How do you handle runtime permissions?

iOS and Android both require declarations, but the mechanics differ. iOS uses Info.plist usage descriptions and shows a system prompt once per permission. Android uses the manifest plus runtime requests for dangerous permissions, and a second denial can make the system stop prompting.

import * as ImagePicker from "expo-image-picker";

export async function pickPhoto() {
  const permission = await ImagePicker.requestMediaLibraryPermissionsAsync();

  if (!permission.granted) {
    return { status: "denied" as const };
  }

  const result = await ImagePicker.launchImageLibraryAsync({
    mediaTypes: ImagePicker.MediaTypeOptions.Images,
    quality: 0.8,
  });

  return result.canceled ? { status: "cancelled" as const } : { status: "ok" as const, assets: result.assets };
}

A permission flow that respects users

• Show a short in-app rationale before the system prompt, not after a denial
• Request only the permission needed for the current action
• Handle granted, denied and permanently denied states distinctly
• Offer a settings deep link when the OS will no longer prompt
• Keep the feature usable or gracefully disabled when permission is denied

App review rejects requests for permissions the app does not visibly use, and iOS requires purpose strings that explain the benefit. Some permissions, such as background location or Bluetooth scanning, have additional policy requirements and may need justification.