅ No new issues found.

Reviewed changes

Reviewed the backend-neutral cookie-prefix correction added since the prior Pullfrog review.

• Restored the shared prefix: Changed the Expo wrapper default to AUTH_COOKIE_PREFIX, which preserves Convex mobile sessions.
• Scoped the Hono override: Passed AUTH_API_COOKIE_PREFIX from the Hono mobile auth template, so generated API clients persist init-api.* cookies.

  ^{｜ View workflow run ｜ Using GPT Sol ｜ 𝕏}