Expo Updatesprotocol v1
Over-the-air updates you host yourself
The Expo Updates server, running on your own Cloudflare account.
Everything a release needs
-
Apps verify every manifest and rollback directive against the certificate embedded in their native build.
-
Keep staging and production in one deployment, with a separate update stream behind each channel.
-
Start at a percentage of devices and raise it to 100%. Overlapping rollouts for the same branch, platform and runtime are refused.
-
Return each native build to its previous update or to embedded JavaScript, with the affected device count shown before you confirm.
-
Content-addressed assets are deduplicated and cached. Optional
bsdiffpatches shrink downloads, with full bundles as the fallback. -
Adoption, failed updates, runtime versions and country breakdowns come from client check-ins, with no extra telemetry SDK.
Deploy it once.
Publish as often as you like
Alchemy provisions the whole stack in your Cloudflare account, and the CLI does the rest from your app repository.
-
One
pnpm cloud:deploy:prodcreates the Workers, the D1 database, the R2 bucket, the Analytics Engine dataset and the Access policy in front of the dashboard. -
open-ota initwrites the update URL, channel, signing settings and runtime policy into your app config, then runs doctor over the result. -
open-ota publishchecks the app and server, exports both platforms, uploads missing assets and publishes one update group.
FAQs
No. Open OTA implements Expo Updates protocol version 1 and serves the standard expo-updates client, so your app talks to your own server instead of EAS.
Open OTA is MIT licensed. You pay Cloudflare for the Workers, D1, R2 and Analytics Engine usage in your own account, and nothing to us.
Any client that speaks Expo Updates protocol version 1. The server matches on platform and runtime version and never reads an SDK version; protocol 0 requests are rejected. It is developed and verified against SDK 57.
In your Cloudflare account. Update metadata and device check-ins go to D1, assets to R2, and check and asset events to Analytics Engine. The dashboard sits behind Cloudflare Access.
Not today. One deployment serves one app across its channels. Multi-app hosting, per-device targeting and percentage splits between branches are outside the current scope.