PocketBill Blog
The feature took a week and not one hour of it went into the feature. A Web-type OAuth client cannot host the app's own callback, two same-named projects made a credentials page look empty, Git for Windows mangled a file:// path, eas credentials wanted a terminal so the fingerprint came from GraphQL, a dependency's stylesheet crashed the build, and on Play you should keep your own signing key.
PocketBill is a bill and subscription tracker that needs no account — you open it, your numbers are there, and it keeps working on a plane. Google sign-in was meant to be optional, a convenience for people who want the same records on a second device. I blocked out one afternoon for it.
It took a week. Not one outage, not one crash in production — just a dozen tiny traps, each worth a few hours of confusion, and most of them documented only after the time was already gone. Here is the pile.
A Google "Web" OAuth client only accepts `https://` or `http://localhost` as a redirect URI. Our own callback — `pocketbill://` — can only ever live on the native Android and iOS clients. Nothing was misconfigured. That field was simply the wrong home for it, and no error message says so.
Then the credentials page looked empty. It was not empty; there were two Cloud projects both named PocketBill, and I was reading the wrong one. Two identical names, one blank screen, an hour gone. Later, EAS ran a `git clone` against `file:///D:/PocketBill` and Git for Windows rewrote that path into something EAS could not resolve — repaired with a global URL rewrite. And `eas credentials` wants an interactive terminal, so the keystore fingerprint I needed came back through EAS's GraphQL API instead: project, credentials list, keystore, sha1, one request.
One build died inside a dependency's own stylesheet. A decoration layer parsed `aspect-ratio: 1` as though it were always a two-part list, then indexed into nothing and threw — not our code, not our screen. We guarded the parse and pinned the fix with patch-package plus a postinstall hook, so a clean `npm install` replays the correction instead of rediscovering the same crash three months from now.
Signing is the choice to take seriously. On Play, do not let Google generate your signing key — keep your own. Hand that over and every SHA-1 fingerprint you registered across the consoles goes stale in a single moment, and you get to rebuild the whole paper trail from scratch.
PocketBill's promise is that it stays out of the way: no account, works offline, opens the instant you tap it. An optional door should never break that. None of the week went into the feature itself. All of it went into making sure the feature stayed optional.