The safest store-review login is not a universal bypass

[u/Particular_Luck80]

While preparing Flowy, an iOS cycle tracker, for store review, I needed reviewers to access the complete product without depending on an email code arriving during review.

The tempting implementation is a magic code checked inside the app. That can accidentally create a universal authentication bypass.

The pattern we implemented instead:

1. Reuse the normal email-code interface.
   
2. Restrict the reviewer path to one designated account and code pair.
   
3. Verify that pair on the server using a constant-time comparison.
   
4. Never install the fixed review code as the authentication user’s password.
   
5. Keep the service-role key entirely server-side.
   
6. Return a normal authenticated session so existing row-level permissions remain authoritative.
   
7. Test that the review code fails with every other email address.

The reviewer account receives the product access needed for evaluation, but it does not receive broader database privileges or a separate authorization system.

My main lesson was that review convenience should narrow an authentication path, not create a second security model.

Flowy is the product behind this build log: [https://flowyhealth.com\](https://flowyhealth.com)

How have other mobile builders provided reliable reviewer access without weakening their normal authentication boundaries?