React Native and mobile

Choose a safe mobile ingest path

React Native apps run on customer devices. Never put a privileged Telemio server key in a mobile bundle.

Provision a client-safe key bound to an application identifier, or send events to an authenticated gateway you operate. Gateways can validate requests, redact attributes, batch telemetry and attach the privileged server key.

Instrument a screen or checkout action

With a gateway in place, call a backend endpoint from the app. Let your backend or native OpenTelemetry layer export OTLP; avoid shipping server secrets.

async function recordCheckoutStarted(cartSize: number): Promise<void> {
  const response = await fetch("https://api.example.com/mobile-events", {
    method: "POST",
    headers: { "content-type": "application/json" },
    body: JSON.stringify({
      event: "checkout.started",
      attributes: { "cart.size": cartSize, "app.platform": "react-native" }
    })
  })

  if (!response.ok) {
    throw new Error("Mobile telemetry gateway rejected event")
  }
}

The /mobile-events route is an example endpoint that you must implement. Authenticate, validate rate limits, and enforce a whitelist of event names and attributes on the backend.

Export from the trusted gateway

The backend can use @telemio/sdk to export approved client events.

import { createTelemio } from "@telemio/sdk"

const telemetry = createTelemio({
  apiKey: process.env.TELEMIO_API_KEY,
  serviceName: "mobile-telemetry-gateway",
  environment: "production"
})

export async function recordVerifiedMobileEvent(cartSize: number) {
  await telemetry.track("checkout.started", {
    "app.platform": "react-native",
    "cart.size": cartSize
  })
}

Call this function only after the server authenticates and validates the incoming payload. For native screen spans and network timing, use supported platform OpenTelemetry instrumentation and propagate traceparent on backend requests.

Verify on device

Test a cold launch, a resumed app, loss of connectivity and a checkout request.

Confirm the events arrive under the expected gateway service, and that no privileged key is embedded in your Android APK, iOS app, source map, or JavaScript bundle. Read native mobile and client-safe ingestion.