diff --git a/.circleci/config.yml b/.circleci/config.yml
index 6c98d46..4237dfd 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -20,7 +20,7 @@ executors:
     resource_class: m4pro.medium
 
 jobs:
-  test-android:
+  test-rn-webcrypto-android:
     executor:
       name: android/android_machine
       resource_class: large
@@ -52,7 +52,7 @@ jobs:
           path: packages/react-native-webcrypto-bridge/android/build/reports
           destination: android-test-reports
 
-  test-ios:
+  test-rn-webcrypto-ios:
     executor: macos
     steps:
       - checkout
@@ -80,9 +80,71 @@ jobs:
           path: packages/react-native-webcrypto-bridge/ios/.build
           destination: ios-build-artifacts
 
+  test-rn-platform-android:
+    executor:
+      name: android/android_machine
+      resource_class: large
+      tag: default
+    steps:
+      - checkout
+
+      - restore_cache:
+          keys:
+            - gradle-rn-platform-{{ checksum "packages/react-native-platform/android/build.gradle" }}
+            - gradle-rn-platform-
+
+      - run:
+          name: Run React Native Platform Android Tests
+          command: |
+            cd packages/react-native-platform/android
+            ./gradlew testDebugUnitTest --info
+
+      - save_cache:
+          key: gradle-rn-platform-{{ checksum "packages/react-native-platform/android/build.gradle" }}
+          paths:
+            - ~/.gradle
+            - .gradle
+
+      - store_test_results:
+          path: packages/react-native-platform/android/build/test-results
+
+      - store_artifacts:
+          path: packages/react-native-platform/android/build/reports
+          destination: react-native-platform-android-test-reports
+
+  test-rn-platform-ios:
+    executor: macos
+    steps:
+      - checkout
+
+      - restore_cache:
+          keys:
+            - swift-spm-rn-platform-{{ checksum "packages/react-native-platform/ios/Package.swift" }}
+            - swift-spm-rn-platform-
+
+      - run:
+          name: Run React Native Platform iOS Tests
+          command: |
+            cd packages/react-native-platform/ios
+            swift test --verbose
+
+      - save_cache:
+          key: swift-spm-rn-platform-{{ checksum "packages/react-native-platform/ios/Package.swift" }}
+          paths:
+            - packages/react-native-platform/ios/.build
+
+      - store_test_results:
+          path: packages/react-native-platform/ios/.build/test-results
+
+      - store_artifacts:
+          path: packages/react-native-platform/ios/.build
+          destination: react-native-platform-ios-build-artifacts
+
 workflows:
   version: 2
   build_and_test:
     jobs:
-      - test-android
-      - test-ios
+      - test-rn-webcrypto-android
+      - test-rn-webcrypto-ios
+      - test-rn-platform-android
+      - test-rn-platform-ios
diff --git a/e2e/apps/react-native-oidc/app.config.ts b/e2e/apps/react-native-oidc/app.config.ts
index 7509c40..2c4f6b7 100644
--- a/e2e/apps/react-native-oidc/app.config.ts
+++ b/e2e/apps/react-native-oidc/app.config.ts
@@ -18,6 +18,7 @@ export default ({ config }: ConfigContext) => ({
   extra: {
     env
   },
+  newArchEnabled: true,
   "android": {
     "package": "com.anonymous.reporeactnativeoidc"
   },
diff --git a/e2e/apps/react-native-oidc/app/(login)/_layout.tsx b/e2e/apps/react-native-oidc/app/(login)/_layout.tsx
deleted file mode 100644
index aa7f199..0000000
--- a/e2e/apps/react-native-oidc/app/(login)/_layout.tsx
+++ /dev/null
@@ -1,45 +0,0 @@
-import { Tabs } from 'expo-router';
-import React from 'react';
-import { Platform } from 'react-native';
-
-import { HapticTab } from '@/components/HapticTab';
-import { IconSymbol } from '@/components/ui/IconSymbol';
-import TabBarBackground from '@/components/ui/TabBarBackground';
-import { Colors } from '@/constants/Colors';
-import { useColorScheme } from '@/hooks/useColorScheme';
-
-export default function TabLayout() {
-  const colorScheme = useColorScheme();
-
-  return (
-    <Tabs
-      screenOptions={{
-        tabBarActiveTintColor: Colors[colorScheme ?? 'light'].tint,
-        headerShown: false,
-        tabBarButton: HapticTab,
-        tabBarBackground: TabBarBackground,
-        tabBarStyle: Platform.select({
-          ios: {
-            // Use a transparent background on iOS to show the blur effect
-            position: 'absolute',
-          },
-          default: {},
-        }),
-      }}>
-      <Tabs.Screen
-        name="index"
-        options={{
-          title: 'Login',
-          tabBarIcon: ({ color }) => <IconSymbol size={28} name="house.fill" color={color} />,
-        }}
-      />
-      <Tabs.Screen
-        name="token"
-        options={{
-          title: 'Token',
-          tabBarIcon: ({ color }) => <IconSymbol size={28} name="paperplane.fill" color={color} />,
-        }}
-      />
-    </Tabs>
-  );
-}
diff --git a/e2e/apps/react-native-oidc/app/(login)/index.tsx b/e2e/apps/react-native-oidc/app/(login)/index.tsx
deleted file mode 100644
index e3fd92d..0000000
--- a/e2e/apps/react-native-oidc/app/(login)/index.tsx
+++ /dev/null
@@ -1,85 +0,0 @@
-import { useCallback, useEffect, useState } from 'react';
-import { StyleSheet, Button } from 'react-native';
-import { Image } from 'expo-image';
-import Constants from 'expo-constants';
-import { useAuth } from '@/hooks/useAuth';
-
-import ParallaxScrollView from '@/components/ParallaxScrollView';
-import { ThemedText } from '@/components/ThemedText';
-import { ThemedView } from '@/components/ThemedView';
-import { HelloWave } from '@/components/HelloWave';
-
-
-export default function LoginScreen () {
-  const { signIn } = useAuth();
-  const [ authError, setAuthError ] = useState<Error | null>(null);
-
-  const signInFunc = useCallback(async () => {
-    try {
-      await signIn('/(login)/token');
-    }
-    catch (err) {
-      setAuthError(err as Error);
-    }
-  }, [signIn, setAuthError]);
-
-  useEffect(() => {
-    (async () => {
-      await signInFunc();
-    })();
-  }, [signInFunc]);
-
-  let view  = (
-    <>
-      <ThemedText type="title">Loading...</ThemedText>
-      <HelloWave />
-    </>
-  );
-
-  if (authError) {
-    view = (
-      <>
-        <ThemedText type="title">Error</ThemedText>
-        <ThemedText type="default">{authError.message}</ThemedText>
-        <Button
-          title="Login"
-          onPress={() => { setAuthError(null); signInFunc(); }}
-        />
-      </>
-    );
-  }
-
-  return (
-    <ParallaxScrollView
-      headerBackgroundColor={{ light: '#A1CEDC', dark: '#1D3D47' }}
-      headerImage={
-        <Image
-          source={require('@/assets/images/partial-react-logo.png')}
-          style={styles.reactLogo}
-        />
-      }>
-      <ThemedView style={styles.titleContainer}>
-        {view}
-      </ThemedView>
-    </ParallaxScrollView>
-  );
-}
-
-const styles = StyleSheet.create({
-  container: {
-    flex: 1,
-    marginTop: Constants.statusBarHeight,
-  },
-  titleContainer: {
-    flexDirection: 'row',
-    alignItems: 'center',
-    gap: 8,
-  },
-  reactLogo: {
-    height: 178,
-    width: 290,
-    bottom: 0,
-    left: 0,
-    position: 'absolute',
-  },
-});
diff --git a/e2e/apps/react-native-oidc/app/(login)/token.tsx b/e2e/apps/react-native-oidc/app/(login)/token.tsx
deleted file mode 100644
index c883c85..0000000
--- a/e2e/apps/react-native-oidc/app/(login)/token.tsx
+++ /dev/null
@@ -1,106 +0,0 @@
-import { useEffect, useState } from 'react';
-import { Button, StyleSheet } from 'react-native';
-import { Image } from 'expo-image';
-import { useRouter } from 'expo-router';
-import Constants from 'expo-constants';
-import { Credential, Token } from '@okta/react-native-platform';
-import { useAuth } from '@/hooks/useAuth';
-
-import ParallaxScrollView from '@/components/ParallaxScrollView';
-import { ThemedText } from '@/components/ThemedText';
-import { ThemedView } from '@/components/ThemedView';
-import { HelloWave } from '@/components/HelloWave';
-
-
-export default function TokenScreen () {
-  const router = useRouter();
-  const { signOut } = useAuth();
-  const [token, setToken] = useState<Token | null>(null);
-
-  useEffect(() => {
-    (async () => {
-      try {
-        const credential = await Credential.getDefault();
-        if (credential) {
-          setToken(credential.token);
-        }
-        else {
-          router.navigate('/(login)');
-        }
-      }
-      catch (err) {
-        console.log('error');
-        console.log(err, (err as Error)?.stack);
-        throw err;
-      }
-    })();
-  }, [router, token, setToken]);
-
-  let body = (
-    <ThemedView style={styles.titleContainer}>
-      <ThemedText type="title">Loading...</ThemedText>
-      <HelloWave />
-    </ThemedView>
-  );
-
-  if (token) {
-   body = (
-    <>
-      <ThemedView style={styles.titleContainer}>
-        <ThemedText type="title">Token</ThemedText>
-        <HelloWave />
-      </ThemedView>
-      <ThemedView style={styles.stepContainer}>
-        <ThemedText type="subtitle">Access Token</ThemedText>
-        <ThemedText>{token.accessToken}</ThemedText>
-        <ThemedText type="subtitle">ID Token</ThemedText>
-        <ThemedText>{token?.idToken?.rawValue}</ThemedText>
-        <ThemedText type="subtitle">Refresh Token</ThemedText>
-        <ThemedText>{token?.refreshToken}</ThemedText>
-      </ThemedView>
-      <ThemedView>
-      <Button
-          title="Logout"
-          onPress={async () => await signOut('/(tabs)')}
-        />
-      </ThemedView>
-    </>
-   );
-  }
-
-  return (
-    <ParallaxScrollView
-      headerBackgroundColor={{ light: '#A1CEDC', dark: '#1D3D47' }}
-      headerImage={
-        <Image
-          source={require('@/assets/images/partial-react-logo.png')}
-          style={styles.reactLogo}
-        />
-      }>
-      {body}
-    </ParallaxScrollView>
-  );
-}
-
-const styles = StyleSheet.create({
-  container: {
-    flex: 1,
-    marginTop: Constants.statusBarHeight,
-  },
-  stepContainer: {
-    gap: 8,
-    marginBottom: 8,
-  },
-  titleContainer: {
-    flexDirection: 'row',
-    alignItems: 'center',
-    gap: 8,
-  },
-  reactLogo: {
-    height: 178,
-    width: 290,
-    bottom: 0,
-    left: 0,
-    position: 'absolute',
-  },
-});
diff --git a/e2e/apps/react-native-oidc/app/(tabs)/_layout.tsx b/e2e/apps/react-native-oidc/app/(tabs)/_layout.tsx
index cfbc1e2..7a27432 100644
--- a/e2e/apps/react-native-oidc/app/(tabs)/_layout.tsx
+++ b/e2e/apps/react-native-oidc/app/(tabs)/_layout.tsx
@@ -29,15 +29,22 @@ export default function TabLayout() {
       <Tabs.Screen
         name="index"
         options={{
-          title: 'Home',
+          title: 'Login',
           tabBarIcon: ({ color }) => <IconSymbol size={28} name="house.fill" color={color} />,
         }}
       />
       <Tabs.Screen
-        name="explore"
+        name="credentials"
         options={{
-          title: 'Explore',
-          tabBarIcon: ({ color }) => <IconSymbol size={28} name="paperplane.fill" color={color} />,
+          title: 'Creds',
+          tabBarIcon: ({ color }) => <IconSymbol size={28} name="list.bullet" color={color} />,
+        }}
+      />
+      <Tabs.Screen
+        name="token"
+        options={{
+          title: 'Token',
+          tabBarIcon: ({ color }) => <IconSymbol size={28} name="lock.document.fill" color={color} />,
         }}
       />
     </Tabs>
diff --git a/e2e/apps/react-native-oidc/app/(tabs)/credentials.tsx b/e2e/apps/react-native-oidc/app/(tabs)/credentials.tsx
new file mode 100644
index 0000000..5579ebd
--- /dev/null
+++ b/e2e/apps/react-native-oidc/app/(tabs)/credentials.tsx
@@ -0,0 +1,228 @@
+import { useState, useCallback } from 'react';
+import { StyleSheet, TouchableOpacity, RefreshControl, ActivityIndicator } from 'react-native';
+import { useRouter, useFocusEffect } from 'expo-router';
+import { IconSymbol } from '@/components/ui/IconSymbol';
+import ParallaxScrollView from '@/components/ParallaxScrollView';
+import { ThemedText } from '@/components/ThemedText';
+import { ThemedView } from '@/components/ThemedView';
+import { Credential } from '@okta/react-native-platform';
+import type { Token } from '@okta/react-native-platform';
+
+type CredentialItem = {
+  id: string;
+  token: Token;
+  isDefault: boolean;
+};
+
+export default function CredentialsScreen() {
+  const router = useRouter();
+  const [credentials, setCredentials] = useState<CredentialItem[]>([]);
+  const [loading, setLoading] = useState(true);
+  const [refreshing, setRefreshing] = useState(false);
+
+  const loadCredentials = useCallback(async () => {
+    try {
+      const allCredentials = await Promise.all(
+        (await Credential.allIDs()).map((id) => Credential.with(id))
+      ) as Credential[];
+      const defaultCred = await Credential.getDefault();
+      
+      const items: CredentialItem[] = await Promise.all(
+        allCredentials.map(async (cred) => ({
+          id: cred.id,
+          token: cred.token,
+          isDefault: cred.id === defaultCred?.id,
+        }))
+      );
+      
+      setCredentials(items);
+    } catch (err) {
+      console.error('Failed to load credentials:', err);
+    } finally {
+      setLoading(false);
+      setRefreshing(false);
+    }
+  }, []);
+
+  useFocusEffect(
+    useCallback(() => {
+      setLoading(true);
+      loadCredentials();
+    }, [loadCredentials])
+  );
+
+  const onRefresh = useCallback(() => {
+    setRefreshing(true);
+    loadCredentials();
+  }, [loadCredentials]);
+
+  const handleCredentialPress = (credentialId: string) => {
+    router.push({
+      pathname: '/(tabs)/token',
+      params: { id: credentialId },
+    });
+  };
+
+  if (loading) {
+    return (
+      <ParallaxScrollView
+        headerBackgroundColor={{ light: '#D0D0D0', dark: '#353636' }}
+        headerImage={
+          <IconSymbol
+            size={310}
+            color="#808080"
+            name="paperplane.fill"
+            style={styles.headerImage}
+          />
+        }>
+        <ThemedView style={styles.centerContainer}>
+          <ActivityIndicator size="large" />
+          <ThemedText>Loading credentials...</ThemedText>
+        </ThemedView>
+      </ParallaxScrollView>
+    );
+  }
+
+  return (
+    <ParallaxScrollView
+      headerBackgroundColor={{ light: '#D0D0D0', dark: '#353636' }}
+      headerImage={
+        <IconSymbol
+          size={310}
+          color="#808080"
+          name="paperplane.fill"
+          style={styles.headerImage}
+        />
+      }
+      refreshControl={
+        <RefreshControl refreshing={refreshing} onRefresh={onRefresh} />
+      }>
+      <ThemedView style={styles.titleContainer}>
+        <ThemedText type="title">Credentials</ThemedText>
+      </ThemedView>
+
+      {credentials.length === 0 ? (
+        <ThemedView style={styles.emptyContainer}>
+          <ThemedText>No credentials found.</ThemedText>
+          <ThemedText style={styles.emptyHint}>
+            Sign in from the Auth tab to create a credential.
+          </ThemedText>
+        </ThemedView>
+      ) : (
+        <ThemedView style={styles.listContainer}>
+          <ThemedText style={styles.countText}>
+            {credentials.length} credential{credentials.length !== 1 ? 's' : ''} stored
+          </ThemedText>
+          
+          {credentials.map((cred) => (
+            <TouchableOpacity
+              key={cred.id}
+              style={styles.credentialCard}
+              onPress={() => handleCredentialPress(cred.id)}>
+              <ThemedView style={styles.credentialHeader}>
+                <ThemedText type="defaultSemiBold" numberOfLines={1} style={styles.credentialId}>
+                  {cred.id.substring(0, 12)}...
+                </ThemedText>
+                {cred.isDefault && (
+                  <ThemedView style={styles.defaultBadge}>
+                    <ThemedText style={styles.defaultBadgeText}>DEFAULT</ThemedText>
+                  </ThemedView>
+                )}
+              </ThemedView>
+              
+              <ThemedView style={styles.credentialDetails}>
+                <ThemedText style={styles.detailText}>
+                  Expires: {new Date(cred.token.expiresAt).toLocaleString()}
+                </ThemedText>
+                <ThemedText style={styles.detailText}>
+                  Type: {cred.token.tokenType}
+                </ThemedText>
+                {cred.token.scopes && (
+                  <ThemedText style={styles.detailText} numberOfLines={1}>
+                    Scopes: {cred.token.scopes.join(', ')}
+                  </ThemedText>
+                )}
+              </ThemedView>
+              
+              <ThemedText style={styles.tapHint}>Tap to view details →</ThemedText>
+            </TouchableOpacity>
+          ))}
+        </ThemedView>
+      )}
+    </ParallaxScrollView>
+  );
+}
+
+const styles = StyleSheet.create({
+  headerImage: {
+    color: '#808080',
+    bottom: -90,
+    left: -35,
+    position: 'absolute',
+  },
+  titleContainer: {
+    flexDirection: 'row',
+    gap: 8,
+    marginBottom: 16,
+  },
+  centerContainer: {
+    alignItems: 'center',
+    gap: 12,
+    padding: 32,
+  },
+  emptyContainer: {
+    alignItems: 'center',
+    gap: 8,
+    padding: 32,
+  },
+  emptyHint: {
+    opacity: 0.7,
+    textAlign: 'center',
+  },
+  listContainer: {
+    gap: 12,
+  },
+  countText: {
+    opacity: 0.7,
+    marginBottom: 8,
+  },
+  credentialCard: {
+    padding: 16,
+    borderRadius: 12,
+    backgroundColor: '#f5f5f522',
+    borderWidth: 1,
+    borderColor: '#e0e0e033',
+    gap: 12,
+  },
+  credentialHeader: {
+    flexDirection: 'row',
+    justifyContent: 'space-between',
+    alignItems: 'center',
+  },
+  credentialId: {
+    flex: 1,
+  },
+  defaultBadge: {
+    backgroundColor: '#34c75922',
+    paddingHorizontal: 8,
+    paddingVertical: 4,
+    borderRadius: 6,
+  },
+  defaultBadgeText: {
+    fontSize: 10,
+    fontWeight: 'bold',
+    color: '#34c759',
+  },
+  credentialDetails: {
+    gap: 4,
+  },
+  detailText: {
+    fontSize: 12,
+    opacity: 0.8,
+  },
+  tapHint: {
+    fontSize: 12,
+    opacity: 0.5,
+    textAlign: 'right',
+  },
+});
diff --git a/e2e/apps/react-native-oidc/app/(tabs)/explore.tsx b/e2e/apps/react-native-oidc/app/(tabs)/explore.tsx
deleted file mode 100644
index d4fbcaa..0000000
--- a/e2e/apps/react-native-oidc/app/(tabs)/explore.tsx
+++ /dev/null
@@ -1,110 +0,0 @@
-import { Image } from 'expo-image';
-import { Platform, StyleSheet } from 'react-native';
-
-import { Collapsible } from '@/components/Collapsible';
-import { ExternalLink } from '@/components/ExternalLink';
-import ParallaxScrollView from '@/components/ParallaxScrollView';
-import { ThemedText } from '@/components/ThemedText';
-import { ThemedView } from '@/components/ThemedView';
-import { IconSymbol } from '@/components/ui/IconSymbol';
-
-export default function TabTwoScreen() {
-  return (
-    <ParallaxScrollView
-      headerBackgroundColor={{ light: '#D0D0D0', dark: '#353636' }}
-      headerImage={
-        <IconSymbol
-          size={310}
-          color="#808080"
-          name="chevron.left.forwardslash.chevron.right"
-          style={styles.headerImage}
-        />
-      }>
-      <ThemedView style={styles.titleContainer}>
-        <ThemedText type="title">Explore</ThemedText>
-      </ThemedView>
-      <ThemedText>This app includes example code to help you get started.</ThemedText>
-      <Collapsible title="File-based routing">
-        <ThemedText>
-          This app has two screens:{' '}
-          <ThemedText type="defaultSemiBold">app/(tabs)/index.tsx</ThemedText> and{' '}
-          <ThemedText type="defaultSemiBold">app/(tabs)/explore.tsx</ThemedText>
-        </ThemedText>
-        <ThemedText>
-          The layout file in <ThemedText type="defaultSemiBold">app/(tabs)/_layout.tsx</ThemedText>{' '}
-          sets up the tab navigator.
-        </ThemedText>
-        <ExternalLink href="https://docs.expo.dev/router/introduction">
-          <ThemedText type="link">Learn more</ThemedText>
-        </ExternalLink>
-      </Collapsible>
-      <Collapsible title="Android, iOS, and web support">
-        <ThemedText>
-          You can open this project on Android, iOS, and the web. To open the web version, press{' '}
-          <ThemedText type="defaultSemiBold">w</ThemedText> in the terminal running this project.
-        </ThemedText>
-      </Collapsible>
-      <Collapsible title="Images">
-        <ThemedText>
-          For static images, you can use the <ThemedText type="defaultSemiBold">@2x</ThemedText> and{' '}
-          <ThemedText type="defaultSemiBold">@3x</ThemedText> suffixes to provide files for
-          different screen densities
-        </ThemedText>
-        <Image source={require('@/assets/images/react-logo.png')} style={{ alignSelf: 'center' }} />
-        <ExternalLink href="https://reactnative.dev/docs/images">
-          <ThemedText type="link">Learn more</ThemedText>
-        </ExternalLink>
-      </Collapsible>
-      <Collapsible title="Custom fonts">
-        <ThemedText>
-          Open <ThemedText type="defaultSemiBold">app/_layout.tsx</ThemedText> to see how to load{' '}
-          <ThemedText style={{ fontFamily: 'SpaceMono' }}>
-            custom fonts such as this one.
-          </ThemedText>
-        </ThemedText>
-        <ExternalLink href="https://docs.expo.dev/versions/latest/sdk/font">
-          <ThemedText type="link">Learn more</ThemedText>
-        </ExternalLink>
-      </Collapsible>
-      <Collapsible title="Light and dark mode components">
-        <ThemedText>
-          This template has light and dark mode support. The{' '}
-          <ThemedText type="defaultSemiBold">useColorScheme()</ThemedText> hook lets you inspect
-          what the user&apos;s current color scheme is, and so you can adjust UI colors accordingly.
-        </ThemedText>
-        <ExternalLink href="https://docs.expo.dev/develop/user-interface/color-themes/">
-          <ThemedText type="link">Learn more</ThemedText>
-        </ExternalLink>
-      </Collapsible>
-      <Collapsible title="Animations">
-        <ThemedText>
-          This template includes an example of an animated component. The{' '}
-          <ThemedText type="defaultSemiBold">components/HelloWave.tsx</ThemedText> component uses
-          the powerful <ThemedText type="defaultSemiBold">react-native-reanimated</ThemedText>{' '}
-          library to create a waving hand animation.
-        </ThemedText>
-        {Platform.select({
-          ios: (
-            <ThemedText>
-              The <ThemedText type="defaultSemiBold">components/ParallaxScrollView.tsx</ThemedText>{' '}
-              component provides a parallax effect for the header image.
-            </ThemedText>
-          ),
-        })}
-      </Collapsible>
-    </ParallaxScrollView>
-  );
-}
-
-const styles = StyleSheet.create({
-  headerImage: {
-    color: '#808080',
-    bottom: -90,
-    left: -35,
-    position: 'absolute',
-  },
-  titleContainer: {
-    flexDirection: 'row',
-    gap: 8,
-  },
-});
diff --git a/e2e/apps/react-native-oidc/app/(tabs)/index.tsx b/e2e/apps/react-native-oidc/app/(tabs)/index.tsx
index 071c5c0..bf06240 100644
--- a/e2e/apps/react-native-oidc/app/(tabs)/index.tsx
+++ b/e2e/apps/react-native-oidc/app/(tabs)/index.tsx
@@ -1,14 +1,68 @@
 import { Image } from 'expo-image';
-import { useRouter } from 'expo-router';
-import { Button, StyleSheet } from 'react-native';
+import { useState, useCallback } from 'react';
+import { Button, StyleSheet, ActivityIndicator } from 'react-native';
+import { useFocusEffect } from 'expo-router';
 
 import { HelloWave } from '@/components/HelloWave';
 import ParallaxScrollView from '@/components/ParallaxScrollView';
 import { ThemedText } from '@/components/ThemedText';
 import { ThemedView } from '@/components/ThemedView';
+import { useAuth } from '@/hooks/useAuth';
+import { Credential } from '@okta/react-native-platform';
 
-export default function HomeScreen() {
-  const router = useRouter();
+export default function AuthScreen() {
+  const { signIn, signOut } = useAuth();
+  const [isAuthenticated, setIsAuthenticated] = useState(false);
+  const [loading, setLoading] = useState(true);
+  const [error, setError] = useState<string | null>(null);
+
+  useFocusEffect(
+    useCallback(() => {
+      setLoading(true);
+      checkAuth();
+    }, [])
+  );
+
+  const checkAuth = async () => {
+    try {
+      setLoading(true);
+      const credential = await Credential.getDefault();
+      setIsAuthenticated(!!credential);
+    } catch (err) {
+      console.error('Error checking auth:', err);
+      setIsAuthenticated(false);
+    } finally {
+      setLoading(false);
+    }
+  };
+
+  const handleSignIn = async () => {
+    try {
+      setLoading(true);
+      setError(null);
+      await signIn();
+      setIsAuthenticated(true);
+    } catch (err) {
+      console.error('Sign in failed:', err);
+      setError(err instanceof Error ? err.message : 'Sign in failed');
+    } finally {
+      setLoading(false);
+    }
+  };
+
+  const handleSignOut = async () => {
+    try {
+      setLoading(true);
+      setError(null);
+      await signOut('/(tabs)');
+      setIsAuthenticated(false);
+    } catch (err) {
+      console.error('Sign out failed:', err);
+      setError(err instanceof Error ? err.message : 'Sign out failed');
+    } finally {
+      setLoading(false);
+    }
+  };
 
   return (
     <ParallaxScrollView
@@ -20,16 +74,44 @@ export default function HomeScreen() {
         />
       }>
       <ThemedView style={styles.titleContainer}>
-        <ThemedText type="title">Welcome!</ThemedText>
+        <ThemedText type="title">Authentication</ThemedText>
         <HelloWave />
       </ThemedView>
-      <ThemedView style={styles.stepContainer}>
-        <ThemedText type="subtitle">Login</ThemedText>
-        <Button
-          title="Login"
-          onPress={() => router.navigate('/(login)')}
-        />
-      </ThemedView>
+
+      {loading ? (
+        <ThemedView style={styles.stepContainer}>
+          <ActivityIndicator size="large" />
+          <ThemedText>Loading...</ThemedText>
+        </ThemedView>
+      ) : (
+        <>
+          <ThemedView style={styles.stepContainer}>
+            <ThemedText type="subtitle">
+              Status: {isAuthenticated ? '✅ Authenticated' : '❌ Not Authenticated'}
+            </ThemedText>
+          </ThemedView>
+
+          {error && (
+            <ThemedView style={[styles.stepContainer, styles.errorContainer]}>
+              <ThemedText style={styles.errorText}>Error: {error}</ThemedText>
+            </ThemedView>
+          )}
+
+          <ThemedView style={styles.stepContainer}>
+            <Button title="Request Token" onPress={handleSignIn} />
+            <Button title="Sign Out" onPress={handleSignOut} color="#ff3b30" />
+          </ThemedView>
+
+          <ThemedView style={styles.stepContainer}>
+            <ThemedText type="defaultSemiBold">Next Steps:</ThemedText>
+            <ThemedText>
+              {isAuthenticated 
+                ? '• Go to Credentials tab to see all stored tokens\n• Select a credential to view token details'
+                : '• Sign in to get started\n• Your tokens will be stored securely in the keychain'}
+            </ThemedText>
+          </ThemedView>
+        </>
+      )}
     </ParallaxScrollView>
   );
 }
@@ -51,4 +133,12 @@ const styles = StyleSheet.create({
     left: 0,
     position: 'absolute',
   },
-});
+  errorContainer: {
+    padding: 12,
+    backgroundColor: '#ff3b3022',
+    borderRadius: 8,
+  },
+  errorText: {
+    color: '#ff3b30',
+  },
+});
\ No newline at end of file
diff --git a/e2e/apps/react-native-oidc/app/(tabs)/token.tsx b/e2e/apps/react-native-oidc/app/(tabs)/token.tsx
new file mode 100644
index 0000000..0774bc3
--- /dev/null
+++ b/e2e/apps/react-native-oidc/app/(tabs)/token.tsx
@@ -0,0 +1,296 @@
+import { useState, useCallback } from 'react';
+import { StyleSheet, ScrollView, ActivityIndicator, Button } from 'react-native';
+import { useLocalSearchParams, useRouter, useFocusEffect } from 'expo-router';
+import { IconSymbol } from '@/components/ui/IconSymbol';
+import ParallaxScrollView from '@/components/ParallaxScrollView';
+import { ThemedText } from '@/components/ThemedText';
+import { ThemedView } from '@/components/ThemedView';
+import { Credential } from '@okta/react-native-platform';
+import type { Token } from '@okta/react-native-platform';
+
+export default function TokenScreen() {
+  const router = useRouter();
+  const params = useLocalSearchParams<{ id?: string }>();
+  const [token, setToken] = useState<Token | null>(null);
+  const [loading, setLoading] = useState(true);
+  const [error, setError] = useState<string | null>(null);
+
+  const loadToken = useCallback(async () => {
+    try {
+      setLoading(true);
+      setError(null);
+      
+      let credential;
+      if (params.id) {
+        credential = await Credential.with(params.id);
+      } else {
+        credential = await Credential.getDefault();
+      }
+
+      if (credential) {
+        setToken(credential.token);
+      } else {
+        let errMsg = 'No credential found';
+        if (params.id) {
+          errMsg += ` (${params.id})`;
+        }
+        setError(errMsg);
+      }
+    } catch (err) {
+      console.error('Failed to load token:', err);
+      setError(err instanceof Error ? err.message : 'Failed to load token');
+    } finally {
+      setLoading(false);
+    }
+  }, [params.id]);
+
+  useFocusEffect(
+    useCallback(() => {
+      loadToken();
+    }, [loadToken])
+  );
+
+  const handleRevoke = async () => {
+    if (token) {
+      const cred = await Credential.with(token.id);
+      await cred?.revoke();
+      router.navigate('/credentials')
+    }
+  }
+
+  if (loading) {
+    return (
+      <ParallaxScrollView
+        headerBackgroundColor={{ light: '#A1CEDC', dark: '#1D3D47' }}
+        headerImage={
+          <IconSymbol
+            size={310}
+            color="#808080"
+            name="chevron.left.forwardslash.chevron.right"
+            style={styles.headerImage}
+          />
+        }>
+        <ThemedView style={styles.centerContainer}>
+          <ActivityIndicator size="large" />
+          <ThemedText>Loading token...</ThemedText>
+        </ThemedView>
+      </ParallaxScrollView>
+    );
+  }
+
+  if (error || !token) {
+    return (
+      <ParallaxScrollView
+        headerBackgroundColor={{ light: '#A1CEDC', dark: '#1D3D47' }}
+        headerImage={
+          <IconSymbol
+            size={310}
+            color="#808080"
+            name="chevron.left.forwardslash.chevron.right"
+            style={styles.headerImage}
+          />
+        }>
+        <ThemedView style={styles.titleContainer}>
+          <ThemedText type="title">Token Details</ThemedText>
+        </ThemedView>
+        <ThemedView style={styles.errorContainer}>
+          <ThemedText style={styles.errorText}>
+            {error || `No token selected (${params.id})`}
+          </ThemedText>
+          <ThemedText style={styles.hintText}>
+            Go to Credentials tab and select a credential
+          </ThemedText>
+        </ThemedView>
+      </ParallaxScrollView>
+    );
+  }
+
+
+  const isExpired = token.isExpired;
+  const expiresIn = Math.floor((new Date(token.expiresAt).getTime() - Date.now()) / 1000);
+
+  return (
+    <ParallaxScrollView
+      headerBackgroundColor={{ light: '#A1CEDC', dark: '#1D3D47' }}
+      headerImage={
+        <IconSymbol
+          size={310}
+          color="#808080"
+          name="chevron.left.forwardslash.chevron.right"
+          style={styles.headerImage}
+        />
+      }>
+      <ThemedView style={styles.titleContainer}>
+        <ThemedText type="title">Token Details</ThemedText>
+      </ThemedView>
+
+      <ThemedView style={styles.section}>
+        <ThemedText type="subtitle">Status</ThemedText>
+        <ThemedView style={styles.statusContainer}>
+          <ThemedText style={isExpired ? styles.expired : styles.valid}>
+            {isExpired ? '❌ Expired' : '✅ Valid'}
+          </ThemedText>
+          {!isExpired && (
+            <ThemedText style={styles.expiresText}>
+              Expires in {Math.floor(expiresIn / 60)} minutes
+            </ThemedText>
+          )}
+        </ThemedView>
+      </ThemedView>
+
+      <ThemedView style={styles.section}>
+        <ThemedText type="subtitle">Token ID</ThemedText>
+        <ThemedView style={styles.codeBlock}>
+          <ThemedText style={styles.codeText} selectable>
+            {token.id}
+          </ThemedText>
+        </ThemedView>
+      </ThemedView>
+
+      <ThemedView style={styles.section}>
+        <ThemedText type="subtitle">Properties</ThemedText>
+        <ThemedView style={styles.propertyContainer}>
+          <Property label="Type" value={token.tokenType} />
+          <Property label="Issued At" value={new Date(token.issuedAt).toLocaleString()} />
+          <Property label="Expires At" value={new Date(token.expiresAt).toLocaleString()} />
+          {token.scopes && <Property label="Scopes" value={token.scopes.join(', ')} />}
+        </ThemedView>
+      </ThemedView>
+
+      {token.context && Object.keys(token.context).length > 0 && (
+        <ThemedView style={styles.section}>
+          <ThemedText type="subtitle">Context</ThemedText>
+          <ThemedView style={styles.codeBlock}>
+            <ScrollView horizontal>
+              <ThemedText style={styles.codeText} selectable>
+                {JSON.stringify(token.context, null, 2)}
+              </ThemedText>
+            </ScrollView>
+          </ThemedView>
+        </ThemedView>
+      )}
+
+      <ThemedView style={styles.section}>
+        <ThemedText type="subtitle">Access Token (truncated)</ThemedText>
+        <ThemedView style={styles.codeBlock}>
+          <ThemedText style={styles.codeText} selectable numberOfLines={3}>
+            {token.accessToken}
+          </ThemedText>
+        </ThemedView>
+      </ThemedView>
+
+      {token?.idToken && (
+        <ThemedView style={styles.section}>
+          <ThemedText type="subtitle">ID Token (truncated)</ThemedText>
+          <ThemedView style={styles.codeBlock}>
+            <ThemedText style={styles.codeText} selectable numberOfLines={3}>
+              {token?.idToken?.rawValue}
+            </ThemedText>
+          </ThemedView>
+        </ThemedView>
+      )}
+
+      {token?.refreshToken && (
+        <ThemedView style={styles.section}>
+          <ThemedText type="subtitle">Refresh Token</ThemedText>
+          <ThemedView style={styles.codeBlock}>
+            <ThemedText style={styles.codeText} selectable numberOfLines={3}>
+              {token.refreshToken}
+            </ThemedText>
+          </ThemedView>
+        </ThemedView>
+      )}
+
+      <ThemedView style={styles.section}>
+        <Button title="Revoke Token" onPress={handleRevoke} />
+      </ThemedView>
+    </ParallaxScrollView>
+  );
+}
+
+function Property({ label, value }: { label: string; value: string }) {
+  return (
+    <ThemedView style={styles.property}>
+      <ThemedText style={styles.propertyLabel}>{label}:</ThemedText>
+      <ThemedText style={styles.propertyValue}>{value}</ThemedText>
+    </ThemedView>
+  );
+}
+
+const styles = StyleSheet.create({
+  headerImage: {
+    color: '#808080',
+    bottom: -90,
+    left: -35,
+    position: 'absolute',
+  },
+  titleContainer: {
+    flexDirection: 'row',
+    gap: 8,
+    marginBottom: 16,
+  },
+  centerContainer: {
+    alignItems: 'center',
+    gap: 12,
+    padding: 32,
+  },
+  errorContainer: {
+    padding: 20,
+    gap: 8,
+    alignItems: 'center',
+  },
+  errorText: {
+    color: '#ff3b30',
+    fontSize: 16,
+  },
+  hintText: {
+    opacity: 0.7,
+    textAlign: 'center',
+  },
+  section: {
+    marginBottom: 24,
+    gap: 8,
+  },
+  statusContainer: {
+    gap: 4,
+  },
+  valid: {
+    color: '#34c759',
+    fontSize: 16,
+    fontWeight: 'bold',
+  },
+  expired: {
+    color: '#ff3b30',
+    fontSize: 16,
+    fontWeight: 'bold',
+  },
+  expiresText: {
+    opacity: 0.7,
+  },
+  codeBlock: {
+    backgroundColor: '#f5f5f522',
+    padding: 12,
+    borderRadius: 8,
+    borderWidth: 1,
+    borderColor: '#e0e0e033',
+  },
+  codeText: {
+    fontFamily: 'monospace',
+    fontSize: 12,
+  },
+  propertyContainer: {
+    gap: 8,
+  },
+  property: {
+    flexDirection: 'row',
+    gap: 8,
+  },
+  propertyLabel: {
+    fontWeight: 'bold',
+    minWidth: 100,
+  },
+  propertyValue: {
+    flex: 1,
+    opacity: 0.8,
+  },
+});
diff --git a/e2e/apps/react-native-oidc/app/_layout.tsx b/e2e/apps/react-native-oidc/app/_layout.tsx
index 4a9dd45..653bb8d 100644
--- a/e2e/apps/react-native-oidc/app/_layout.tsx
+++ b/e2e/apps/react-native-oidc/app/_layout.tsx
@@ -21,7 +21,6 @@ export default function RootLayout() {
     <ThemeProvider value={colorScheme === 'dark' ? DarkTheme : DefaultTheme}>
       <Stack>
         <Stack.Screen name="(tabs)" options={{ headerShown: false }} />
-        <Stack.Screen name="(login)" options={{ headerShown: false }} />
         <Stack.Screen name="+not-found" />
       </Stack>
       <StatusBar style="auto" />
diff --git a/e2e/apps/react-native-oidc/hooks/useAuth.ts b/e2e/apps/react-native-oidc/hooks/useAuth.ts
index e355c20..f30a671 100644
--- a/e2e/apps/react-native-oidc/hooks/useAuth.ts
+++ b/e2e/apps/react-native-oidc/hooks/useAuth.ts
@@ -26,11 +26,8 @@ async function performSignIn () {
       redirectUri
     });
 
-    // TODO: improve this pattern, too awkward
-    // .save was migrated away from AuthCodeFlow
+    console.log('here 1')
     const uri = await flow.start();
-    console.log('here 2')
-    console.log('authorize url', uri);
 
     // @ts-ignore
     const transaction = new AuthTransaction(flow.context);
@@ -41,7 +38,8 @@ async function performSignIn () {
     const { token, context } = await flow.resume(result.url);
     console.log('token', token);
     console.log('context', context);
-    Credential.store(token);
+    const credential = await Credential.store(token);
+    return credential.id;
   }
   catch (err) {
     console.log('here 3');
@@ -50,28 +48,19 @@ async function performSignIn () {
   }
 }
 
-// TODO: cannot use oidc logout as openid is not a request scope currently
 async function performSignOut () {
   const isOIDC = client.configuration.scopes.includes('openid');
 
-  if (isOIDC) {
-    // TODO:
-    throw new Error('Not implemented');
-  }
-  else {
-    // TODO: /revoke fails due to same URLSearchParams issue
-    await (await Credential.getDefault())?.revoke();
-    // await (await Credential.getDefault())?.remove();
-  }
+  // TODO: implement oidc logout
+  await (await Credential.getDefault())?.revoke();
 }
 
 export function useAuth () {
   const router = useRouter();
 
-  const signIn = useCallback(async (redirectTo: Parameters<Router['navigate']>[0]) => {
-    Credential.clear();
-    await performSignIn();
-    router.navigate(redirectTo);
+  const signIn = useCallback(async () => {
+    const id = await performSignIn();
+    return id;
   }, [router]);
 
   const signOut = useCallback(async (redirectTo: Parameters<Router['navigate']>[0]) => {
diff --git a/e2e/apps/react-native-oidc/index.js b/e2e/apps/react-native-oidc/index.js
index bf171fd..48f0382 100644
--- a/e2e/apps/react-native-oidc/index.js
+++ b/e2e/apps/react-native-oidc/index.js
@@ -8,3 +8,5 @@ console.log('Plat', Platform, Platform.TimeCoordinator)
 console.log("globalThis.crypto", globalThis.crypto);
 // global.crypto = global.crypto ?? globalThis.crypto;
 
+import { Credential } from '@okta/react-native-platform';
+Credential.coordinator.tokenStorage.emitter.on('token_added', (...args) => console.log(args))
diff --git a/e2e/apps/react-native-oidc/react-native.config.js b/e2e/apps/react-native-oidc/react-native.config.js
index 30ea1c7..a39b60d 100644
--- a/e2e/apps/react-native-oidc/react-native.config.js
+++ b/e2e/apps/react-native-oidc/react-native.config.js
@@ -5,5 +5,8 @@ module.exports = {
     '@okta/react-native-webcrypto-bridge': {
       root: path.resolve(__dirname, '../../packages/react-native-webcrypto-bridge'),
     },
+    '@okta/react-native-platform': {
+      root: path.resolve(__dirname, '../../packages/react-native-platform'),
+    },
   },
 };
diff --git a/packages/auth-foundation/src/Credential/CredentialCoordinator.ts b/packages/auth-foundation/src/Credential/CredentialCoordinator.ts
index d5c82be..1a2bc8a 100644
--- a/packages/auth-foundation/src/Credential/CredentialCoordinator.ts
+++ b/packages/auth-foundation/src/Credential/CredentialCoordinator.ts
@@ -47,7 +47,7 @@ export interface CredentialCoordinator {
    */
   getDefault (): Promise<Credential | null>;
   setDefault (cred: Credential | null): Promise<void>;
-  get tokenStorage (): TokenStorage;
+  tokenStorage: TokenStorage;
   /**
    * Writes the provided {@link Token.Token | Token} (and {@link Token.Token.Metadata:TYPE | Token.Metadata}) to storage and creates a {@link Credential}
    * instance to represent the {@link Token.Token | Token} via the {@link CredentialDataSource}
@@ -247,7 +247,12 @@ export class CredentialCoordinatorImpl implements CredentialCoordinator {
   }
 
   protected async loadDefaultCredential (): Promise<Credential | null> {
-    const defaultTokenId = this.tokenStorage.defaultTokenId;
+    let defaultTokenId = this.tokenStorage.defaultTokenId;
+    if (defaultTokenId === undefined) {
+      // `undefined` value indicates storage (source-of-truth) hasn't been checked yet
+      // the value should only be `undefined` at bootstrapping time
+      defaultTokenId = await this.tokenStorage.loadDefaultTokenId();
+    }
     if (!defaultTokenId) {
       return null;
     }
diff --git a/packages/auth-foundation/src/Credential/TokenStorage.ts b/packages/auth-foundation/src/Credential/TokenStorage.ts
index f115b6d..50e72ce 100644
--- a/packages/auth-foundation/src/Credential/TokenStorage.ts
+++ b/packages/auth-foundation/src/Credential/TokenStorage.ts
@@ -33,7 +33,11 @@ export interface TokenStorage {
   /**
    * In memory cached value of the {@link Credential.getDefault | default Credential}'s id
    */
-  readonly defaultTokenId: string | null;
+  readonly defaultTokenId: string | null | undefined;
+  /**
+   * Queries storage location for  stored id
+   */
+  loadDefaultTokenId (): Promise<string | null>;
   /**
    * Updates the stored {@link Credential.getDefault | default Credential} id
    */
@@ -103,6 +107,10 @@ export class DefaultTokenStorage implements TokenStorage {
     return this.#defaultId;
   }
 
+  async loadDefaultTokenId (): Promise<string | null> {
+    return this.defaultTokenId;
+  }
+
   async setDefaultTokenId (id: string | null): Promise<void> {
     if (id === this.defaultTokenId) {
       return;
diff --git a/packages/auth-foundation/src/FetchClient.ts b/packages/auth-foundation/src/FetchClient.ts
index 50b671a..56b5fe5 100644
--- a/packages/auth-foundation/src/FetchClient.ts
+++ b/packages/auth-foundation/src/FetchClient.ts
@@ -92,6 +92,8 @@ export class FetchClient<E extends APIClient.Events = APIClient.Events> extends
       await this.prepareAcrStepUpRetry(response, request, wwwAuthError);
     }
 
+    // TODO: clear token???
+
     // super.send() will sign call .authorize()
   }
 
diff --git a/packages/react-native-platform/THIRD-PARTY-NOTICES.md b/packages/react-native-platform/THIRD-PARTY-NOTICES.md
new file mode 100644
index 0000000..a7f25a3
--- /dev/null
+++ b/packages/react-native-platform/THIRD-PARTY-NOTICES.md
@@ -0,0 +1,53 @@
+# Third Party Notices
+
+This file contains third-party software licenses for @okta/react-native-platform.
+
+## Runtime Dependencies
+
+react-native-platform has no third-party JavaScript runtime dependencies.
+
+## Peer Dependencies
+
+### React
+- Version: *
+- License: MIT
+- Repository: https://github.com/facebook/react
+- Description: A declarative, efficient, and flexible JavaScript library for building user interfaces.
+
+### React Native
+- Version: *
+- License: MIT
+- Repository: https://github.com/facebook/react-native
+- Description: A framework for building native applications using React.
+
+## iOS Dependencies
+
+### Runtime
+
+- React-Core - MIT License
+- Foundation framework - Apple proprietary
+- CryptoKit framework - Apple proprietary (for iOS 13+)
+- Security framework - Apple proprietary (iOS Keychain access)
+
+### Build Time
+
+- Xcode 15.0+ with Swift 5.0+ compiler
+- iOS SDK 13.0 minimum
+
+## Android Dependencies
+
+### Runtime
+
+- kotlin-stdlib 2.1.0 - Apache-2.0 License
+- react-android 0.81.0 - MIT License
+- androidx.datastore 1.0.0 - Apache-2.0 License
+- androidx.browser 1.7.0 - Apache-2.0 License
+- android.security.keystore - Android platform (proprietary)
+
+### Build Time
+
+- Android Gradle Plugin 8.1.0 - Apache-2.0 License
+- Kotlin Gradle Plugin 2.1.0 - Apache-2.0 License
+- Java 17 (minimum required)
+- Android SDK 35 (compile version) - Apache-2.0 License
+- Android SDK 24+ (minimum support version) - Apache-2.0 License
diff --git a/packages/react-native-platform/android/.gitignore b/packages/react-native-platform/android/.gitignore
new file mode 100644
index 0000000..fd9cd50
--- /dev/null
+++ b/packages/react-native-platform/android/.gitignore
@@ -0,0 +1,3 @@
+.gradle
+local.properties
+.kotlin
diff --git a/packages/react-native-platform/android/build.gradle b/packages/react-native-platform/android/build.gradle
new file mode 100644
index 0000000..4639104
--- /dev/null
+++ b/packages/react-native-platform/android/build.gradle
@@ -0,0 +1,83 @@
+buildscript {
+    ext.kotlin_version = '2.1.0'
+
+    repositories {
+        google()
+        mavenCentral()
+    }
+
+    dependencies {
+        classpath 'com.android.tools.build:gradle:8.1.0'
+        classpath "org.jetbrains.kotlin:kotlin-gradle-plugin:$kotlin_version"
+    }
+}
+
+apply plugin: 'com.android.library'
+apply plugin: 'kotlin-android'
+
+android {
+    namespace "com.okta.reactnativeplatform"
+    compileSdkVersion 35
+
+    defaultConfig {
+        minSdkVersion 24
+        targetSdkVersion 35
+        versionCode 1
+        versionName "1.0"
+    }
+
+    buildTypes {
+        release {
+            minifyEnabled false
+        }
+    }
+
+    compileOptions {
+        sourceCompatibility JavaVersion.VERSION_17
+        targetCompatibility JavaVersion.VERSION_17
+    }
+
+    kotlinOptions {
+        jvmTarget = '17'
+    }
+
+    testOptions {
+        unitTests.includeAndroidResources = true
+    }
+
+    sourceSets {
+        main {
+            java {
+                exclude 'com/okta/reactnativeplatform/browserSession/**'
+            }
+        }
+    }
+}
+
+repositories {
+    google()
+    mavenCentral()
+}
+
+dependencies {
+    implementation "org.jetbrains.kotlin:kotlin-stdlib:$kotlin_version"
+    implementation 'com.facebook.react:react-android:0.81.0'
+    implementation 'androidx.datastore:datastore-preferences:1.0.0'
+    implementation 'androidx.browser:browser:1.7.0'
+
+    // Testing dependencies
+    testImplementation 'junit:junit:4.13.2'
+    testImplementation 'com.google.truth:truth:1.1.2'
+    testImplementation 'io.mockk:mockk:1.14.9'
+    testImplementation 'org.robolectric:robolectric:4.16.1'
+    testImplementation 'androidx.test:core:1.5.0'
+}
+
+// Filter tests to only run TokenStorage tests
+tasks.withType(Test) {
+    filter {
+        includeTestsMatching 'com.okta.reactnativeplatform.TokenStorageModuleTest'
+    }
+}
+
+
diff --git a/packages/react-native-platform/android/gradle.properties b/packages/react-native-platform/android/gradle.properties
new file mode 100644
index 0000000..3e784c7
--- /dev/null
+++ b/packages/react-native-platform/android/gradle.properties
@@ -0,0 +1,2 @@
+android.useAndroidX=true
+android.suppressUnsupportedCompileSdk=35
diff --git a/packages/react-native-platform/android/gradle/wrapper/gradle-wrapper.jar b/packages/react-native-platform/android/gradle/wrapper/gradle-wrapper.jar
new file mode 100644
index 0000000..a4b76b9
Binary files /dev/null and b/packages/react-native-platform/android/gradle/wrapper/gradle-wrapper.jar differ
diff --git a/packages/react-native-platform/android/gradle/wrapper/gradle-wrapper.properties b/packages/react-native-platform/android/gradle/wrapper/gradle-wrapper.properties
new file mode 100644
index 0000000..37f853b
--- /dev/null
+++ b/packages/react-native-platform/android/gradle/wrapper/gradle-wrapper.properties
@@ -0,0 +1,7 @@
+distributionBase=GRADLE_USER_HOME
+distributionPath=wrapper/dists
+distributionUrl=https\://services.gradle.org/distributions/gradle-8.13-bin.zip
+networkTimeout=10000
+validateDistributionUrl=true
+zipStoreBase=GRADLE_USER_HOME
+zipStorePath=wrapper/dists
diff --git a/packages/react-native-platform/android/gradlew b/packages/react-native-platform/android/gradlew
new file mode 100755
index 0000000..f3b75f3
--- /dev/null
+++ b/packages/react-native-platform/android/gradlew
@@ -0,0 +1,251 @@
+#!/bin/sh
+
+#
+# Copyright © 2015-2021 the original authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# SPDX-License-Identifier: Apache-2.0
+#
+
+##############################################################################
+#
+#   Gradle start up script for POSIX generated by Gradle.
+#
+#   Important for running:
+#
+#   (1) You need a POSIX-compliant shell to run this script. If your /bin/sh is
+#       noncompliant, but you have some other compliant shell such as ksh or
+#       bash, then to run this script, type that shell name before the whole
+#       command line, like:
+#
+#           ksh Gradle
+#
+#       Busybox and similar reduced shells will NOT work, because this script
+#       requires all of these POSIX shell features:
+#         * functions;
+#         * expansions «$var», «${var}», «${var:-default}», «${var+SET}»,
+#           «${var#prefix}», «${var%suffix}», and «$( cmd )»;
+#         * compound commands having a testable exit status, especially «case»;
+#         * various built-in commands including «command», «set», and «ulimit».
+#
+#   Important for patching:
+#
+#   (2) This script targets any POSIX shell, so it avoids extensions provided
+#       by Bash, Ksh, etc; in particular arrays are avoided.
+#
+#       The "traditional" practice of packing multiple parameters into a
+#       space-separated string is a well documented source of bugs and security
+#       problems, so this is (mostly) avoided, by progressively accumulating
+#       options in "$@", and eventually passing that to Java.
+#
+#       Where the inherited environment variables (DEFAULT_JVM_OPTS, JAVA_OPTS,
+#       and GRADLE_OPTS) rely on word-splitting, this is performed explicitly;
+#       see the in-line comments for details.
+#
+#       There are tweaks for specific operating systems such as AIX, CygWin,
+#       Darwin, MinGW, and NonStop.
+#
+#   (3) This script is generated from the Groovy template
+#       https://github.com/gradle/gradle/blob/HEAD/platforms/jvm/plugins-application/src/main/resources/org/gradle/api/internal/plugins/unixStartScript.txt
+#       within the Gradle project.
+#
+#       You can find Gradle at https://github.com/gradle/gradle/.
+#
+##############################################################################
+
+# Attempt to set APP_HOME
+
+# Resolve links: $0 may be a link
+app_path=$0
+
+# Need this for daisy-chained symlinks.
+while
+    APP_HOME=${app_path%"${app_path##*/}"}  # leaves a trailing /; empty if no leading path
+    [ -h "$app_path" ]
+do
+    ls=$( ls -ld "$app_path" )
+    link=${ls#*' -> '}
+    case $link in             #(
+      /*)   app_path=$link ;; #(
+      *)    app_path=$APP_HOME$link ;;
+    esac
+done
+
+# This is normally unused
+# shellcheck disable=SC2034
+APP_BASE_NAME=${0##*/}
+# Discard cd standard output in case $CDPATH is set (https://github.com/gradle/gradle/issues/25036)
+APP_HOME=$( cd -P "${APP_HOME:-./}" > /dev/null && printf '%s\n' "$PWD" ) || exit
+
+# Use the maximum available, or set MAX_FD != -1 to use that value.
+MAX_FD=maximum
+
+warn () {
+    echo "$*"
+} >&2
+
+die () {
+    echo
+    echo "$*"
+    echo
+    exit 1
+} >&2
+
+# OS specific support (must be 'true' or 'false').
+cygwin=false
+msys=false
+darwin=false
+nonstop=false
+case "$( uname )" in                #(
+  CYGWIN* )         cygwin=true  ;; #(
+  Darwin* )         darwin=true  ;; #(
+  MSYS* | MINGW* )  msys=true    ;; #(
+  NONSTOP* )        nonstop=true ;;
+esac
+
+CLASSPATH=$APP_HOME/gradle/wrapper/gradle-wrapper.jar
+
+
+# Determine the Java command to use to start the JVM.
+if [ -n "$JAVA_HOME" ] ; then
+    if [ -x "$JAVA_HOME/jre/sh/java" ] ; then
+        # IBM's JDK on AIX uses strange locations for the executables
+        JAVACMD=$JAVA_HOME/jre/sh/java
+    else
+        JAVACMD=$JAVA_HOME/bin/java
+    fi
+    if [ ! -x "$JAVACMD" ] ; then
+        die "ERROR: JAVA_HOME is set to an invalid directory: $JAVA_HOME
+
+Please set the JAVA_HOME variable in your environment to match the
+location of your Java installation."
+    fi
+else
+    JAVACMD=java
+    if ! command -v java >/dev/null 2>&1
+    then
+        die "ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
+
+Please set the JAVA_HOME variable in your environment to match the
+location of your Java installation."
+    fi
+fi
+
+# Increase the maximum file descriptors if we can.
+if ! "$cygwin" && ! "$darwin" && ! "$nonstop" ; then
+    case $MAX_FD in #(
+      max*)
+        # In POSIX sh, ulimit -H is undefined. That's why the result is checked to see if it worked.
+        # shellcheck disable=SC2039,SC3045
+        MAX_FD=$( ulimit -H -n ) ||
+            warn "Could not query maximum file descriptor limit"
+    esac
+    case $MAX_FD in  #(
+      '' | soft) :;; #(
+      *)
+        # In POSIX sh, ulimit -n is undefined. That's why the result is checked to see if it worked.
+        # shellcheck disable=SC2039,SC3045
+        ulimit -n "$MAX_FD" ||
+            warn "Could not set maximum file descriptor limit to $MAX_FD"
+    esac
+fi
+
+# Collect all arguments for the java command, stacking in reverse order:
+#   * args from the command line
+#   * the main class name
+#   * -classpath
+#   * -D...appname settings
+#   * --module-path (only if needed)
+#   * DEFAULT_JVM_OPTS, JAVA_OPTS, and GRADLE_OPTS environment variables.
+
+# For Cygwin or MSYS, switch paths to Windows format before running java
+if "$cygwin" || "$msys" ; then
+    APP_HOME=$( cygpath --path --mixed "$APP_HOME" )
+    CLASSPATH=$( cygpath --path --mixed "$CLASSPATH" )
+
+    JAVACMD=$( cygpath --unix "$JAVACMD" )
+
+    # Now convert the arguments - kludge to limit ourselves to /bin/sh
+    for arg do
+        if
+            case $arg in                                #(
+              -*)   false ;;                            # don't mess with options #(
+              /?*)  t=${arg#/} t=/${t%%/*}              # looks like a POSIX filepath
+                    [ -e "$t" ] ;;                      #(
+              *)    false ;;
+            esac
+        then
+            arg=$( cygpath --path --ignore --mixed "$arg" )
+        fi
+        # Roll the args list around exactly as many times as the number of
+        # args, so each arg winds up back in the position where it started, but
+        # possibly modified.
+        #
+        # NB: a `for` loop captures its iteration list before it begins, so
+        # changing the positional parameters here affects neither the number of
+        # iterations, nor the values presented in `arg`.
+        shift                   # remove old arg
+        set -- "$@" "$arg"      # push replacement arg
+    done
+fi
+
+
+# Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
+DEFAULT_JVM_OPTS='"-Xmx64m" "-Xms64m"'
+
+# Collect all arguments for the java command:
+#   * DEFAULT_JVM_OPTS, JAVA_OPTS, JAVA_OPTS, and optsEnvironmentVar are not allowed to contain shell fragments,
+#     and any embedded shellness will be escaped.
+#   * For example: A user cannot expect ${Hostname} to be expanded, as it is an environment variable and will be
+#     treated as '${Hostname}' itself on the command line.
+
+set -- \
+        "-Dorg.gradle.appname=$APP_BASE_NAME" \
+        -classpath "$CLASSPATH" \
+        org.gradle.wrapper.GradleWrapperMain \
+        "$@"
+
+# Stop when "xargs" is not available.
+if ! command -v xargs >/dev/null 2>&1
+then
+    die "xargs is not available"
+fi
+
+# Use "xargs" to parse quoted args.
+#
+# With -n1 it outputs one arg per line, with the quotes and backslashes removed.
+#
+# In Bash we could simply go:
+#
+#   readarray ARGS < <( xargs -n1 <<<"$var" ) &&
+#   set -- "${ARGS[@]}" "$@"
+#
+# but POSIX shell has neither arrays nor command substitution, so instead we
+# post-process each arg (as a line of input to sed) to backslash-escape any
+# character that might be a shell metacharacter, then use eval to reverse
+# that process (while maintaining the separation between arguments), and wrap
+# the whole thing up as a single "set" statement.
+#
+# This will of course break if any of these variables contains a newline or
+# an unmatched quote.
+#
+
+eval "set -- $(
+        printf '%s\n' "$DEFAULT_JVM_OPTS $JAVA_OPTS $GRADLE_OPTS" |
+        xargs -n1 |
+        sed ' s~[^-[:alnum:]+,./:=@_]~\\&~g; ' |
+        tr '\n' ' '
+    )" '"$@"'
+
+exec "$JAVACMD" "$@"
diff --git a/packages/react-native-platform/android/gradlew.bat b/packages/react-native-platform/android/gradlew.bat
new file mode 100644
index 0000000..9d21a21
--- /dev/null
+++ b/packages/react-native-platform/android/gradlew.bat
@@ -0,0 +1,94 @@
+@rem
+@rem Copyright 2015 the original author or authors.
+@rem
+@rem Licensed under the Apache License, Version 2.0 (the "License");
+@rem you may not use this file except in compliance with the License.
+@rem You may obtain a copy of the License at
+@rem
+@rem      https://www.apache.org/licenses/LICENSE-2.0
+@rem
+@rem Unless required by applicable law or agreed to in writing, software
+@rem distributed under the License is distributed on an "AS IS" BASIS,
+@rem WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+@rem See the License for the specific language governing permissions and
+@rem limitations under the License.
+@rem
+@rem SPDX-License-Identifier: Apache-2.0
+@rem
+
+@if "%DEBUG%"=="" @echo off
+@rem ##########################################################################
+@rem
+@rem  Gradle startup script for Windows
+@rem
+@rem ##########################################################################
+
+@rem Set local scope for the variables with windows NT shell
+if "%OS%"=="Windows_NT" setlocal
+
+set DIRNAME=%~dp0
+if "%DIRNAME%"=="" set DIRNAME=.
+@rem This is normally unused
+set APP_BASE_NAME=%~n0
+set APP_HOME=%DIRNAME%
+
+@rem Resolve any "." and ".." in APP_HOME to make it shorter.
+for %%i in ("%APP_HOME%") do set APP_HOME=%%~fi
+
+@rem Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
+set DEFAULT_JVM_OPTS="-Xmx64m" "-Xms64m"
+
+@rem Find java.exe
+if defined JAVA_HOME goto findJavaFromJavaHome
+
+set JAVA_EXE=java.exe
+%JAVA_EXE% -version >NUL 2>&1
+if %ERRORLEVEL% equ 0 goto execute
+
+echo. 1>&2
+echo ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH. 1>&2
+echo. 1>&2
+echo Please set the JAVA_HOME variable in your environment to match the 1>&2
+echo location of your Java installation. 1>&2
+
+goto fail
+
+:findJavaFromJavaHome
+set JAVA_HOME=%JAVA_HOME:"=%
+set JAVA_EXE=%JAVA_HOME%/bin/java.exe
+
+if exist "%JAVA_EXE%" goto execute
+
+echo. 1>&2
+echo ERROR: JAVA_HOME is set to an invalid directory: %JAVA_HOME% 1>&2
+echo. 1>&2
+echo Please set the JAVA_HOME variable in your environment to match the 1>&2
+echo location of your Java installation. 1>&2
+
+goto fail
+
+:execute
+@rem Setup the command line
+
+set CLASSPATH=%APP_HOME%\gradle\wrapper\gradle-wrapper.jar
+
+
+@rem Execute Gradle
+"%JAVA_EXE%" %DEFAULT_JVM_OPTS% %JAVA_OPTS% %GRADLE_OPTS% "-Dorg.gradle.appname=%APP_BASE_NAME%" -classpath "%CLASSPATH%" org.gradle.wrapper.GradleWrapperMain %*
+
+:end
+@rem End local scope for the variables with windows NT shell
+if %ERRORLEVEL% equ 0 goto mainEnd
+
+:fail
+rem Set variable GRADLE_EXIT_CONSOLE if you need the _script_ return code instead of
+rem the _cmd.exe /c_ return code!
+set EXIT_CODE=%ERRORLEVEL%
+if %EXIT_CODE% equ 0 set EXIT_CODE=1
+if not ""=="%GRADLE_EXIT_CONSOLE%" exit %EXIT_CODE%
+exit /b %EXIT_CODE%
+
+:mainEnd
+if "%OS%"=="Windows_NT" endlocal
+
+:omega
diff --git a/packages/react-native-platform/android/src/main/AndroidManifest.xml b/packages/react-native-platform/android/src/main/AndroidManifest.xml
new file mode 100644
index 0000000..16de78c
--- /dev/null
+++ b/packages/react-native-platform/android/src/main/AndroidManifest.xml
@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<manifest xmlns:android="http://schemas.android.com/apk/res/android"
+    package="com.okta.reactnativeplatform">
+</manifest>
\ No newline at end of file
diff --git a/packages/react-native-platform/android/src/main/java/com/okta/reactnativeplatform/OktaReactNativePlatformPackage.kt b/packages/react-native-platform/android/src/main/java/com/okta/reactnativeplatform/OktaReactNativePlatformPackage.kt
new file mode 100644
index 0000000..db1f476
--- /dev/null
+++ b/packages/react-native-platform/android/src/main/java/com/okta/reactnativeplatform/OktaReactNativePlatformPackage.kt
@@ -0,0 +1,20 @@
+package com.okta.reactnativeplatform
+
+import com.facebook.react.ReactPackage
+import com.facebook.react.bridge.NativeModule
+import com.facebook.react.bridge.ReactApplicationContext
+import com.facebook.react.uimanager.ViewManager
+
+class OktaReactNativePlatformPackage : ReactPackage {
+    override fun createNativeModules(reactContext: ReactApplicationContext): List<NativeModule> {
+        return listOf(
+            TokenStorageModule(reactContext)
+        )
+    }
+
+    @Suppress("DEPRECATION")
+    override fun createViewManagers(reactContext: ReactApplicationContext): List<ViewManager<*, *>> {
+        return emptyList()
+    }
+}
+
diff --git a/packages/react-native-platform/android/src/main/java/com/okta/reactnativeplatform/browserSession/BrowserSessionModule.kt.disabled b/packages/react-native-platform/android/src/main/java/com/okta/reactnativeplatform/browserSession/BrowserSessionModule.kt.disabled
new file mode 100644
index 0000000..eaeb7c6
--- /dev/null
+++ b/packages/react-native-platform/android/src/main/java/com/okta/reactnativeplatform/browserSession/BrowserSessionModule.kt.disabled
@@ -0,0 +1,58 @@
+package com.okta.reactnativeplatform
+
+import android.app.Activity
+import android.content.Intent
+import android.net.Uri
+import androidx.browser.customtabs.CustomTabsIntent
+import com.facebook.react.bridge.*
+import com.facebook.react.module.annotations.ReactModule
+
+@ReactModule(name = BrowserSessionModule.NAME)
+class BrowserSessionModule(reactContext: ReactApplicationContext) :
+    ReactContextBaseJavaModule(reactContext) {
+
+    companion object {
+        const val NAME = "BrowserSessionBridge"
+    }
+
+    override fun getName(): String = NAME
+
+    @ReactMethod
+    fun launchBrowserSession(url: String, promise: Promise) {
+        try {
+            val activity = currentActivity as? Activity
+            if (activity == null) {
+                promise.reject("no_activity", "Current activity is not available")
+                return
+            }
+
+            val uri = Uri.parse(url)
+            if (uri.scheme == null || uri.host == null) {
+                promise.reject("invalid_url", "Invalid URL provided")
+                return
+            }
+
+            val customTabsIntent = CustomTabsIntent.Builder()
+                .setShareState(CustomTabsIntent.SHARE_STATE_ON)
+                .build()
+
+            customTabsIntent.launchUrl(activity, uri)
+            promise.resolve(null)
+        } catch (e: Exception) {
+            promise.reject("browser_session_error", "Failed to launch browser session", e)
+        }
+    }
+
+    @ReactMethod
+    fun closeBrowserSession(promise: Promise) {
+        try {
+            val activity = currentActivity as? Activity
+            if (activity != null) {
+                activity.finish()
+            }
+            promise.resolve(null)
+        } catch (e: Exception) {
+            promise.reject("close_error", "Failed to close browser session", e)
+        }
+    }
+}
diff --git a/packages/react-native-platform/android/src/main/java/com/okta/reactnativeplatform/tokenStorage/EncryptionManager.kt b/packages/react-native-platform/android/src/main/java/com/okta/reactnativeplatform/tokenStorage/EncryptionManager.kt
new file mode 100644
index 0000000..5b1f615
--- /dev/null
+++ b/packages/react-native-platform/android/src/main/java/com/okta/reactnativeplatform/tokenStorage/EncryptionManager.kt
@@ -0,0 +1,171 @@
+package com.okta.reactnativeplatform
+
+import android.security.keystore.KeyGenParameterSpec
+import android.security.keystore.KeyProperties
+import android.util.Base64
+import java.security.KeyStore
+import java.security.SecureRandom
+import javax.crypto.Cipher
+import javax.crypto.KeyGenerator
+import javax.crypto.SecretKey
+import javax.crypto.spec.GCMParameterSpec
+
+/**
+ * Manages AES-256-GCM encryption/decryption for token data.
+ * Uses Android Keystore for secure key generation and storage.
+ *
+ * - Generates 256-bit AES keys in hardware keystore when available
+ * - Uses AES-256-GCM for authenticated encryption
+ * - Generates random 12-byte IVs for each encryption
+ * - Prepends IV to ciphertext for decryption
+ */
+class EncryptionManager {
+    companion object {
+        // Keystore provider for secure key storage
+        private const val KEYSTORE_PROVIDER = "AndroidKeyStore"
+        
+        // Master key alias - single key per app
+        private const val MASTER_KEY_ALIAS = "okta_token_master_key"
+        
+        // Encryption algorithm and parameters
+        private const val ALGORITHM = KeyProperties.KEY_ALGORITHM_AES
+        private const val TRANSFORMATION = "AES/GCM/NoPadding"
+        private const val KEY_SIZE = 256
+        
+        // GCM parameters
+        private const val GCM_TAG_LENGTH_BITS = 128
+        private const val IV_LENGTH_BYTES = 12
+    }
+
+    private val keyStore: java.security.KeyStore by lazy {
+        try {
+            KeyStore.getInstance(KEYSTORE_PROVIDER).apply {
+                load(null)
+            }
+        } catch (e: Exception) {
+            // Fallback for test environments where AndroidKeyStore is not available
+            throw Exception("Failed to initialize Android Keystore: ${e.message}", e)
+        }
+    }
+
+    /**
+     * Encrypts plaintext using AES-256-GCM with a random IV.
+     * Returns Base64-encoded (IV + ciphertext) for storage.
+     *
+     * @param plaintext The data to encrypt
+     * @return Base64-encoded string of (IV + ciphertext)
+     * @throws Exception if encryption fails
+     */
+    fun encryptString(plaintext: String): String {
+        val dataToEncrypt = plaintext.toByteArray(Charsets.UTF_8)
+        
+        // Generate random IV
+        val iv = ByteArray(IV_LENGTH_BYTES)
+        java.security.SecureRandom().nextBytes(iv)
+        
+        // Get cipher and apply GCM spec with IV
+        val cipher = Cipher.getInstance(TRANSFORMATION)
+        val gcmSpec = GCMParameterSpec(GCM_TAG_LENGTH_BITS, iv)
+        
+        val secretKey = getMasterKey()
+        cipher.init(Cipher.ENCRYPT_MODE, secretKey, gcmSpec)
+        
+        // Encrypt data
+        val ciphertext = cipher.doFinal(dataToEncrypt)
+        
+        // Combine IV + ciphertext and Base64 encode
+        val encryptedData = iv + ciphertext
+        return Base64.encodeToString(encryptedData, Base64.NO_WRAP)
+    }
+
+    /**
+     * Decrypts Base64-encoded (IV + ciphertext) back to plaintext.
+     *
+     * @param encryptedString Base64-encoded (IV + ciphertext)
+     * @return Decrypted plaintext
+     * @throws Exception if decryption fails or data is corrupted
+     */
+    fun decryptString(encryptedString: String): String {
+        try {
+            // Decode from Base64
+            val encryptedData = Base64.decode(encryptedString, Base64.NO_WRAP)
+            
+            // Extract IV and ciphertext
+            if (encryptedData.size < IV_LENGTH_BYTES) {
+                throw IllegalArgumentException("Encrypted data too short: missing IV")
+            }
+            
+            val iv = encryptedData.sliceArray(0 until IV_LENGTH_BYTES)
+            val ciphertext = encryptedData.sliceArray(IV_LENGTH_BYTES until encryptedData.size)
+            
+            // Initialize cipher with IV
+            val cipher = Cipher.getInstance(TRANSFORMATION)
+            val gcmSpec = GCMParameterSpec(GCM_TAG_LENGTH_BITS, iv)
+            
+            val secretKey = getMasterKey()
+            cipher.init(Cipher.DECRYPT_MODE, secretKey, gcmSpec)
+            
+            // Decrypt
+            val plaintext = cipher.doFinal(ciphertext)
+            return String(plaintext, Charsets.UTF_8)
+        } catch (e: Exception) {
+            throw Exception("Decryption failed: ${e.message}", e)
+        }
+    }
+
+    /**
+     * Retrieves or generates the master key from Android Keystore.
+     *
+     * @return AES-256 SecretKey stored in Android Keystore
+     */
+    private fun getMasterKey(): SecretKey {
+        // Check if key already exists
+        val existingKey = keyStore.getKey(MASTER_KEY_ALIAS, null)
+        if (existingKey is SecretKey) {
+            return existingKey
+        }
+        
+        // Generate new master key
+        return generateMasterKey()
+    }
+
+    /**
+     * Generates a new AES-256 key in Android Keystore.
+     * Attempts hardware-backed keystore first, falls back to software-backed if unavailable.
+     *
+     * @return Newly generated AES-256 SecretKey
+     */
+    private fun generateMasterKey(): SecretKey {
+        val keyGenerator = KeyGenerator.getInstance(ALGORITHM, KEYSTORE_PROVIDER)
+        
+        try {
+            // attempt hardware-backed keystore first
+            val keySpec = KeyGenParameterSpec.Builder(
+                MASTER_KEY_ALIAS,
+                KeyProperties.PURPOSE_ENCRYPT or KeyProperties.PURPOSE_DECRYPT
+            ).apply {
+                setKeySize(KEY_SIZE)
+                setEncryptionPaddings(KeyProperties.ENCRYPTION_PADDING_NONE)
+                setBlockModes(KeyProperties.BLOCK_MODE_GCM)
+                setIsStrongBoxBacked(true)
+            }.build()
+
+            keyGenerator.init(keySpec)
+            return keyGenerator.generateKey()
+        } catch (e: Exception) {
+            // fallback to software-backed keystore if hardware is not available
+            val keySpec = KeyGenParameterSpec.Builder(
+                MASTER_KEY_ALIAS,
+                KeyProperties.PURPOSE_ENCRYPT or KeyProperties.PURPOSE_DECRYPT
+            ).apply {
+                setKeySize(KEY_SIZE)
+                setEncryptionPaddings(KeyProperties.ENCRYPTION_PADDING_NONE)
+                setBlockModes(KeyProperties.BLOCK_MODE_GCM)
+                setIsStrongBoxBacked(false)
+            }.build()
+            
+            keyGenerator.init(keySpec)
+            return keyGenerator.generateKey()
+        }
+    }
+}
diff --git a/packages/react-native-platform/android/src/main/java/com/okta/reactnativeplatform/tokenStorage/TokenDataStore.kt b/packages/react-native-platform/android/src/main/java/com/okta/reactnativeplatform/tokenStorage/TokenDataStore.kt
new file mode 100644
index 0000000..81ae5a3
--- /dev/null
+++ b/packages/react-native-platform/android/src/main/java/com/okta/reactnativeplatform/tokenStorage/TokenDataStore.kt
@@ -0,0 +1,221 @@
+package com.okta.reactnativeplatform
+
+import android.content.Context
+import androidx.datastore.core.DataStore
+import androidx.datastore.preferences.core.Preferences
+import androidx.datastore.preferences.core.edit
+import androidx.datastore.preferences.core.stringPreferencesKey
+import androidx.datastore.preferences.preferencesDataStore
+import kotlinx.coroutines.flow.first
+
+/**
+ * Secure token storage using DataStore with AES-256-GCM encryption.
+ *
+ * Tokens are encrypted before storage using EncryptionManager.
+ * Metadata is stored separately and remains unencrypted (no sensitive data).
+ *
+ * All operations are suspend functions - intended to be called from EncryptionManager's CoroutineScope.
+ */
+class TokenDataStore(private val context: Context) {
+    private val encryptionManager = EncryptionManager()
+
+    // DataStore instances
+    private val Context.tokenDataStore: DataStore<Preferences> by preferencesDataStore(
+        name = "okta_tokens_encrypted"
+    )
+
+    private val Context.metadataDataStore: DataStore<Preferences> by preferencesDataStore(
+        name = "okta_metadata"
+    )
+
+    /**
+     * Saves an encrypted token to DataStore.
+     *
+     * @param id Token ID
+     * @param tokenData Token data (plaintext)
+     * @throws Exception if encryption or storage fails
+     */
+    suspend fun saveToken(id: String, tokenData: String) {
+        try {
+            val encryptedData = encryptionManager.encryptString(tokenData)
+            val key = stringPreferencesKey(id)
+            
+            context.tokenDataStore.edit { preferences ->
+                preferences[key] = encryptedData
+            }
+        } catch (e: Exception) {
+            throw Exception("Failed to save token '$id': ${e.message}", e)
+        }
+    }
+
+    /**
+     * Retrieves and decrypts a token from DataStore.
+     *
+     * @param id Token ID
+     * @return Decrypted token data, or null if not found
+     * @throws Exception if decryption fails
+     */
+    suspend fun getToken(id: String): String? {
+        return try {
+            val key = stringPreferencesKey(id)
+            val preferences = context.tokenDataStore.data.first()
+            val encryptedData = preferences[key]
+            
+            encryptedData?.let { encryptionManager.decryptString(it) }
+        } catch (e: Exception) {
+            throw Exception("Failed to retrieve token '$id': ${e.message}", e)
+        }
+    }
+
+    /**
+     * Removes a token and its metadata from DataStore.
+     *
+     * @param id Token ID
+     * @throws Exception if operation fails
+     */
+    suspend fun removeToken(id: String) {
+        try {
+            val tokenKey = stringPreferencesKey(id)
+            val metadataKey = stringPreferencesKey(id)
+            
+            context.tokenDataStore.edit { preferences ->
+                preferences.remove(tokenKey)
+            }
+            
+            context.metadataDataStore.edit { preferences ->
+                preferences.remove(metadataKey)
+            }
+        } catch (e: Exception) {
+            throw Exception("Failed to remove token '$id': ${e.message}", e)
+        }
+    }
+
+    /**
+     * Retrieves all token IDs currently stored.
+     *
+     * @return List of token IDs
+     * @throws Exception if operation fails
+     */
+    suspend fun getAllTokenIds(): List<String> {
+        return try {
+            val preferences = context.tokenDataStore.data.first()
+            preferences.asMap().keys.map { it.name }
+        } catch (e: Exception) {
+            throw Exception("Failed to retrieve token IDs: ${e.message}", e)
+        }
+    }
+
+    /**
+     * Clears all tokens and metadata from DataStore.
+     *
+     * @throws Exception if operation fails
+     */
+    suspend fun clearAllTokens() {
+        try {
+            context.tokenDataStore.edit { preferences ->
+                preferences.clear()
+            }
+            
+            context.metadataDataStore.edit { preferences ->
+                preferences.clear()
+            }
+        } catch (e: Exception) {
+            throw Exception("Failed to clear tokens: ${e.message}", e)
+        }
+    }
+
+    // MARK: - Metadata Operations (Unencrypted)
+
+    /**
+     * Saves metadata (unencrypted) to DataStore.
+     *
+     * @param id Metadata ID
+     * @param metadataData Metadata JSON string
+     * @throws Exception if operation fails
+     */
+    suspend fun saveMetadata(id: String, metadataData: String) {
+        try {
+            val key = stringPreferencesKey(id)
+            context.metadataDataStore.edit { preferences ->
+                preferences[key] = metadataData
+            }
+        } catch (e: Exception) {
+            throw Exception("Failed to save metadata '$id': ${e.message}", e)
+        }
+    }
+
+    /**
+     * Retrieves metadata from DataStore.
+     *
+     * @param id Metadata ID
+     * @return Metadata JSON string, or null if not found
+     * @throws Exception if operation fails
+     */
+    suspend fun getMetadata(id: String): String? {
+        return try {
+            val key = stringPreferencesKey(id)
+            val preferences = context.metadataDataStore.data.first()
+            preferences[key]
+        } catch (e: Exception) {
+            throw Exception("Failed to retrieve metadata '$id': ${e.message}", e)
+        }
+    }
+
+    /**
+     * Removes metadata from DataStore.
+     *
+     * @param id Metadata ID
+     * @throws Exception if operation fails
+     */
+    suspend fun removeMetadata(id: String) {
+        try {
+            val key = stringPreferencesKey(id)
+            context.metadataDataStore.edit { preferences ->
+                preferences.remove(key)
+            }
+        } catch (e: Exception) {
+            throw Exception("Failed to remove metadata '$id': ${e.message}", e)
+        }
+    }
+
+    /**
+     * Sets the default token ID in metadata storage.
+     *
+     * @param id Token ID, or null to clear default
+     * @throws Exception if operation fails
+     */
+    suspend fun setDefaultTokenId(id: String?) {
+        try {
+            val key = stringPreferencesKey(DEFAULT_TOKEN_KEY)
+            context.metadataDataStore.edit { preferences ->
+                if (id != null) {
+                    preferences[key] = id
+                } else {
+                    preferences.remove(key)
+                }
+            }
+        } catch (e: Exception) {
+            throw Exception("Failed to set default token ID: ${e.message}", e)
+        }
+    }
+
+    /**
+     * Retrieves the default token ID from metadata storage.
+     *
+     * @return Default token ID, or null if not set
+     * @throws Exception if operation fails
+     */
+    suspend fun getDefaultTokenId(): String? {
+        return try {
+            val key = stringPreferencesKey(DEFAULT_TOKEN_KEY)
+            val preferences = context.metadataDataStore.data.first()
+            preferences[key]
+        } catch (e: Exception) {
+            throw Exception("Failed to retrieve default token ID: ${e.message}", e)
+        }
+    }
+
+    companion object {
+        private const val DEFAULT_TOKEN_KEY = "okta-default-token"
+    }
+}
diff --git a/packages/react-native-platform/android/src/main/java/com/okta/reactnativeplatform/tokenStorage/TokenStorageModule.kt b/packages/react-native-platform/android/src/main/java/com/okta/reactnativeplatform/tokenStorage/TokenStorageModule.kt
new file mode 100644
index 0000000..e5e8eab
--- /dev/null
+++ b/packages/react-native-platform/android/src/main/java/com/okta/reactnativeplatform/tokenStorage/TokenStorageModule.kt
@@ -0,0 +1,155 @@
+package com.okta.reactnativeplatform
+
+import com.facebook.react.bridge.*
+import com.facebook.react.module.annotations.ReactModule
+import kotlinx.coroutines.CoroutineScope
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.Job
+import kotlinx.coroutines.launch
+
+@ReactModule(name = TokenStorageModule.NAME)
+class TokenStorageModule(reactContext: ReactApplicationContext) :
+    ReactContextBaseJavaModule(reactContext) {
+
+    companion object {
+        const val NAME = "TokenStorageBridge"
+    }
+
+    override fun getName(): String = NAME
+
+    // DataStore provider for encrypted token and metadata storage
+    private val dataStore = TokenDataStore(reactContext)
+
+    // CoroutineScope for async DataStore operations
+    // Uses IO dispatcher to avoid blocking main thread
+    // Scope persists for the lifetime of the app (React Native modules are singletons)
+    private val scope = CoroutineScope(Dispatchers.IO + Job())
+
+    // MARK: - Token Operations (Secure Storage)
+
+    @ReactMethod
+    fun saveToken(id: String, tokenData: String, promise: Promise) {
+        scope.launch {
+            try {
+                dataStore.saveToken(id, tokenData)
+                promise.resolve(null)
+            } catch (e: Exception) {
+                promise.reject("token_save_error", "Failed to save token", e)
+            }
+        }
+    }
+
+    @ReactMethod
+    fun getToken(id: String, promise: Promise) {
+        scope.launch {
+            try {
+                val token = dataStore.getToken(id)
+                promise.resolve(token)
+            } catch (e: Exception) {
+                promise.resolve(null)
+            }
+        }
+    }
+
+    @ReactMethod
+    fun removeToken(id: String, promise: Promise) {
+        scope.launch {
+            try {
+                dataStore.removeToken(id)
+                promise.resolve(null)
+            } catch (e: Exception) {
+                promise.reject("token_remove_error", "Failed to remove token", e)
+            }
+        }
+    }
+
+    @ReactMethod
+    fun getAllTokenIds(promise: Promise) {
+        scope.launch {
+            try {
+                val keys = dataStore.getAllTokenIds()
+                val array = Arguments.createArray()
+                keys.forEach { array.pushString(it) }
+                promise.resolve(array)
+            } catch (e: Exception) {
+                promise.reject("token_list_error", "Failed to get token IDs", e)
+            }
+        }
+    }
+
+    @ReactMethod
+    fun clearTokens(promise: Promise) {
+        scope.launch {
+            try {
+                dataStore.clearAllTokens()
+                promise.resolve(null)
+            } catch (e: Exception) {
+                promise.reject("token_clear_error", "Failed to clear tokens", e)
+            }
+        }
+    }
+
+    // MARK: - Metadata Operations (Regular Storage)
+
+    @ReactMethod
+    fun saveMetadata(id: String, metadataData: String, promise: Promise) {
+        scope.launch {
+            try {
+                dataStore.saveMetadata(id, metadataData)
+                promise.resolve(null)
+            } catch (e: Exception) {
+                promise.reject("metadata_save_error", "Failed to save metadata", e)
+            }
+        }
+    }
+
+    @ReactMethod
+    fun getMetadata(id: String, promise: Promise) {
+        scope.launch {
+            try {
+                val metadata = dataStore.getMetadata(id)
+                promise.resolve(metadata)
+            } catch (e: Exception) {
+                promise.resolve(null)
+            }
+        }
+    }
+
+    @ReactMethod
+    fun removeMetadata(id: String, promise: Promise) {
+        scope.launch {
+            try {
+                dataStore.removeMetadata(id)
+                promise.resolve(null)
+            } catch (e: Exception) {
+                promise.reject("metadata_remove_error", "Failed to remove metadata", e)
+            }
+        }
+    }
+
+    // MARK: - Default Token ID
+
+    @ReactMethod
+    fun setDefaultTokenId(id: String?, promise: Promise) {
+        scope.launch {
+            try {
+                dataStore.setDefaultTokenId(id)
+                promise.resolve(null)
+            } catch (e: Exception) {
+                promise.reject("default_token_error", "Failed to set default token ID", e)
+            }
+        }
+    }
+
+    @ReactMethod
+    fun getDefaultTokenId(promise: Promise) {
+        scope.launch {
+            try {
+                val id = dataStore.getDefaultTokenId()
+                promise.resolve(id)
+            } catch (e: Exception) {
+                promise.resolve(null)
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/packages/react-native-platform/android/src/test/kotlin/com/okta/reactnativeplatform/browserSession/BrowserSessionModuleTest.kt.disabled b/packages/react-native-platform/android/src/test/kotlin/com/okta/reactnativeplatform/browserSession/BrowserSessionModuleTest.kt.disabled
new file mode 100644
index 0000000..05d959d
--- /dev/null
+++ b/packages/react-native-platform/android/src/test/kotlin/com/okta/reactnativeplatform/browserSession/BrowserSessionModuleTest.kt.disabled
@@ -0,0 +1,121 @@
+package com.okta.reactnativeplatform
+
+import android.app.Application
+import androidx.test.core.app.ApplicationProvider
+import com.facebook.react.bridge.ReactApplicationContext
+import com.facebook.react.bridge.Promise
+import io.mockk.mockk
+import io.mockk.slot
+import io.mockk.verify
+import org.junit.Before
+import org.junit.Test
+import org.junit.runner.RunWith
+import org.robolectric.RobolectricTestRunner
+import org.robolectric.annotation.Config
+import com.google.common.truth.Truth.assertThat
+
+/**
+ * Unit tests for BrowserSessionModule.
+ * Tests the Kotlin implementation of browser session operations.
+ */
+@RunWith(RobolectricTestRunner::class)
+@Config(sdk = [34])
+class BrowserSessionModuleTest {
+
+    private lateinit var module: BrowserSessionModule
+    private lateinit var context: ReactApplicationContext
+
+    @Before
+    fun setUp() {
+        val application = ApplicationProvider.getApplicationContext<Application>()
+        context = ReactApplicationContext(application)
+        module = BrowserSessionModule(context)
+    }
+
+    // MARK: - Module Info Tests
+
+    @Test
+    fun testGetName_shouldReturnBrowserSessionBridge() {
+        val name = module.name
+        assertThat(name).isEqualTo("BrowserSessionBridge")
+    }
+
+    // MARK: - Launch Browser Session Tests
+
+    @Test
+    fun testLaunchBrowserSession_withValidUrl_shouldResolvePromise() {
+        val promise = mockk<Promise>(relaxed = true)
+
+        module.launchBrowserSession("https://example.com", promise)
+
+        // Note: This test may resolve or reject depending on whether an activity is available
+        // In Robolectric environment, currentActivity may be null
+        verify { promise.reject("no_activity", "Current activity is not available") }
+    }
+
+    @Test
+    fun testLaunchBrowserSession_withInvalidUrl_shouldRejectPromise() {
+        val promise = mockk<Promise>(relaxed = true)
+        val rejectSlot = slot<String>()
+
+        module.launchBrowserSession("not a valid url", promise)
+
+        verify { promise.reject(capture(rejectSlot), any()) }
+        assertThat(rejectSlot.captured).isEqualTo("invalid_url")
+    }
+
+    @Test
+    fun testLaunchBrowserSession_withEmptyUrl_shouldRejectPromise() {
+        val promise = mockk<Promise>(relaxed = true)
+        val rejectSlot = slot<String>()
+
+        module.launchBrowserSession("", promise)
+
+        verify { promise.reject(capture(rejectSlot), any()) }
+        assertThat(rejectSlot.captured).isEqualTo("invalid_url")
+    }
+
+    // MARK: - Close Browser Session Tests
+
+    @Test
+    fun testCloseBrowserSession_shouldResolvePromise() {
+        val promise = mockk<Promise>(relaxed = true)
+
+        module.closeBrowserSession(promise)
+
+        verify { promise.resolve(null) }
+    }
+
+    @Test
+    fun testCloseBrowserSession_withoutActivity_shouldStillResolve() {
+        val promise = mockk<Promise>(relaxed = true)
+
+        module.closeBrowserSession(promise)
+
+        verify { promise.resolve(null) }
+    }
+
+    // MARK: - Error Handling Tests
+
+    @Test
+    fun testLaunchBrowserSession_withMalformedUrl_shouldRejectInvalidUrl() {
+        val promise = mockk<Promise>(relaxed = true)
+        val codeSlot = slot<String>()
+
+        module.launchBrowserSession("://invalid", promise)
+
+        // Malformed URL should either be caught or handled gracefully
+        assertThat(promise).isNotNull()
+    }
+
+    @Test
+    fun testLaunchBrowserSession_withSchemeOnly_shouldRejectInvalidUrl() {
+        val promise = mockk<Promise>(relaxed = true)
+        val rejectSlot = slot<String>()
+
+        module.launchBrowserSession("https://", promise)
+
+        verify { promise.reject(capture(rejectSlot), any()) }
+        assertThat(rejectSlot.captured).isEqualTo("invalid_url")
+    }
+}
diff --git a/packages/react-native-platform/android/src/test/kotlin/com/okta/reactnativeplatform/tokenStorage/EncryptionManagerTest.kt b/packages/react-native-platform/android/src/test/kotlin/com/okta/reactnativeplatform/tokenStorage/EncryptionManagerTest.kt
new file mode 100644
index 0000000..3e06186
--- /dev/null
+++ b/packages/react-native-platform/android/src/test/kotlin/com/okta/reactnativeplatform/tokenStorage/EncryptionManagerTest.kt
@@ -0,0 +1,279 @@
+package com.okta.reactnativeplatform
+
+import android.util.Base64
+import org.junit.Before
+import org.junit.Test
+import org.junit.Ignore
+import org.junit.runner.RunWith
+import org.robolectric.RobolectricTestRunner
+import org.robolectric.annotation.Config
+import com.google.common.truth.Truth.assertThat
+import org.junit.Assert.assertThrows
+import org.junit.Assume
+
+/**
+ * Unit tests for EncryptionManager.
+ * Tests AES-256-GCM encryption/decryption with random IV generation.
+ *
+ * Note: These tests require Android Keystore to be available.
+ * On CI environments without Keystore support, these tests are skipped.
+ */
+@RunWith(RobolectricTestRunner::class)
+@Config(sdk = [34])
+class EncryptionManagerTest {
+
+    private lateinit var encryptionManager: EncryptionManager
+    private var keystoreAvailable = false
+
+    @Before
+    fun setUp() {
+        // Note: EncryptionManager initialization will be skipped if AndroidKeystore is not available
+        try {
+            encryptionManager = EncryptionManager()
+            keystoreAvailable = true
+        } catch (e: Exception) {
+            // AndroidKeyStore not available in test environment - tests will be skipped
+            // This is expected on CI environments
+            keystoreAvailable = false
+        }
+    }
+
+    // MARK: - Basic Encryption Tests
+
+    @Test
+    fun testEncryptString_returnsBase64EncodedValue() {
+        Assume.assumeTrue("Android Keystore not available", keystoreAvailable)
+        
+        val plaintext = "test-token-data"
+        
+        val encrypted = encryptionManager.encryptString(plaintext)
+        
+        assertThat(encrypted).isNotNull()
+        assertThat(encrypted).isNotEmpty()
+        // Encrypted value should be valid Base64
+        assertThat(isValidBase64(encrypted)).isTrue()
+    }
+
+    @Test
+    fun testDecryptString_retrievesOriginalPlaintext() {
+        Assume.assumeTrue("Android Keystore not available", keystoreAvailable)
+        
+        val plaintext = "test-token-data"
+        
+        val encrypted = encryptionManager.encryptString(plaintext)
+        val decrypted = encryptionManager.decryptString(encrypted)
+        
+        assertThat(decrypted).isEqualTo(plaintext)
+    }
+
+    @Test
+    fun testEncryptDecryptRoundTrip_withComplexData() {
+        Assume.assumeTrue("Android Keystore not available", keystoreAvailable)
+        
+        val plaintext = """
+            {
+                "access_token": "eyJhbGciOiJSUzI1NiIsImtpZCI6IjEifQ",
+                "token_type": "Bearer",
+                "expires_in": 3600,
+                "scope": "openid profile email"
+            }
+        """.trimIndent()
+        
+        val encrypted = encryptionManager.encryptString(plaintext)
+        val decrypted = encryptionManager.decryptString(encrypted)
+        
+        assertThat(decrypted).isEqualTo(plaintext)
+    }
+
+    @Test
+    fun testEncryptDecryptRoundTrip_withUnicodeCharacters() {
+        Assume.assumeTrue("Android Keystore not available", keystoreAvailable)
+        
+        val plaintext = "token-with-unicode-🔐-key"
+        
+        val encrypted = encryptionManager.encryptString(plaintext)
+        val decrypted = encryptionManager.decryptString(encrypted)
+        
+        assertThat(decrypted).isEqualTo(plaintext)
+    }
+
+    // MARK: - IV Tests
+
+    @Test
+    fun testEncryptString_generatesRandomIV() {
+        Assume.assumeTrue("Android Keystore not available", keystoreAvailable)
+        
+        val plaintext = "test-token-data"
+        
+        val encrypted1 = encryptionManager.encryptString(plaintext)
+        val encrypted2 = encryptionManager.encryptString(plaintext)
+        
+        // Same plaintext encrypted twice should produce different ciphertexts
+        // due to random IV generation
+        assertThat(encrypted1).isNotEqualTo(encrypted2)
+    }
+
+    @Test
+    fun testEncryptString_ivIsPrependedToCiphertext() {
+        Assume.assumeTrue("Android Keystore not available", keystoreAvailable)
+        
+        val plaintext = "test-token-data"
+        
+        val encrypted = encryptionManager.encryptString(plaintext)
+        val encryptedBytes = Base64.decode(encrypted, Base64.NO_WRAP)
+        
+        // IV should be 12 bytes, followed by ciphertext
+        // GCM authentication tag is 16 bytes (appended to ciphertext)
+        // So minimum size: 12 (IV) + 1 (minimum plaintext) + 16 (tag) = 29 bytes
+        assertThat(encryptedBytes.size).isAtLeast(29)
+    }
+
+    // MARK: - Error Handling Tests
+
+    @Test
+    fun testDecryptString_withInvalidBase64_throwsException() {
+        Assume.assumeTrue("Android Keystore not available", keystoreAvailable)
+        
+        val invalidBase64 = "!!!not-valid-base64!!!"
+        
+        assertThrows(Exception::class.java) {
+            encryptionManager.decryptString(invalidBase64)
+        }
+    }
+
+    @Test
+    fun testDecryptString_withTamperedData_throwsException() {
+        Assume.assumeTrue("Android Keystore not available", keystoreAvailable)
+        
+        val plaintext = "test-token-data"
+        val encrypted = encryptionManager.encryptString(plaintext)
+        
+        // Tamper with encrypted data by flipping a bit
+        val encryptedBytes = Base64.decode(encrypted, Base64.NO_WRAP)
+        encryptedBytes[encryptedBytes.size - 1] = (encryptedBytes[encryptedBytes.size - 1].toInt() xor 1).toByte()
+        val tamperedEncrypted = Base64.encodeToString(encryptedBytes, Base64.NO_WRAP)
+        
+        // GCM should detect tampering and throw an exception
+        assertThrows(Exception::class.java) {
+            encryptionManager.decryptString(tamperedEncrypted)
+        }
+    }
+
+    @Test
+    fun testDecryptString_withTruncatedData_throwsException() {
+        Assume.assumeTrue("Android Keystore not available", keystoreAvailable)
+        
+        val plaintext = "test-token-data"
+        val encrypted = encryptionManager.encryptString(plaintext)
+        
+        // Truncate encrypted data
+        val truncated = encrypted.substring(0, encrypted.length / 2)
+        
+        assertThrows(Exception::class.java) {
+            encryptionManager.decryptString(truncated)
+        }
+    }
+
+    @Test
+    fun testDecryptString_withDataMissingIV_throwsException() {
+        Assume.assumeTrue("Android Keystore not available", keystoreAvailable)
+        
+        // Create data that's too short to contain IV (12 bytes)
+        val shortData = Base64.encodeToString(ByteArray(5), Base64.NO_WRAP)
+        
+        assertThrows(Exception::class.java) {
+            encryptionManager.decryptString(shortData)
+        }
+    }
+
+    // MARK: - Empty/Edge Case Tests
+
+    @Test
+    fun testEncryptDecrypt_withEmptyString() {
+        Assume.assumeTrue("Android Keystore not available", keystoreAvailable)
+        
+        val plaintext = ""
+        
+        val encrypted = encryptionManager.encryptString(plaintext)
+        val decrypted = encryptionManager.decryptString(encrypted)
+        
+        assertThat(decrypted).isEqualTo(plaintext)
+    }
+
+    @Test
+    fun testEncryptDecrypt_withLargeString() {
+        Assume.assumeTrue("Android Keystore not available", keystoreAvailable)
+        
+        // Create a large string (1MB)
+        val plaintext = "x".repeat(1024 * 1024)
+        
+        val encrypted = encryptionManager.encryptString(plaintext)
+        val decrypted = encryptionManager.decryptString(encrypted)
+        
+        assertThat(decrypted).isEqualTo(plaintext)
+    }
+
+    @Test
+    fun testEncryptDecrypt_withSpecialCharacters() {
+        Assume.assumeTrue("Android Keystore not available", keystoreAvailable)
+        
+        val plaintext = "!@#$%^&*()_+-={}[]|\\:;\"'<>,.?/"
+        
+        val encrypted = encryptionManager.encryptString(plaintext)
+        val decrypted = encryptionManager.decryptString(encrypted)
+        
+        assertThat(decrypted).isEqualTo(plaintext)
+    }
+
+    // MARK: - Hardware-Backed Keystore Fallback Tests
+
+    @Test
+    fun testKeyGeneration_succeedsWithFallback() {
+        Assume.assumeTrue("Android Keystore not available", keystoreAvailable)
+
+        // This test verifies that key generation succeeds.
+        // If hardware-backed keystore is available, the first attempt succeeds.
+        // If not available, the fallback to software-backed succeeds.
+        // Either way, encryption/decryption should work.
+        val plaintext = "test-token-for-key-generation"
+
+        val encrypted = encryptionManager.encryptString(plaintext)
+        val decrypted = encryptionManager.decryptString(encrypted)
+
+        // If we reach here, key generation succeeded with either hardware or software backing
+        assertThat(decrypted).isEqualTo(plaintext)
+    }
+
+    @Test
+    fun testEncryptDecrypt_withKeyStoreBackingVariation() {
+        Assume.assumeTrue("Android Keystore not available", keystoreAvailable)
+
+        // Test that encryption works consistently, regardless of whether the key
+        // was generated with hardware-backed or software-backed keystore.
+        // Both approaches should produce the same encryption/decryption behavior.
+        val plaintext = "consistent-encryption-test"
+
+        val encrypted1 = encryptionManager.encryptString(plaintext)
+        val decrypted1 = encryptionManager.decryptString(encrypted1)
+
+        val encrypted2 = encryptionManager.encryptString(plaintext)
+        val decrypted2 = encryptionManager.decryptString(encrypted2)
+
+        // Both encryptions should decrypt to the same plaintext
+        assertThat(decrypted1).isEqualTo(plaintext)
+        assertThat(decrypted2).isEqualTo(plaintext)
+        // Different IVs should produce different ciphertexts
+        assertThat(encrypted1).isNotEqualTo(encrypted2)
+    }
+
+    // MARK: - Helper Functions
+
+    private fun isValidBase64(str: String): Boolean {
+        return try {
+            Base64.decode(str, Base64.NO_WRAP)
+            true
+        } catch (e: IllegalArgumentException) {
+            false
+        }
+    }
+}
diff --git a/packages/react-native-platform/android/src/test/kotlin/com/okta/reactnativeplatform/tokenStorage/TokenDataStoreTest.kt b/packages/react-native-platform/android/src/test/kotlin/com/okta/reactnativeplatform/tokenStorage/TokenDataStoreTest.kt
new file mode 100644
index 0000000..04f9af3
--- /dev/null
+++ b/packages/react-native-platform/android/src/test/kotlin/com/okta/reactnativeplatform/tokenStorage/TokenDataStoreTest.kt
@@ -0,0 +1,355 @@
+package com.okta.reactnativeplatform
+
+import android.app.Application
+import androidx.datastore.core.DataStore
+import androidx.datastore.preferences.core.Preferences
+import androidx.datastore.preferences.core.edit
+import androidx.datastore.preferences.core.stringPreferencesKey
+import androidx.test.core.app.ApplicationProvider
+import kotlinx.coroutines.flow.first
+import kotlinx.coroutines.runBlocking
+import org.junit.Assume
+import org.junit.Before
+import org.junit.Test
+import org.junit.runner.RunWith
+import org.robolectric.RobolectricTestRunner
+import org.robolectric.annotation.Config
+import com.google.common.truth.Truth.assertThat
+
+/**
+ * Unit tests for TokenDataStore.
+ * Tests async DataStore operations with encryption integration.
+ * Uses runBlocking to bridge suspend functions in tests.
+ * Tests skip on CI where Android Keystore is unavailable.
+ */
+@RunWith(RobolectricTestRunner::class)
+@Config(sdk = [34])
+class TokenDataStoreTest {
+
+    private lateinit var dataStore: TokenDataStore
+    private lateinit var application: Application
+    private var keystoreAvailable = false
+
+    @Before
+    fun setUp() {
+        application = ApplicationProvider.getApplicationContext<Application>()
+        
+        // Check if Android Keystore is available
+        try {
+            EncryptionManager()
+            keystoreAvailable = true
+        } catch (e: Exception) {
+            keystoreAvailable = false
+        }
+
+        dataStore = TokenDataStore(application)
+    }
+
+    // MARK: - Token Operations Tests
+
+    @Test
+    fun testSaveToken_storesEncryptedToken() = runBlocking {
+        Assume.assumeTrue("Android Keystore not available", keystoreAvailable)
+        
+        val tokenId = "test-token-id"
+        val tokenData = "test-token-data"
+        
+        dataStore.saveToken(tokenId, tokenData)
+        
+        // Verify token was saved
+        val retrieved = dataStore.getToken(tokenId)
+        assertThat(retrieved).isEqualTo(tokenData)
+    }
+
+    @Test
+    fun testGetToken_returnsDecryptedValue() = runBlocking {
+        Assume.assumeTrue("Android Keystore not available", keystoreAvailable)
+        
+        val tokenId = "test-token-id"
+        val tokenData = """{"access_token": "abc123", "token_type": "Bearer"}"""
+        
+        dataStore.saveToken(tokenId, tokenData)
+        val retrieved = dataStore.getToken(tokenId)
+        
+        assertThat(retrieved).isEqualTo(tokenData)
+    }
+
+    @Test
+    fun testGetToken_nonExistent_returnsNull() = runBlocking {
+        Assume.assumeTrue("Android Keystore not available", keystoreAvailable)
+        
+        val retrieved = dataStore.getToken("non-existent-id")
+        
+        assertThat(retrieved).isNull()
+    }
+
+    @Test
+    fun testRemoveToken_deletesToken() = runBlocking {
+        Assume.assumeTrue("Android Keystore not available", keystoreAvailable)
+        
+        val tokenId = "test-token-id"
+        
+        dataStore.saveToken(tokenId, "test-token-data")
+        dataStore.removeToken(tokenId)
+        val retrieved = dataStore.getToken(tokenId)
+        
+        assertThat(retrieved).isNull()
+    }
+
+    @Test
+    fun testRemoveToken_removesMetadata() = runBlocking {
+        Assume.assumeTrue("Android Keystore not available", keystoreAvailable)
+        
+        val tokenId = "test-token-id"
+        
+        dataStore.saveToken(tokenId, "test-token-data")
+        dataStore.saveMetadata(tokenId, "test-metadata")
+        dataStore.removeToken(tokenId)
+        val metadata = dataStore.getMetadata(tokenId)
+        
+        assertThat(metadata).isNull()
+    }
+
+    @Test
+    fun testGetAllTokenIds_returnsEmptyListForEmptyStorage() = runBlocking {
+        Assume.assumeTrue("Android Keystore not available", keystoreAvailable)
+        
+        val ids = dataStore.getAllTokenIds()
+        
+        assertThat(ids).isEmpty()
+    }
+
+    @Test
+    fun testGetAllTokenIds_returnsAllSavedTokenIds() = runBlocking {
+        Assume.assumeTrue("Android Keystore not available", keystoreAvailable)
+        
+        dataStore.saveToken("token-1", "data-1")
+        dataStore.saveToken("token-2", "data-2")
+        dataStore.saveToken("token-3", "data-3")
+        
+        val ids = dataStore.getAllTokenIds()
+        
+        assertThat(ids).hasSize(3)
+        assertThat(ids).containsExactly("token-1", "token-2", "token-3")
+    }
+
+    @Test
+    fun testClearAllTokens_removesAllTokens() = runBlocking {
+        Assume.assumeTrue("Android Keystore not available", keystoreAvailable)
+        
+        dataStore.saveToken("token-1", "data-1")
+        dataStore.saveToken("token-2", "data-2")
+        
+        dataStore.clearAllTokens()
+        
+        val ids = dataStore.getAllTokenIds()
+        assertThat(ids).isEmpty()
+    }
+
+    @Test
+    fun testClearAllTokens_removesAllMetadata() = runBlocking {
+        Assume.assumeTrue("Android Keystore not available", keystoreAvailable)
+        
+        dataStore.saveMetadata("meta-1", "data-1")
+        dataStore.saveMetadata("meta-2", "data-2")
+        
+        dataStore.clearAllTokens()
+        
+        val meta1 = dataStore.getMetadata("meta-1")
+        val meta2 = dataStore.getMetadata("meta-2")
+        assertThat(meta1).isNull()
+        assertThat(meta2).isNull()
+    }
+
+    // MARK: - Metadata Operations Tests
+
+    @Test
+    fun testSaveMetadata_storesMetadata() = runBlocking {
+        Assume.assumeTrue("Android Keystore not available", keystoreAvailable)
+        
+        val metadataId = "test-metadata-id"
+        val metadataData = """{"expiresAt": 1234567890, "scope": "openid profile"}"""
+        
+        dataStore.saveMetadata(metadataId, metadataData)
+        
+        val retrieved = dataStore.getMetadata(metadataId)
+        assertThat(retrieved).isEqualTo(metadataData)
+    }
+
+    @Test
+    fun testGetMetadata_nonExistent_returnsNull() = runBlocking {
+        Assume.assumeTrue("Android Keystore not available", keystoreAvailable)
+        
+        val retrieved = dataStore.getMetadata("non-existent-id")
+        
+        assertThat(retrieved).isNull()
+    }
+
+    @Test
+    fun testRemoveMetadata_deletesMetadata() = runBlocking {
+        Assume.assumeTrue("Android Keystore not available", keystoreAvailable)
+        
+        val metadataId = "test-metadata-id"
+        
+        dataStore.saveMetadata(metadataId, "test-metadata")
+        dataStore.removeMetadata(metadataId)
+        val retrieved = dataStore.getMetadata(metadataId)
+        
+        assertThat(retrieved).isNull()
+    }
+
+    @Test
+    fun testMetadata_isNotEncrypted() = runBlocking {
+        Assume.assumeTrue("Android Keystore not available", keystoreAvailable)
+        
+        val metadataId = "test-metadata-id"
+        val metadataData = """{"expiresAt": 1234567890}"""
+        
+        dataStore.saveMetadata(metadataId, metadataData)
+        
+        // Metadata should be stored in the metadata DataStore and be readable without decryption
+        val retrieved = dataStore.getMetadata(metadataId)
+        // The value should match exactly (not encrypted)
+        assertThat(retrieved).isEqualTo(metadataData)
+    }
+
+    // MARK: - Default Token ID Tests
+
+    @Test
+    fun testSetDefaultTokenId_storesId() = runBlocking {
+        Assume.assumeTrue("Android Keystore not available", keystoreAvailable)
+        
+        val defaultId = "default-token-id"
+        
+        dataStore.setDefaultTokenId(defaultId)
+        
+        val retrieved = dataStore.getDefaultTokenId()
+        assertThat(retrieved).isEqualTo(defaultId)
+    }
+
+    @Test
+    fun testSetDefaultTokenId_null_clearsDefault() = runBlocking {
+        Assume.assumeTrue("Android Keystore not available", keystoreAvailable)
+        
+        val defaultId = "default-token-id"
+        
+        dataStore.setDefaultTokenId(defaultId)
+        dataStore.setDefaultTokenId(null)
+        
+        val retrieved = dataStore.getDefaultTokenId()
+        assertThat(retrieved).isNull()
+    }
+
+    @Test
+    fun testGetDefaultTokenId_woNothingSet_returnsNull() = runBlocking {
+        Assume.assumeTrue("Android Keystore not available", keystoreAvailable)
+        
+        val retrieved = dataStore.getDefaultTokenId()
+        
+        assertThat(retrieved).isNull()
+    }
+
+    @Test
+    fun testSetDefaultTokenId_overwrites_previousValue() = runBlocking {
+        Assume.assumeTrue("Android Keystore not available", keystoreAvailable)
+        
+        dataStore.setDefaultTokenId("id-1")
+        dataStore.setDefaultTokenId("id-2")
+        
+        val retrieved = dataStore.getDefaultTokenId()
+        
+        assertThat(retrieved).isEqualTo("id-2")
+    }
+
+    // MARK: - Integration Tests
+
+    @Test
+    fun testTokensAndMetadata_canBeStoredSeparately() = runBlocking {
+        Assume.assumeTrue("Android Keystore not available", keystoreAvailable)
+        
+        val tokenId = "test-token"
+        val tokenData = "token-data"
+        val metadataData = """{"expiresAt": 1234567890}"""
+        
+        dataStore.saveToken(tokenId, tokenData)
+        dataStore.saveMetadata(tokenId, metadataData)
+        
+        val retrievedToken = dataStore.getToken(tokenId)
+        val retrievedMetadata = dataStore.getMetadata(tokenId)
+        
+        assertThat(retrievedToken).isEqualTo(tokenData)
+        assertThat(retrievedMetadata).isEqualTo(metadataData)
+    }
+
+    @Test
+    fun testMultipleTokens_withDifferentMetadata() = runBlocking {
+        Assume.assumeTrue("Android Keystore not available", keystoreAvailable)
+        
+        dataStore.saveToken("token-1", "data-1")
+        dataStore.saveMetadata("token-1", "meta-1")
+        
+        dataStore.saveToken("token-2", "data-2")
+        dataStore.saveMetadata("token-2", "meta-2")
+        
+        val token1 = dataStore.getToken("token-1")
+        val meta1 = dataStore.getMetadata("token-1")
+        val token2 = dataStore.getToken("token-2")
+        val meta2 = dataStore.getMetadata("token-2")
+        
+        assertThat(token1).isEqualTo("data-1")
+        assertThat(meta1).isEqualTo("meta-1")
+        assertThat(token2).isEqualTo("data-2")
+        assertThat(meta2).isEqualTo("meta-2")
+    }
+
+    @Test
+    fun testEncryptionManager_usedForTokens() = runBlocking {
+        Assume.assumeTrue("Android Keystore not available", keystoreAvailable)
+        
+        val tokenId = "test-token"
+        val plaintext = "sensitive-token-data"
+        
+        // Save token (should be encrypted internally)
+        dataStore.saveToken(tokenId, plaintext)
+        
+        // Retrieve it (should be decrypted automatically)
+        val retrieved = dataStore.getToken(tokenId)
+        
+        // Should get the original plaintext
+        assertThat(retrieved).isEqualTo(plaintext)
+    }
+
+    // MARK: - Error Handling Tests
+
+    @Test
+    fun testSaveToken_withEmptyId_storesToken() = runBlocking {
+        val tokenData = "test-token-data"
+        
+        dataStore.saveToken("", tokenData)
+        
+        val retrieved = dataStore.getToken("")
+        assertThat(retrieved).isEqualTo(tokenData)
+    }
+
+    @Test
+    fun testSaveMetadata_withLargeData() = runBlocking {
+        val metadataId = "test-id"
+        val largeData = "x".repeat(10000)
+        
+        dataStore.saveMetadata(metadataId, largeData)
+        
+        val retrieved = dataStore.getMetadata(metadataId)
+        assertThat(retrieved).isEqualTo(largeData)
+    }
+
+    @Test
+    fun testSaveToken_withSpecialCharactersInId() = runBlocking {
+        val tokenId = "token:with:special*chars@123"
+        val tokenData = "test-data"
+        
+        dataStore.saveToken(tokenId, tokenData)
+        
+        val retrieved = dataStore.getToken(tokenId)
+        assertThat(retrieved).isEqualTo(tokenData)
+    }
+}
diff --git a/packages/react-native-platform/android/src/test/kotlin/com/okta/reactnativeplatform/tokenStorage/TokenStorageModuleTest.kt b/packages/react-native-platform/android/src/test/kotlin/com/okta/reactnativeplatform/tokenStorage/TokenStorageModuleTest.kt
new file mode 100644
index 0000000..43ef96d
--- /dev/null
+++ b/packages/react-native-platform/android/src/test/kotlin/com/okta/reactnativeplatform/tokenStorage/TokenStorageModuleTest.kt
@@ -0,0 +1,406 @@
+package com.okta.reactnativeplatform
+
+import android.app.Application
+import androidx.test.core.app.ApplicationProvider
+import com.facebook.react.bridge.ReactApplicationContext
+import com.facebook.react.bridge.Promise
+import com.facebook.react.bridge.Arguments
+import com.facebook.react.bridge.WritableArray
+import io.mockk.mockk
+import io.mockk.slot
+import io.mockk.verify
+import io.mockk.every
+import io.mockk.mockkStatic
+import org.junit.Assume
+import org.junit.Before
+import org.junit.Test
+import org.junit.runner.RunWith
+import org.robolectric.RobolectricTestRunner
+import org.robolectric.annotation.Config
+import com.google.common.truth.Truth.assertThat
+import java.util.concurrent.CountDownLatch
+import java.util.concurrent.TimeUnit
+
+/**
+ * Unit tests for TokenStorageModule.
+ * Tests the React Native module that delegates to TokenDataStore.
+ * Uses async testing patterns to handle CoroutineScope-based async operations.
+ */
+@RunWith(RobolectricTestRunner::class)
+@Config(sdk = [34])
+class TokenStorageModuleTest {
+
+    private lateinit var module: TokenStorageModule
+    private lateinit var context: ReactApplicationContext
+    private lateinit var application: Application
+    private var keystoreAvailable = false
+
+    companion object {
+        // Timeout for async operations in tests (ms)
+        private const val OPERATION_TIMEOUT_MS = 5000L
+    }
+
+    @Before
+    fun setUp() {
+        application = ApplicationProvider.getApplicationContext<Application>()
+
+        // Check if Android Keystore is available by trying to encrypt something
+        try {
+            val manager = EncryptionManager()
+            manager.encryptString("test")
+            keystoreAvailable = true
+        } catch (e: Exception) {
+            keystoreAvailable = false
+        }
+
+        // Mock Arguments.createArray() to avoid React Native initialization
+        mockkStatic(Arguments::class)
+        every { Arguments.createArray() } answers {
+            mockk<WritableArray>(relaxed = true)
+        }
+
+        // Create a real context wrapper that behaves like ReactApplicationContext
+        // Use the real application context to allow DataStore to access file system
+        context = mockk<ReactApplicationContext>(relaxed = true)
+        every { context.baseContext } returns application
+        every { context.applicationContext } returns application
+        every { context.filesDir } returns application.filesDir
+        every { context.getCacheDir() } returns application.cacheDir
+
+        // Create module with real context delegation
+        module = TokenStorageModule(context)
+    }
+
+    // MARK: - Token Operations Tests
+
+    @Test
+    fun testSaveToken_shouldResolvePromise() {
+        Assume.assumeTrue("Android Keystore not available", keystoreAvailable)
+        
+        val promise = mockk<Promise>(relaxed = true)
+        val latch = CountDownLatch(1)
+        
+        every { promise.resolve(any()) } answers {
+            latch.countDown()
+        }
+
+        module.saveToken("test-id", "test-token", promise)
+
+        // Wait for async operation to complete
+        latch.await(OPERATION_TIMEOUT_MS, TimeUnit.MILLISECONDS)
+        verify { promise.resolve(null) }
+    }
+
+    @Test
+    fun testSaveAndGetToken_shouldReturnSavedToken() {
+        Assume.assumeTrue("Android Keystore not available", keystoreAvailable)
+        
+        val savePromise = mockk<Promise>(relaxed = true)
+        val getPromise = mockk<Promise>(relaxed = true)
+        val saveLatch = CountDownLatch(1)
+        val getLatch = CountDownLatch(1)
+
+        every { savePromise.resolve(any()) } answers {
+            saveLatch.countDown()
+        }
+        every { getPromise.resolve(any()) } answers {
+            getLatch.countDown()
+        }
+
+        // Save token
+        module.saveToken("test-id", "test-token", savePromise)
+        saveLatch.await(OPERATION_TIMEOUT_MS, TimeUnit.MILLISECONDS)
+        verify { savePromise.resolve(null) }
+
+        // Get token
+        module.getToken("test-id", getPromise)
+        getLatch.await(OPERATION_TIMEOUT_MS, TimeUnit.MILLISECONDS)
+        verify { getPromise.resolve("test-token") }
+    }
+
+    @Test
+    fun testGetToken_nonExistent_shouldResolveNull() {
+        val promise = mockk<Promise>(relaxed = true)
+        val latch = CountDownLatch(1)
+
+        every { promise.resolve(any()) } answers {
+            latch.countDown()
+        }
+
+        module.getToken("non-existent", promise)
+
+        latch.await(OPERATION_TIMEOUT_MS, TimeUnit.MILLISECONDS)
+        verify { promise.resolve(null) }
+    }
+
+    @Test
+    fun testRemoveToken_shouldRemoveTokenAndMetadata() {
+        val savePromise = mockk<Promise>(relaxed = true)
+        val saveMetaPromise = mockk<Promise>(relaxed = true)
+        val removePromise = mockk<Promise>(relaxed = true)
+        val getPromise = mockk<Promise>(relaxed = true)
+        val saveLatch = CountDownLatch(2)
+        val removeLatch = CountDownLatch(1)
+        val getLatch = CountDownLatch(1)
+
+        every { savePromise.resolve(any()) } answers { saveLatch.countDown() }
+        every { saveMetaPromise.resolve(any()) } answers { saveLatch.countDown() }
+        every { removePromise.resolve(any()) } answers { removeLatch.countDown() }
+        every { getPromise.resolve(any()) } answers { getLatch.countDown() }
+
+        // Save token and metadata
+        module.saveToken("test-id", "test-token", savePromise)
+        module.saveMetadata("test-id", "test-metadata", saveMetaPromise)
+        saveLatch.await(OPERATION_TIMEOUT_MS, TimeUnit.MILLISECONDS)
+
+        // Remove token
+        module.removeToken("test-id", removePromise)
+        removeLatch.await(OPERATION_TIMEOUT_MS, TimeUnit.MILLISECONDS)
+        verify { removePromise.resolve(null) }
+
+        // Verify token is removed
+        module.getToken("test-id", getPromise)
+        getLatch.await(OPERATION_TIMEOUT_MS, TimeUnit.MILLISECONDS)
+        verify { getPromise.resolve(null) }
+    }
+
+    @Test
+    fun testGetAllTokenIds_emptyStorage_shouldReturnEmptyArray() {
+        val promise = mockk<Promise>(relaxed = true)
+        val latch = CountDownLatch(1)
+
+        every { promise.resolve(any()) } answers {
+            latch.countDown()
+        }
+
+        module.getAllTokenIds(promise)
+
+        latch.await(OPERATION_TIMEOUT_MS, TimeUnit.MILLISECONDS)
+        verify { promise.resolve(any()) }
+    }
+
+    @Test
+    fun testGetAllTokenIds_withTokens_shouldReturnIds() {
+        val savePromise1 = mockk<Promise>(relaxed = true)
+        val savePromise2 = mockk<Promise>(relaxed = true)
+        val getPromise = mockk<Promise>(relaxed = true)
+        val saveLatch = CountDownLatch(2)
+        val getLatch = CountDownLatch(1)
+
+        every { savePromise1.resolve(any()) } answers { saveLatch.countDown() }
+        every { savePromise2.resolve(any()) } answers { saveLatch.countDown() }
+        every { getPromise.resolve(any()) } answers { getLatch.countDown() }
+
+        // Save multiple tokens
+        module.saveToken("token-1", "data-1", savePromise1)
+        module.saveToken("token-2", "data-2", savePromise2)
+        saveLatch.await(OPERATION_TIMEOUT_MS, TimeUnit.MILLISECONDS)
+
+        // Get all IDs
+        module.getAllTokenIds(getPromise)
+        getLatch.await(OPERATION_TIMEOUT_MS, TimeUnit.MILLISECONDS)
+
+        verify { getPromise.resolve(any()) }
+    }
+
+    @Test
+    fun testClearTokens_shouldRemoveAllTokens() {
+        val savePromise1 = mockk<Promise>(relaxed = true)
+        val savePromise2 = mockk<Promise>(relaxed = true)
+        val clearPromise = mockk<Promise>(relaxed = true)
+        val getPromise = mockk<Promise>(relaxed = true)
+        val saveLatch = CountDownLatch(2)
+        val clearLatch = CountDownLatch(1)
+        val getLatch = CountDownLatch(1)
+
+        every { savePromise1.resolve(any()) } answers { saveLatch.countDown() }
+        every { savePromise2.resolve(any()) } answers { saveLatch.countDown() }
+        every { clearPromise.resolve(any()) } answers { clearLatch.countDown() }
+        every { getPromise.resolve(any()) } answers { getLatch.countDown() }
+
+        // Save tokens
+        module.saveToken("token-1", "data-1", savePromise1)
+        module.saveToken("token-2", "data-2", savePromise2)
+        saveLatch.await(OPERATION_TIMEOUT_MS, TimeUnit.MILLISECONDS)
+
+        // Clear all
+        module.clearTokens(clearPromise)
+        clearLatch.await(OPERATION_TIMEOUT_MS, TimeUnit.MILLISECONDS)
+        verify { clearPromise.resolve(null) }
+
+        // Verify tokens are cleared
+        module.getToken("token-1", getPromise)
+        getLatch.await(OPERATION_TIMEOUT_MS, TimeUnit.MILLISECONDS)
+        verify { getPromise.resolve(null) }
+    }
+
+    // MARK: - Metadata Operations Tests
+
+    @Test
+    fun testSaveMetadata_shouldResolvePromise() {
+        val promise = mockk<Promise>(relaxed = true)
+        val latch = CountDownLatch(1)
+
+        every { promise.resolve(any()) } answers {
+            latch.countDown()
+        }
+
+        module.saveMetadata("test-id", "test-metadata", promise)
+
+        latch.await(OPERATION_TIMEOUT_MS, TimeUnit.MILLISECONDS)
+        verify { promise.resolve(null) }
+    }
+
+    @Test
+    fun testSaveAndGetMetadata_shouldReturnSavedMetadata() {
+        val savePromise = mockk<Promise>(relaxed = true)
+        val getPromise = mockk<Promise>(relaxed = true)
+        val saveLatch = CountDownLatch(1)
+        val getLatch = CountDownLatch(1)
+
+        every { savePromise.resolve(any()) } answers {
+            saveLatch.countDown()
+        }
+        every { getPromise.resolve(any()) } answers {
+            getLatch.countDown()
+        }
+
+        // Save metadata
+        module.saveMetadata("test-id", "test-metadata", savePromise)
+        saveLatch.await(OPERATION_TIMEOUT_MS, TimeUnit.MILLISECONDS)
+        verify { savePromise.resolve(null) }
+
+        // Get metadata
+        module.getMetadata("test-id", getPromise)
+        getLatch.await(OPERATION_TIMEOUT_MS, TimeUnit.MILLISECONDS)
+        verify { getPromise.resolve("test-metadata") }
+    }
+
+    @Test
+    fun testGetMetadata_nonExistent_shouldResolveNull() {
+        val promise = mockk<Promise>(relaxed = true)
+        val latch = CountDownLatch(1)
+
+        every { promise.resolve(any()) } answers {
+            latch.countDown()
+        }
+
+        module.getMetadata("non-existent", promise)
+
+        latch.await(OPERATION_TIMEOUT_MS, TimeUnit.MILLISECONDS)
+        verify { promise.resolve(null) }
+    }
+
+    @Test
+    fun testRemoveMetadata_shouldRemoveMetadata() {
+        val savePromise = mockk<Promise>(relaxed = true)
+        val removePromise = mockk<Promise>(relaxed = true)
+        val getPromise = mockk<Promise>(relaxed = true)
+        val saveLatch = CountDownLatch(1)
+        val removeLatch = CountDownLatch(1)
+        val getLatch = CountDownLatch(1)
+
+        every { savePromise.resolve(any()) } answers { saveLatch.countDown() }
+        every { removePromise.resolve(any()) } answers { removeLatch.countDown() }
+        every { getPromise.resolve(any()) } answers { getLatch.countDown() }
+
+        // Save metadata
+        module.saveMetadata("test-id", "test-metadata", savePromise)
+        saveLatch.await(OPERATION_TIMEOUT_MS, TimeUnit.MILLISECONDS)
+
+        // Remove metadata
+        module.removeMetadata("test-id", removePromise)
+        removeLatch.await(OPERATION_TIMEOUT_MS, TimeUnit.MILLISECONDS)
+        verify { removePromise.resolve(null) }
+
+        // Verify metadata is removed
+        module.getMetadata("test-id", getPromise)
+        getLatch.await(OPERATION_TIMEOUT_MS, TimeUnit.MILLISECONDS)
+        verify { getPromise.resolve(null) }
+    }
+
+    // MARK: - Default Token ID Tests
+
+    @Test
+    fun testSetDefaultTokenId_shouldResolvePromise() {
+        val promise = mockk<Promise>(relaxed = true)
+        val latch = CountDownLatch(1)
+
+        every { promise.resolve(any()) } answers {
+            latch.countDown()
+        }
+
+        module.setDefaultTokenId("default-id", promise)
+
+        latch.await(OPERATION_TIMEOUT_MS, TimeUnit.MILLISECONDS)
+        verify { promise.resolve(null) }
+    }
+
+    @Test
+    fun testSetAndGetDefaultTokenId_shouldReturnSavedId() {
+        val setPromise = mockk<Promise>(relaxed = true)
+        val getPromise = mockk<Promise>(relaxed = true)
+        val setLatch = CountDownLatch(1)
+        val getLatch = CountDownLatch(1)
+
+        every { setPromise.resolve(any()) } answers {
+            setLatch.countDown()
+        }
+        every { getPromise.resolve(any()) } answers {
+            getLatch.countDown()
+        }
+
+        // Set default
+        module.setDefaultTokenId("default-id", setPromise)
+        setLatch.await(OPERATION_TIMEOUT_MS, TimeUnit.MILLISECONDS)
+        verify { setPromise.resolve(null) }
+
+        // Get default
+        module.getDefaultTokenId(getPromise)
+        getLatch.await(OPERATION_TIMEOUT_MS, TimeUnit.MILLISECONDS)
+        verify { getPromise.resolve("default-id") }
+    }
+
+    @Test
+    fun testSetDefaultTokenId_null_shouldClearDefault() {
+        val setPromise = mockk<Promise>(relaxed = true)
+        val setNullPromise = mockk<Promise>(relaxed = true)
+        val getPromise = mockk<Promise>(relaxed = true)
+        val setLatch = CountDownLatch(1)
+        val setNullLatch = CountDownLatch(1)
+        val getLatch = CountDownLatch(1)
+
+        every { setPromise.resolve(any()) } answers { setLatch.countDown() }
+        every { setNullPromise.resolve(any()) } answers { setNullLatch.countDown() }
+        every { getPromise.resolve(any()) } answers { getLatch.countDown() }
+
+        // Set default
+        module.setDefaultTokenId("default-id", setPromise)
+        setLatch.await(OPERATION_TIMEOUT_MS, TimeUnit.MILLISECONDS)
+
+        // Clear default
+        module.setDefaultTokenId(null, setNullPromise)
+        setNullLatch.await(OPERATION_TIMEOUT_MS, TimeUnit.MILLISECONDS)
+        verify { setNullPromise.resolve(null) }
+
+        // Get default
+        module.getDefaultTokenId(getPromise)
+        getLatch.await(OPERATION_TIMEOUT_MS, TimeUnit.MILLISECONDS)
+        verify { getPromise.resolve(null) }
+    }
+
+    @Test
+    fun testGetDefaultTokenId_notSet_shouldResolveNull() {
+        val promise = mockk<Promise>(relaxed = true)
+        val latch = CountDownLatch(1)
+
+        every { promise.resolve(any()) } answers {
+            latch.countDown()
+        }
+
+        module.getDefaultTokenId(promise)
+
+        latch.await(OPERATION_TIMEOUT_MS, TimeUnit.MILLISECONDS)
+        verify { promise.resolve(null) }
+    }
+}
diff --git a/packages/react-native-platform/ios/.gitignore b/packages/react-native-platform/ios/.gitignore
new file mode 100644
index 0000000..c09e535
--- /dev/null
+++ b/packages/react-native-platform/ios/.gitignore
@@ -0,0 +1,5 @@
+.build/
+.swiftpm/
+*.xcodeproj/
+*.xcworkspace/
+.DS_Store
diff --git a/packages/react-native-platform/ios/Package.swift b/packages/react-native-platform/ios/Package.swift
new file mode 100644
index 0000000..0865371
--- /dev/null
+++ b/packages/react-native-platform/ios/Package.swift
@@ -0,0 +1,32 @@
+// swift-tools-version:5.9
+import PackageDescription
+
+let package = Package(
+    name: "RNPlatformBridges",
+    platforms: [
+        .iOS(.v13)
+    ],
+    products: [
+        .library(
+            name: "RNTokenStorageBridge",
+            targets: ["RNTokenStorageBridge"]
+        )
+    ],
+    dependencies: [],
+    targets: [
+        .target(
+            name: "RNTokenStorageBridge",
+            path: "Sources/RNTokenStorageBridge",
+            exclude: ["TokenStorageBridge.m", "TokenStorageBridge.h"],
+            publicHeadersPath: "."
+        ),
+        .testTarget(
+            name: "RNTokenStorageBridgeTests",
+            dependencies: ["RNTokenStorageBridge"],
+            path: "Tests/RNTokenStorageBridgeTests"
+        )
+    ]
+)
+
+
+
diff --git a/packages/react-native-platform/ios/Sources/RNBrowserSessionBridge/BrowserSessionBridge.h b/packages/react-native-platform/ios/Sources/RNBrowserSessionBridge/BrowserSessionBridge.h
new file mode 100644
index 0000000..51e55c8
--- /dev/null
+++ b/packages/react-native-platform/ios/Sources/RNBrowserSessionBridge/BrowserSessionBridge.h
@@ -0,0 +1,13 @@
+#import <React/RCTBridgeModule.h>
+#import <React/RCTEventEmitter.h>
+
+@interface RCT_EXTERN_MODULE(BrowserSessionBridge, NSObject)
+
+RCT_EXTERN_METHOD(launchBrowserSession:(NSString *)url
+                  resolve:(RCTPromiseResolveBlock)resolve
+                  reject:(RCTPromiseRejectBlock)reject)
+
+RCT_EXTERN_METHOD(closeBrowserSession:(RCTPromiseResolveBlock)resolve
+                  reject:(RCTPromiseRejectBlock)reject)
+
+@end
diff --git a/packages/react-native-platform/ios/Sources/RNBrowserSessionBridge/BrowserSessionBridge.m b/packages/react-native-platform/ios/Sources/RNBrowserSessionBridge/BrowserSessionBridge.m
new file mode 100644
index 0000000..405f158
--- /dev/null
+++ b/packages/react-native-platform/ios/Sources/RNBrowserSessionBridge/BrowserSessionBridge.m
@@ -0,0 +1,5 @@
+#import "BrowserSessionBridge.h"
+
+@implementation BrowserSessionBridge
+
+@end
diff --git a/packages/react-native-platform/ios/Sources/RNBrowserSessionBridge/BrowserSessionBridge.swift b/packages/react-native-platform/ios/Sources/RNBrowserSessionBridge/BrowserSessionBridge.swift
new file mode 100644
index 0000000..e2726bc
--- /dev/null
+++ b/packages/react-native-platform/ios/Sources/RNBrowserSessionBridge/BrowserSessionBridge.swift
@@ -0,0 +1,95 @@
+import Foundation
+
+#if os(iOS)
+import WebKit
+import UIKit
+#endif
+
+// Type aliases for Promise-like callbacks (compatible with React Native)
+typealias PromiseResolveBlock = (Any?) -> Void
+typealias PromiseRejectBlock = (String, String, Error?) -> Void
+
+#if os(iOS)
+@objc(BrowserSessionBridge)
+class BrowserSessionBridge: NSObject {
+
+    override init() {
+        super.init()
+        print("✅ BrowserSessionBridge initialized!")
+    }
+
+    @objc
+    static func requiresMainQueueSetup() -> Bool {
+        return true  // WebView operations must happen on main thread
+    }
+
+    @objc
+    static func moduleName() -> String! {
+        return "BrowserSessionBridge"
+    }
+
+    @objc
+    func constantsToExport() -> [String: Any]! {
+        return [
+            "isAvailable": true
+        ]
+    }
+
+    // MARK: - Browser Session Operations
+
+    @objc(launchBrowserSession:resolve:reject:)
+    func launchBrowserSession(_ url: String, resolve: @escaping PromiseResolveBlock, reject: @escaping PromiseRejectBlock) {
+        do {
+            guard let urlObj = URL(string: url) else {
+                reject("invalid_url", "Invalid URL provided", nil)
+                return
+            }
+
+            DispatchQueue.main.async {
+                let webViewController = UIViewController()
+                let webView = WKWebView(frame: webViewController.view.bounds)
+                webView.load(URLRequest(url: urlObj))
+
+                webViewController.view.addSubview(webView)
+
+                // Get the key window and present the view controller
+                if let keyWindow = UIApplication.shared.connectedScenes
+                    .compactMap({ $0 as? UIWindowScene })
+                    .first?.windows
+                    .first(where: { $0.isKeyWindow }) {
+                    keyWindow.rootViewController?.present(webViewController, animated: true) {
+                        resolve(nil)
+                    }
+                } else {
+                    reject("no_window", "Could not find key window", nil)
+                }
+            }
+        }
+    }
+
+    @objc(closeBrowserSession:reject:)
+    func closeBrowserSession(_ resolve: @escaping PromiseResolveBlock, reject: @escaping PromiseRejectBlock) {
+        DispatchQueue.main.async {
+            if let presentedViewController = UIApplication.shared.connectedScenes
+                .compactMap({ $0 as? UIWindowScene })
+                .first?.windows
+                .first(where: { $0.isKeyWindow })?.rootViewController?.presentedViewController {
+                presentedViewController.dismiss(animated: true) {
+                    resolve(nil)
+                }
+            } else {
+                resolve(nil)  // Already closed
+            }
+        }
+    }
+}
+#else
+// Stub for non-iOS platforms (for SPM testing on macOS)
+@objc(BrowserSessionBridge)
+class BrowserSessionBridge: NSObject {
+    @objc static func requiresMainQueueSetup() -> Bool { return false }
+    @objc static func moduleName() -> String! { return "BrowserSessionBridge" }
+    @objc func constantsToExport() -> [String: Any]! { return ["isAvailable": false] }
+}
+#endif
+
diff --git a/packages/react-native-platform/ios/Sources/RNTokenStorageBridge/TokenStorageBridge.h b/packages/react-native-platform/ios/Sources/RNTokenStorageBridge/TokenStorageBridge.h
new file mode 100644
index 0000000..fc6d364
--- /dev/null
+++ b/packages/react-native-platform/ios/Sources/RNTokenStorageBridge/TokenStorageBridge.h
@@ -0,0 +1,11 @@
+#import <React/RCTBridgeModule.h>
+
+#ifdef RCT_NEW_ARCH_ENABLED
+#import "RNTokenStorageBridge.h"
+
+@interface TokenStorageBridge : NSObject <RCTBridgeModule, NativeTokenStorageBridgeSpec>
+#else
+@interface TokenStorageBridge : NSObject <RCTBridgeModule>
+#endif
+
+@end
diff --git a/packages/react-native-platform/ios/Sources/RNTokenStorageBridge/TokenStorageBridge.m b/packages/react-native-platform/ios/Sources/RNTokenStorageBridge/TokenStorageBridge.m
new file mode 100644
index 0000000..617ea29
--- /dev/null
+++ b/packages/react-native-platform/ios/Sources/RNTokenStorageBridge/TokenStorageBridge.m
@@ -0,0 +1,44 @@
+#import <React/RCTBridgeModule.h>
+
+@interface RCT_EXTERN_MODULE(TokenStorageBridge, NSObject)
+
+RCT_EXTERN_METHOD(saveToken:(NSString *)id
+                  tokenData:(NSString *)tokenData
+                  resolve:(RCTPromiseResolveBlock)resolve
+                  reject:(RCTPromiseRejectBlock)reject)
+
+RCT_EXTERN_METHOD(getToken:(NSString *)id
+                  resolve:(RCTPromiseResolveBlock)resolve
+                  reject:(RCTPromiseRejectBlock)reject)
+
+RCT_EXTERN_METHOD(removeToken:(NSString *)id
+                  resolve:(RCTPromiseResolveBlock)resolve
+                  reject:(RCTPromiseRejectBlock)reject)
+
+RCT_EXTERN_METHOD(getAllTokenIds:(RCTPromiseResolveBlock)resolve
+                  reject:(RCTPromiseRejectBlock)reject)
+
+RCT_EXTERN_METHOD(clearTokens:(RCTPromiseResolveBlock)resolve
+                  reject:(RCTPromiseRejectBlock)reject)
+
+RCT_EXTERN_METHOD(saveMetadata:(NSString *)id
+                  metadataData:(NSString *)metadataData
+                  resolve:(RCTPromiseResolveBlock)resolve
+                  reject:(RCTPromiseRejectBlock)reject)
+
+RCT_EXTERN_METHOD(getMetadata:(NSString *)id
+                  resolve:(RCTPromiseResolveBlock)resolve
+                  reject:(RCTPromiseRejectBlock)reject)
+
+RCT_EXTERN_METHOD(removeMetadata:(NSString *)id
+                  resolve:(RCTPromiseResolveBlock)resolve
+                  reject:(RCTPromiseRejectBlock)reject)
+
+RCT_EXTERN_METHOD(setDefaultTokenId:(nullable NSString *)id
+                  resolve:(RCTPromiseResolveBlock)resolve
+                  reject:(RCTPromiseRejectBlock)reject)
+
+RCT_EXTERN_METHOD(getDefaultTokenId:(RCTPromiseResolveBlock)resolve
+                  reject:(RCTPromiseRejectBlock)reject)
+
+@end
\ No newline at end of file
diff --git a/packages/react-native-platform/ios/Sources/RNTokenStorageBridge/TokenStorageBridge.swift b/packages/react-native-platform/ios/Sources/RNTokenStorageBridge/TokenStorageBridge.swift
new file mode 100644
index 0000000..46107f4
--- /dev/null
+++ b/packages/react-native-platform/ios/Sources/RNTokenStorageBridge/TokenStorageBridge.swift
@@ -0,0 +1,302 @@
+import Foundation
+import Security
+
+// Type aliases for Promise-like callbacks (compatible with React Native)
+typealias PromiseResolveBlock = (Any?) -> Void
+typealias PromiseRejectBlock = (String, String, Error?) -> Void
+
+@objc(TokenStorageBridge)
+class TokenStorageBridge: NSObject {
+
+    override init() {
+            super.init()
+            print("✅ TokenStorageBridge initialized!")
+            // Debug: Print all methods
+            let methodCount = UnsafeMutablePointer<UInt32>.allocate(capacity: 1)
+            let methods = class_copyMethodList(type(of: self), methodCount)
+            print("📋 TokenStorageBridge methods:")
+            for i in 0..<Int(methodCount.pointee) {
+                if let method = methods?[i] {
+                    print("  - \(NSStringFromSelector(method_getName(method)))")
+                }
+            }
+            free(methods)
+        }
+
+    private static let SERVICE_TOKENS = "com.okta.auth-foundation.tokens"
+    private static let SERVICE_METADATA = "com.okta.auth-foundation.metadata"
+    private static let SERVICE_DEFAULT = "com.okta.auth-foundation.default"
+
+    @objc
+    static func requiresMainQueueSetup() -> Bool {
+        return false
+    }
+
+    @objc
+    static func moduleName() -> String! {
+        return "TokenStorageBridge"
+    }
+
+    @objc
+    func constantsToExport() -> [String: Any]! {
+        return [
+            "isAvailable": true
+        ]
+    }
+
+    // MARK: - Token Operations (Secure Storage - Keychain with strict access)
+
+    @objc(saveToken:tokenData:resolve:reject:)
+    func saveToken(_ id: String, tokenData: String, resolve: @escaping PromiseResolveBlock, reject: @escaping PromiseRejectBlock) {
+        do {
+            // More restrictive: requires device unlock
+            try KeychainHelper.save(
+                service: Self.SERVICE_TOKENS,
+                key: id,
+                value: tokenData,
+                accessibility: kSecAttrAccessibleWhenUnlockedThisDeviceOnly
+            )
+            resolve(nil)
+        } catch {
+            reject("token_save_error", "Failed to save token", error)
+        }
+    }
+
+    @objc(getToken:resolve:reject:)
+    func getToken(_ id: String, resolve: @escaping PromiseResolveBlock, reject: @escaping PromiseRejectBlock) {
+        do {
+            let value = try KeychainHelper.load(service: Self.SERVICE_TOKENS, key: id)
+            resolve(value)
+        } catch {
+            resolve(nil)
+        }
+    }
+
+    @objc(removeToken:resolve:reject:)
+    func removeToken(_ id: String, resolve: @escaping PromiseResolveBlock, reject: @escaping PromiseRejectBlock) {
+        do {
+            try KeychainHelper.delete(service: Self.SERVICE_TOKENS, key: id)
+            try KeychainHelper.delete(service: Self.SERVICE_METADATA, key: id)
+            resolve(nil)
+        } catch {
+            reject("token_remove_error", "Failed to remove token", error)
+        }
+    }
+
+    @objc(getAllTokenIds:reject:)
+    func getAllTokenIds(_ resolve: @escaping PromiseResolveBlock, reject: @escaping PromiseRejectBlock) {
+        do {
+            let keys = try KeychainHelper.allKeys(service: Self.SERVICE_TOKENS)
+            resolve(keys)
+        } catch {
+            reject("token_list_error", "Failed to get token IDs", error)
+        }
+    }
+
+    @objc(clearTokens:reject:)
+    func clearTokens(_ resolve: @escaping PromiseResolveBlock, reject: @escaping PromiseRejectBlock) {
+        do {
+            try KeychainHelper.clearAll(service: Self.SERVICE_TOKENS)
+            try KeychainHelper.clearAll(service: Self.SERVICE_METADATA)
+            try KeychainHelper.clearAll(service: Self.SERVICE_DEFAULT)
+            resolve(nil)
+        } catch {
+            reject("token_clear_error", "Failed to clear tokens", error)
+        }
+    }
+
+    // MARK: - Metadata Operations (Keychain with relaxed access)
+
+    @objc(saveMetadata:metadataData:resolve:reject:)
+    func saveMetadata(_ id: String, metadataData: String, resolve: @escaping PromiseResolveBlock, reject: @escaping PromiseRejectBlock) {
+        do {
+            // Less restrictive: accessible after first unlock (survives reboots)
+            try KeychainHelper.save(
+                service: Self.SERVICE_METADATA,
+                key: id,
+                value: metadataData,
+                accessibility: kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly
+            )
+            resolve(nil)
+        } catch {
+            reject("metadata_save_error", "Failed to save metadata", error)
+        }
+    }
+
+    @objc(getMetadata:resolve:reject:)
+    func getMetadata(_ id: String, resolve: @escaping PromiseResolveBlock, reject: @escaping PromiseRejectBlock) {
+        do {
+            let value = try KeychainHelper.load(service: Self.SERVICE_METADATA, key: id)
+            resolve(value)
+        } catch {
+            resolve(nil)
+        }
+    }
+
+    @objc(removeMetadata:resolve:reject:)
+    func removeMetadata(_ id: String, resolve: @escaping PromiseResolveBlock, reject: @escaping PromiseRejectBlock) {
+        do {
+            try KeychainHelper.delete(service: Self.SERVICE_METADATA, key: id)
+            resolve(nil)
+        } catch {
+            reject("metadata_remove_error", "Failed to remove metadata", error)
+        }
+    }
+
+    // MARK: - Default Token ID (Keychain with relaxed access)
+
+    @objc(setDefaultTokenId:resolve:reject:)
+    func setDefaultTokenId(_ id: String?, resolve: @escaping PromiseResolveBlock, reject: @escaping PromiseRejectBlock) {
+        do {
+            if let id = id {
+                try KeychainHelper.save(
+                    service: Self.SERVICE_DEFAULT,
+                    key: "default",
+                    value: id,
+                    accessibility: kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly
+                )
+            } else {
+                try KeychainHelper.delete(service: Self.SERVICE_DEFAULT, key: "default")
+            }
+            resolve(nil)
+        } catch {
+            reject("default_token_error", "Failed to set default token ID", error)
+        }
+    }
+
+    @objc(getDefaultTokenId:reject:)
+    func getDefaultTokenId(_ resolve: @escaping PromiseResolveBlock, reject: @escaping PromiseRejectBlock) {
+        do {
+            let value = try KeychainHelper.load(service: Self.SERVICE_DEFAULT, key: "default")
+            resolve(value)
+        } catch {
+            resolve(nil)
+        }
+    }
+}
+
+// MARK: - Keychain Helper
+
+class KeychainHelper {
+    
+    static func save(
+        service: String,
+        key: String,
+        value: String,
+        accessibility: CFString
+    ) throws {
+        let data = value.data(using: .utf8)!
+
+        // Query for adding new item
+        let addQuery: [String: Any] = [
+            kSecClass as String: kSecClassGenericPassword,
+            kSecAttrService as String: service,
+            kSecAttrAccount as String: key,
+            kSecValueData as String: data,
+            kSecAttrAccessible as String: accessibility
+        ]
+
+        // First try to delete any existing item (use minimal query)
+        let deleteQuery: [String: Any] = [
+            kSecClass as String: kSecClassGenericPassword,
+            kSecAttrService as String: service,
+            kSecAttrAccount as String: key
+        ]
+        SecItemDelete(deleteQuery as CFDictionary)
+
+        // Now add the new item
+        let status = SecItemAdd(addQuery as CFDictionary, nil)
+        guard status == errSecSuccess else {
+            throw NSError(domain: NSOSStatusErrorDomain, code: Int(status))
+        }
+    }
+    
+    static func load(service: String, key: String) throws -> String? {
+        let query: [String: Any] = [
+            kSecClass as String: kSecClassGenericPassword,
+            kSecAttrService as String: service,
+            kSecAttrAccount as String: key,
+            kSecReturnData as String: true
+        ]
+        
+        var result: AnyObject?
+        let status = SecItemCopyMatching(query as CFDictionary, &result)
+        
+        guard status == errSecSuccess else {
+            if status == errSecItemNotFound {
+                return nil
+            }
+            throw NSError(domain: NSOSStatusErrorDomain, code: Int(status))
+        }
+        
+        guard let data = result as? Data,
+              let value = String(data: data, encoding: .utf8) else {
+            return nil
+        }
+        
+        return value
+    }
+    
+    static func delete(service: String, key: String) throws {
+        let query: [String: Any] = [
+            kSecClass as String: kSecClassGenericPassword,
+            kSecAttrService as String: service,
+            kSecAttrAccount as String: key
+        ]
+
+        // Loop to delete all items matching the query (defensive against duplicates)
+        while true {
+            let status = SecItemDelete(query as CFDictionary)
+            if status == errSecItemNotFound {
+                break
+            } else if status != errSecSuccess {
+                throw NSError(domain: NSOSStatusErrorDomain, code: Int(status))
+            }
+            // If successful, loop again to ensure all items are deleted
+        }
+    }
+    
+    static func allKeys(service: String) throws -> [String] {
+        let query: [String: Any] = [
+            kSecClass as String: kSecClassGenericPassword,
+            kSecAttrService as String: service,
+            kSecReturnAttributes as String: true,
+            kSecMatchLimit as String: kSecMatchLimitAll
+        ]
+        
+        var result: AnyObject?
+        let status = SecItemCopyMatching(query as CFDictionary, &result)
+        
+        guard status == errSecSuccess else {
+            if status == errSecItemNotFound {
+                return []
+            }
+            throw NSError(domain: NSOSStatusErrorDomain, code: Int(status))
+        }
+        
+        guard let items = result as? [[String: Any]] else {
+            return []
+        }
+        
+        return items.compactMap { $0[kSecAttrAccount as String] as? String }
+    }
+    
+    static func clearAll(service: String) throws {
+        let query: [String: Any] = [
+            kSecClass as String: kSecClassGenericPassword,
+            kSecAttrService as String: service
+        ]
+
+        // SecItemDelete only deletes one item per call, so loop until empty
+        while true {
+            let status = SecItemDelete(query as CFDictionary)
+            if status == errSecItemNotFound {
+                // No more items to delete
+                break
+            } else if status != errSecSuccess {
+                throw NSError(domain: NSOSStatusErrorDomain, code: Int(status))
+            }
+            // If successful, loop again to delete next item
+        }
+    }
+}
diff --git a/packages/react-native-platform/ios/Tests/RNBrowserSessionBridgeTests/BrowserSessionBridgeTests.swift b/packages/react-native-platform/ios/Tests/RNBrowserSessionBridgeTests/BrowserSessionBridgeTests.swift
new file mode 100644
index 0000000..34af341
--- /dev/null
+++ b/packages/react-native-platform/ios/Tests/RNBrowserSessionBridgeTests/BrowserSessionBridgeTests.swift
@@ -0,0 +1,110 @@
+import XCTest
+@testable import RNBrowserSessionBridge
+
+class BrowserSessionBridgeTests: XCTestCase {
+
+    var sut: BrowserSessionBridge!
+
+    override func setUp() {
+        super.setUp()
+        sut = BrowserSessionBridge()
+    }
+
+    override func tearDown() {
+        super.tearDown()
+        sut = nil
+    }
+
+    // MARK: - Initialization Tests
+
+    func testInit_shouldSucceed() {
+        XCTAssertNotNil(sut)
+    }
+
+    func testRequiresMainQueueSetup_shouldReturnValue() {
+        XCTAssertFalse(BrowserSessionBridge.requiresMainQueueSetup())
+    }
+
+    func testModuleName_shouldReturnBrowserSessionBridge() {
+        XCTAssertEqual(BrowserSessionBridge.moduleName(), "BrowserSessionBridge")
+    }
+
+    func testConstantsToExport_shouldBeNotNil() {
+        let constants = sut.constantsToExport()
+        XCTAssertNotNil(constants)
+    }
+
+    #if os(iOS)
+    // MARK: - Launch Browser Session Tests (iOS only)
+
+    func testLaunchBrowserSession_withValidUrl_shouldResolve() {
+        let expectation = XCTestExpectation(description: "Launch browser session")
+
+        sut.launchBrowserSession("https://example.com") { result in
+            XCTAssertNil(result)
+            expectation.fulfill()
+        } reject: { code, message, error in
+            XCTFail("Should not reject: \(message ?? "unknown error")")
+            expectation.fulfill()
+        }
+
+        wait(for: [expectation], timeout: 2.0)
+    }
+
+    func testLaunchBrowserSession_withInvalidUrl_shouldReject() {
+        let expectation = XCTestExpectation(description: "Launch with invalid URL")
+
+        sut.launchBrowserSession("not a url") { result in
+            XCTFail("Should not resolve")
+            expectation.fulfill()
+        } reject: { code, message, error in
+            XCTAssertEqual(code, "invalid_url")
+            expectation.fulfill()
+        }
+
+        wait(for: [expectation], timeout: 2.0)
+    }
+
+    // MARK: - Close Browser Session Tests (iOS only)
+
+    func testCloseBrowserSession_shouldResolve() {
+        let expectation = XCTestExpectation(description: "Close browser session")
+
+        sut.closeBrowserSession { result in
+            XCTAssertNil(result)
+            expectation.fulfill()
+        } reject: { code, message, error in
+            XCTFail("Should resolve")
+            expectation.fulfill()
+        }
+
+        wait(for: [expectation], timeout: 2.0)
+    }
+
+    // MARK: - Integration Tests (iOS only)
+
+    func testLaunchAndCloseBrowserSession() {
+        let launchExpectation = XCTestExpectation(description: "Launch")
+        let closeExpectation = XCTestExpectation(description: "Close")
+
+        sut.launchBrowserSession("https://example.com") { _ in
+            launchExpectation.fulfill()
+        } reject: { _, _, _ in
+            XCTFail("Launch should not reject")
+            launchExpectation.fulfill()
+        }
+
+        wait(for: [launchExpectation], timeout: 2.0)
+
+        sut.closeBrowserSession { _ in
+            closeExpectation.fulfill()
+        } reject: { _, _, _ in
+            XCTFail("Close should not reject")
+            closeExpectation.fulfill()
+        }
+
+        wait(for: [closeExpectation], timeout: 2.0)
+    }
+    #endif
+}
+
diff --git a/packages/react-native-platform/ios/Tests/RNTokenStorageBridgeTests/KeychainHelperTests.swift b/packages/react-native-platform/ios/Tests/RNTokenStorageBridgeTests/KeychainHelperTests.swift
new file mode 100644
index 0000000..c75c62b
--- /dev/null
+++ b/packages/react-native-platform/ios/Tests/RNTokenStorageBridgeTests/KeychainHelperTests.swift
@@ -0,0 +1,327 @@
+import XCTest
+import Security
+@testable import RNTokenStorageBridge
+
+class KeychainHelperTests: XCTestCase {
+
+    let testService = "com.okta.test.service"
+    let testKey = "test-key"
+    let testValue = "test-value"
+
+    override func setUp() {
+        super.setUp()
+        cleanupTestKeychain()
+    }
+
+    override func tearDown() {
+        super.tearDown()
+        cleanupTestKeychain()
+    }
+
+    // MARK: - Save Tests
+
+    func testSave_shouldStoreValueInKeychain() {
+        let accessibility = kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly
+
+        XCTAssertNoThrow({
+            try KeychainHelper.save(
+                service: self.testService,
+                key: self.testKey,
+                value: self.testValue,
+                accessibility: accessibility
+            )
+        })
+    }
+
+    func testSave_withDifferentAccessibility_shouldSucceed() {
+        let restrictions = [
+            kSecAttrAccessibleWhenUnlockedThisDeviceOnly,
+            kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly
+        ]
+
+        for accessibility in restrictions {
+            let uniqueKey = "\(testKey)-\(UUID().uuidString)"
+            XCTAssertNoThrow({
+                try KeychainHelper.save(
+                    service: self.testService,
+                    key: uniqueKey,
+                    value: self.testValue,
+                    accessibility: accessibility
+                )
+            })
+        }
+    }
+
+    // MARK: - Load Tests
+
+    func testLoad_savedValue_shouldReturnValue() {
+        let accessibility = kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly
+
+        try? KeychainHelper.save(
+            service: testService,
+            key: testKey,
+            value: testValue,
+            accessibility: accessibility
+        )
+
+        let result = try? KeychainHelper.load(service: testService, key: testKey)
+
+        XCTAssertEqual(result, testValue)
+    }
+
+    func testLoad_nonExistent_shouldReturnNil() {
+        let result = try? KeychainHelper.load(service: testService, key: "non-existent")
+
+        XCTAssertNil(result)
+    }
+
+    func testLoad_afterSaveAndDelete_shouldReturnNil() {
+        let accessibility = kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly
+
+        try? KeychainHelper.save(
+            service: testService,
+            key: testKey,
+            value: testValue,
+            accessibility: accessibility
+        )
+
+        try? KeychainHelper.delete(service: testService, key: testKey)
+
+        let result = try? KeychainHelper.load(service: testService, key: testKey)
+
+        XCTAssertNil(result)
+    }
+
+    // MARK: - Delete Tests
+
+    func testDelete_savedValue_shouldRemoveValue() {
+        let accessibility = kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly
+        let uniqueKey = "isolated-delete-test-\(UUID().uuidString)"
+        let testData = "isolated-delete-data"
+
+        // Step 1: Save
+        do {
+            try KeychainHelper.save(
+                service: self.testService,
+                key: uniqueKey,
+                value: testData,
+                accessibility: accessibility
+            )
+        } catch {
+            XCTFail("Save should not throw: \(error)")
+            return
+        }
+
+        // Step 2: Verify save worked
+        do {
+            let savedValue = try KeychainHelper.load(service: self.testService, key: uniqueKey)
+            XCTAssertEqual(savedValue, testData)
+        } catch {
+            XCTFail("Load after save should not throw: \(error)")
+            return
+        }
+
+        // Step 3: Delete
+        do {
+            try KeychainHelper.delete(service: self.testService, key: uniqueKey)
+        } catch {
+            XCTFail("Delete should not throw: \(error)")
+            return
+        }
+
+        // Step 4: Verify delete worked
+        do {
+            let deletedValue = try KeychainHelper.load(service: self.testService, key: uniqueKey)
+            XCTAssertNil(deletedValue)
+        } catch {
+            XCTFail("Load after delete should not throw: \(error)")
+            return
+        }
+    }
+
+    func testDelete_nonExistent_shouldNotThrow() {
+        XCTAssertNoThrow({
+            try KeychainHelper.delete(service: self.testService, key: "non-existent")
+        })
+    }
+
+    func testDelete_multipleItems_shouldDeleteOnlyTarget() {
+        let accessibility = kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly
+        let key1 = "key-1"
+        let key2 = "key-2"
+        let value1 = "value-1"
+        let value2 = "value-2"
+
+        try? KeychainHelper.save(service: testService, key: key1, value: value1, accessibility: accessibility)
+        try? KeychainHelper.save(service: testService, key: key2, value: value2, accessibility: accessibility)
+
+        try? KeychainHelper.delete(service: testService, key: key1)
+
+        let result1 = try? KeychainHelper.load(service: testService, key: key1)
+        let result2 = try? KeychainHelper.load(service: testService, key: key2)
+
+        XCTAssertNil(result1)
+        XCTAssertEqual(result2, value2)
+    }
+
+    // MARK: - AllKeys Tests
+
+    func testAllKeys_emptyService_shouldReturnEmptyArray() {
+        let result = try? KeychainHelper.allKeys(service: testService)
+
+        XCTAssertEqual(result, [])
+    }
+
+    func testAllKeys_withMultipleItems_shouldReturnAllKeys() {
+        let accessibility = kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly
+        let keys = ["key-1", "key-2", "key-3"]
+
+        for key in keys {
+            try? KeychainHelper.save(
+                service: testService,
+                key: key,
+                value: "value-\(key)",
+                accessibility: accessibility
+            )
+        }
+
+        let result = try? KeychainHelper.allKeys(service: testService)
+
+        XCTAssertEqual(Set(result ?? []), Set(keys))
+    }
+
+    func testAllKeys_afterDelete_shouldNotIncludeDeletedKey() {
+        let accessibility = kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly
+        let keys = ["key-1", "key-2"]
+
+        for key in keys {
+            try? KeychainHelper.save(
+                service: testService,
+                key: key,
+                value: "value",
+                accessibility: accessibility
+            )
+        }
+
+        try? KeychainHelper.delete(service: testService, key: "key-1")
+
+        let result = try? KeychainHelper.allKeys(service: testService)
+
+        XCTAssertEqual(result, ["key-2"])
+    }
+
+    // MARK: - ClearAll Tests
+
+    func testClearAll_emptyService_shouldNotThrow() {
+        XCTAssertNoThrow({
+            try KeychainHelper.clearAll(service: self.testService)
+        })
+    }
+
+    func testClearAll_withItems_shouldRemoveAllItems() {
+        let accessibility = kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly
+        let keys = ["key-1", "key-2", "key-3"]
+
+        for key in keys {
+            try? KeychainHelper.save(
+                service: testService,
+                key: key,
+                value: "value",
+                accessibility: accessibility
+            )
+        }
+
+        try? KeychainHelper.clearAll(service: testService)
+
+        let result = try? KeychainHelper.allKeys(service: testService)
+
+        XCTAssertEqual(result, [])
+    }
+
+    // MARK: - Data Integrity Tests
+
+    func testSaveAndLoad_preservesData() {
+        let accessibility = kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly
+        let testData = "Complex data with special characters: !@#$%^&*()"
+
+        try? KeychainHelper.save(
+            service: testService,
+            key: testKey,
+            value: testData,
+            accessibility: accessibility
+        )
+
+        let result = try? KeychainHelper.load(service: testService, key: testKey)
+
+        XCTAssertEqual(result, testData)
+    }
+
+    func testSaveAndLoad_largeData() {
+        let accessibility = kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly
+        let largeData = String(repeating: "x", count: 10000)
+
+        try? KeychainHelper.save(
+            service: testService,
+            key: testKey,
+            value: largeData,
+            accessibility: accessibility
+        )
+
+        let result = try? KeychainHelper.load(service: testService, key: testKey)
+
+        XCTAssertEqual(result, largeData)
+    }
+
+    func testSaveAndLoad_emptyString() {
+        let accessibility = kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly
+
+        try? KeychainHelper.save(
+            service: testService,
+            key: testKey,
+            value: "",
+            accessibility: accessibility
+        )
+
+        let result = try? KeychainHelper.load(service: testService, key: testKey)
+
+        XCTAssertEqual(result, "")
+    }
+
+    // MARK: - Service Isolation Tests
+
+    func testDifferentServices_shouldBeIsolated() {
+        let service1 = "com.okta.service1"
+        let service2 = "com.okta.service2"
+        let accessibility = kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly
+
+        try? KeychainHelper.save(
+            service: service1,
+            key: testKey,
+            value: "value1",
+            accessibility: accessibility
+        )
+
+        try? KeychainHelper.save(
+            service: service2,
+            key: testKey,
+            value: "value2",
+            accessibility: accessibility
+        )
+
+        let result1 = try? KeychainHelper.load(service: service1, key: testKey)
+        let result2 = try? KeychainHelper.load(service: service2, key: testKey)
+
+        XCTAssertEqual(result1, "value1")
+        XCTAssertEqual(result2, "value2")
+
+        // Cleanup
+        try? KeychainHelper.clearAll(service: service1)
+        try? KeychainHelper.clearAll(service: service2)
+    }
+
+    // MARK: - Helper Methods
+
+    private func cleanupTestKeychain() {
+        try? KeychainHelper.clearAll(service: testService)
+    }
+}
diff --git a/packages/react-native-platform/ios/Tests/RNTokenStorageBridgeTests/TokenStorageBridgeTests.swift b/packages/react-native-platform/ios/Tests/RNTokenStorageBridgeTests/TokenStorageBridgeTests.swift
new file mode 100644
index 0000000..23f3b09
--- /dev/null
+++ b/packages/react-native-platform/ios/Tests/RNTokenStorageBridgeTests/TokenStorageBridgeTests.swift
@@ -0,0 +1,377 @@
+import XCTest
+import Security
+@testable import RNTokenStorageBridge
+
+class TokenStorageBridgeTests: XCTestCase {
+
+    var sut: TokenStorageBridge!
+
+    override func setUp() {
+        super.setUp()
+        sut = TokenStorageBridge()
+        cleanupKeychain()
+    }
+
+    override func tearDown() {
+        super.tearDown()
+        cleanupKeychain()
+    }
+
+    // MARK: - Token Operations Tests
+
+    func testSaveToken_shouldSucceed() {
+        let expectation = XCTestExpectation(description: "Save token")
+
+        sut.saveToken("test-id", tokenData: "test-token-data", resolve: { _ in
+            expectation.fulfill()
+        }, reject: { _, _, _ in
+            XCTFail("Should not reject")
+            expectation.fulfill()
+        })
+
+        wait(for: [expectation], timeout: 1.0)
+    }
+
+    func testSaveAndGetToken_shouldReturnSavedToken() {
+        let saveExpectation = XCTestExpectation(description: "Save token")
+        let getExpectation = XCTestExpectation(description: "Get token")
+        var savedTokenValue: String?
+
+        sut.saveToken("test-id", tokenData: "test-token-data", resolve: { _ in
+            saveExpectation.fulfill()
+        }, reject: { _, _, _ in
+            XCTFail("Save should not reject")
+            saveExpectation.fulfill()
+        })
+
+        wait(for: [saveExpectation], timeout: 1.0)
+
+        sut.getToken("test-id", resolve: { token in
+            savedTokenValue = token as? String
+            getExpectation.fulfill()
+        }, reject: { _, _, _ in
+            XCTFail("Get should not reject")
+            getExpectation.fulfill()
+        })
+
+        wait(for: [getExpectation], timeout: 1.0)
+        XCTAssertEqual(savedTokenValue, "test-token-data")
+    }
+
+    func testGetToken_nonExistent_shouldReturnNil() {
+        let expectation = XCTestExpectation(description: "Get non-existent token")
+        var result: String?
+
+        sut.getToken("non-existent", resolve: { token in
+            result = token as? String
+            expectation.fulfill()
+        }, reject: { _, _, _ in
+            XCTFail("Should not reject")
+            expectation.fulfill()
+        })
+
+        wait(for: [expectation], timeout: 1.0)
+        XCTAssertNil(result)
+    }
+
+    func testRemoveToken_shouldRemoveTokenAndMetadata() {
+        let saveTokenExp = XCTestExpectation(description: "Save token")
+        let saveMetaExp = XCTestExpectation(description: "Save metadata")
+        let removeExp = XCTestExpectation(description: "Remove token")
+        let getTokenExp = XCTestExpectation(description: "Get removed token")
+        var retrievedToken: String?
+
+        sut.saveToken("test-id", tokenData: "test-data", resolve: { _ in
+            saveTokenExp.fulfill()
+        }, reject: { _, _, _ in
+            XCTFail("Save token should not reject")
+            saveTokenExp.fulfill()
+        })
+
+        sut.saveMetadata("test-id", metadataData: "test-meta", resolve: { _ in
+            saveMetaExp.fulfill()
+        }, reject: { _, _, _ in
+            XCTFail("Save metadata should not reject")
+            saveMetaExp.fulfill()
+        })
+
+        wait(for: [saveTokenExp, saveMetaExp], timeout: 1.0)
+
+        sut.removeToken("test-id", resolve: { _ in
+            removeExp.fulfill()
+        }, reject: { _, _, _ in
+            XCTFail("Remove should not reject")
+            removeExp.fulfill()
+        })
+
+        wait(for: [removeExp], timeout: 1.0)
+
+        sut.getToken("test-id", resolve: { token in
+            retrievedToken = token as? String
+            getTokenExp.fulfill()
+        }, reject: { _, _, _ in
+            XCTFail("Get should not reject")
+            getTokenExp.fulfill()
+        })
+
+        wait(for: [getTokenExp], timeout: 1.0)
+        XCTAssertNil(retrievedToken)
+    }
+
+    func testGetAllTokenIds_emptyStorage_shouldReturnEmptyArray() {
+        let expectation = XCTestExpectation(description: "Get all token IDs")
+        var result: [String]?
+
+        sut.getAllTokenIds({ ids in
+            result = ids as? [String]
+            expectation.fulfill()
+        }, reject: { _, _, _ in
+            XCTFail("Should not reject")
+            expectation.fulfill()
+        })
+
+        wait(for: [expectation], timeout: 1.0)
+        XCTAssertEqual(result, [])
+    }
+
+    func testGetAllTokenIds_withMultipleTokens_shouldReturnIds() {
+        let save1Exp = XCTestExpectation(description: "Save token 1")
+        let save2Exp = XCTestExpectation(description: "Save token 2")
+        let getAllExp = XCTestExpectation(description: "Get all IDs")
+        var result: [String]?
+
+        sut.saveToken("token-1", tokenData: "data-1", resolve: { _ in
+            save1Exp.fulfill()
+        }, reject: { _, _, _ in
+            XCTFail("Save 1 should not reject")
+            save1Exp.fulfill()
+        })
+
+        sut.saveToken("token-2", tokenData: "data-2", resolve: { _ in
+            save2Exp.fulfill()
+        }, reject: { _, _, _ in
+            XCTFail("Save 2 should not reject")
+            save2Exp.fulfill()
+        })
+
+        wait(for: [save1Exp, save2Exp], timeout: 1.0)
+
+        sut.getAllTokenIds({ ids in
+            result = ids as? [String]
+            getAllExp.fulfill()
+        }, reject: { _, _, _ in
+            XCTFail("Should not reject")
+            getAllExp.fulfill()
+        })
+
+        wait(for: [getAllExp], timeout: 1.0)
+        XCTAssertEqual(Set(result ?? []), Set(["token-1", "token-2"]))
+    }
+
+    func testClearTokens_shouldRemoveAllTokens() {
+        let save1Exp = XCTestExpectation(description: "Save token 1")
+        let save2Exp = XCTestExpectation(description: "Save token 2")
+        let clearExp = XCTestExpectation(description: "Clear tokens")
+        let getAllExp = XCTestExpectation(description: "Get all IDs after clear")
+        var result: [String]?
+
+        sut.saveToken("token-1", tokenData: "data-1", resolve: { _ in
+            save1Exp.fulfill()
+        }, reject: { _, _, _ in
+            save1Exp.fulfill()
+        })
+
+        sut.saveToken("token-2", tokenData: "data-2", resolve: { _ in
+            save2Exp.fulfill()
+        }, reject: { _, _, _ in
+            save2Exp.fulfill()
+        })
+
+        wait(for: [save1Exp, save2Exp], timeout: 1.0)
+
+        sut.clearTokens({ _ in
+            clearExp.fulfill()
+        }, reject: { _, _, _ in
+            XCTFail("Clear should not reject")
+            clearExp.fulfill()
+        })
+
+        wait(for: [clearExp], timeout: 1.0)
+
+        sut.getAllTokenIds({ ids in
+            result = ids as? [String]
+            getAllExp.fulfill()
+        }, reject: { _, _, _ in
+            getAllExp.fulfill()
+        })
+
+        wait(for: [getAllExp], timeout: 1.0)
+        XCTAssertEqual(result, [])
+    }
+
+    // MARK: - Metadata Operations Tests
+
+    func testSaveMetadata_shouldSucceed() {
+        let expectation = XCTestExpectation(description: "Save metadata")
+
+        sut.saveMetadata("test-id", metadataData: "test-metadata", resolve: { _ in
+            expectation.fulfill()
+        }, reject: { _, _, _ in
+            XCTFail("Should not reject")
+            expectation.fulfill()
+        })
+
+        wait(for: [expectation], timeout: 1.0)
+    }
+
+    func testSaveAndGetMetadata_shouldReturnSavedMetadata() {
+        let saveExpectation = XCTestExpectation(description: "Save metadata")
+        let getExpectation = XCTestExpectation(description: "Get metadata")
+        var savedMetadata: String?
+
+        sut.saveMetadata("test-id", metadataData: "test-metadata", resolve: { _ in
+            saveExpectation.fulfill()
+        }, reject: { _, _, _ in
+            XCTFail("Save should not reject")
+            saveExpectation.fulfill()
+        })
+
+        wait(for: [saveExpectation], timeout: 1.0)
+
+        sut.getMetadata("test-id", resolve: { metadata in
+            savedMetadata = metadata as? String
+            getExpectation.fulfill()
+        }, reject: { _, _, _ in
+            XCTFail("Get should not reject")
+            getExpectation.fulfill()
+        })
+
+        wait(for: [getExpectation], timeout: 1.0)
+        XCTAssertEqual(savedMetadata, "test-metadata")
+    }
+
+    func testGetMetadata_nonExistent_shouldReturnNil() {
+        let expectation = XCTestExpectation(description: "Get non-existent metadata")
+        var result: String?
+
+        sut.getMetadata("non-existent", resolve: { metadata in
+            result = metadata as? String
+            expectation.fulfill()
+        }, reject: { _, _, _ in
+            XCTFail("Should not reject")
+            expectation.fulfill()
+        })
+
+        wait(for: [expectation], timeout: 1.0)
+        XCTAssertNil(result)
+    }
+
+    func testRemoveMetadata_shouldRemoveMetadata() {
+        let saveExpectation = XCTestExpectation(description: "Save metadata")
+        let removeExpectation = XCTestExpectation(description: "Remove metadata")
+        let getExpectation = XCTestExpectation(description: "Get removed metadata")
+        var result: String?
+
+        sut.saveMetadata("test-id", metadataData: "test-metadata", resolve: { _ in
+            saveExpectation.fulfill()
+        }, reject: { _, _, _ in
+            saveExpectation.fulfill()
+        })
+
+        wait(for: [saveExpectation], timeout: 1.0)
+
+        sut.removeMetadata("test-id", resolve: { _ in
+            removeExpectation.fulfill()
+        }, reject: { _, _, _ in
+            XCTFail("Remove should not reject")
+            removeExpectation.fulfill()
+        })
+
+        wait(for: [removeExpectation], timeout: 1.0)
+
+        sut.getMetadata("test-id", resolve: { metadata in
+            result = metadata as? String
+            getExpectation.fulfill()
+        }, reject: { _, _, _ in
+            getExpectation.fulfill()
+        })
+
+        wait(for: [getExpectation], timeout: 1.0)
+        XCTAssertNil(result)
+    }
+
+    // MARK: - Default Token ID Tests
+
+    func testSetDefaultTokenId_shouldSucceed() {
+        let expectation = XCTestExpectation(description: "Set default token ID")
+
+        sut.setDefaultTokenId("default-id", resolve: { _ in
+            expectation.fulfill()
+        }, reject: { _, _, _ in
+            XCTFail("Should not reject")
+            expectation.fulfill()
+        })
+
+        wait(for: [expectation], timeout: 1.0)
+    }
+
+    func testSetAndGetDefaultTokenId_shouldReturnSavedId() {
+        let setExpectation = XCTestExpectation(description: "Set default")
+        let getExpectation = XCTestExpectation(description: "Get default")
+        var savedId: String?
+
+        sut.setDefaultTokenId("default-id", resolve: { _ in
+            setExpectation.fulfill()
+        }, reject: { _, _, _ in
+            XCTFail("Set should not reject")
+            setExpectation.fulfill()
+        })
+
+        wait(for: [setExpectation], timeout: 1.0)
+
+        sut.getDefaultTokenId({ id in
+            savedId = id as? String
+            getExpectation.fulfill()
+        }, reject: { _, _, _ in
+            XCTFail("Get should not reject")
+            getExpectation.fulfill()
+        })
+
+        wait(for: [getExpectation], timeout: 1.0)
+        XCTAssertEqual(savedId, "default-id")
+    }
+
+    func testGetDefaultTokenId_notSet_shouldReturnNil() {
+        let expectation = XCTestExpectation(description: "Get default not set")
+        var result: String?
+
+        sut.getDefaultTokenId({ id in
+            result = id as? String
+            expectation.fulfill()
+        }, reject: { _, _, _ in
+            XCTFail("Should not reject")
+            expectation.fulfill()
+        })
+
+        wait(for: [expectation], timeout: 1.0)
+        XCTAssertNil(result)
+    }
+
+    // MARK: - Helper Methods
+
+    private func cleanupKeychain() {
+        let services = [
+            "com.okta.auth-foundation.tokens",
+            "com.okta.auth-foundation.metadata",
+            "com.okta.auth-foundation.default"
+        ]
+
+        for service in services {
+            let query: [String: Any] = [
+                kSecClass as String: kSecClassGenericPassword,
+                kSecAttrService as String: service
+            ]
+            SecItemDelete(query as CFDictionary)
+        }
+    }
+}
diff --git a/packages/react-native-platform/jest.config.js b/packages/react-native-platform/jest.config.js
new file mode 100644
index 0000000..26eaaaa
--- /dev/null
+++ b/packages/react-native-platform/jest.config.js
@@ -0,0 +1,29 @@
+import pkg from './package.json' with { type: 'json' };
+
+
+const config = {
+  displayName: '@okta/react-native-platform',
+  preset: '@repo/jest-helpers/react-native',
+  globals: {
+    __PKG_NAME__: pkg.name,
+    __PKG_VERSION__: pkg.version,
+    __DEV__: true     // required for `react-native` itself
+  },
+  // setupFiles: [
+  //   '<rootDir>/test/jest.setup.ts'
+  // ],
+  setupFilesAfterEnv: [
+    '<rootDir>/test/jest.setupAfterEnv.ts'
+  ],
+  moduleNameMapper: {
+    // '^src/(.*)$': '<rootDir>/src/$1',
+    // NOTE: '@okta/auth-foundation' maps to '@okta/auth-foundation/core' since every src file
+    // imports from /core rather than the base entrypoint
+    '^@okta/auth-foundation$': '<rootDir>/../auth-foundation/src/core.ts',
+    '^@okta/auth-foundation/core$': '<rootDir>/../auth-foundation/src/core.ts',
+    '^@okta/auth-foundation/internal$': '<rootDir>/../auth-foundation/src/internal.ts',
+    '^@okta/react-native-webcrypto-bridge$': '<rootDir>/../react-native-webcrypto-bridge/src/index.ts',
+  }
+};
+
+export default config;
diff --git a/packages/react-native-platform/package.json b/packages/react-native-platform/package.json
index 5a5a266..91dd063 100644
--- a/packages/react-native-platform/package.json
+++ b/packages/react-native-platform/package.json
@@ -20,7 +20,7 @@
     "./cpp",
     "*.md",
     "package.json",
-    "react-native-webcrypto-bridge.podspec"
+    "react-native-platform.podspec"
   ],
   "exports": {
     ".": {
@@ -35,6 +35,9 @@
     "build:watch": "rollup -c --watch & tsc --watch",
     "build:esm": "rollup -c",
     "build:types": "tsc",
+    "test": "yarn test:unit",
+    "test:unit": "jest",
+    "test:watch": "jest --watchAll",
     "prepack": "yarn build"
   },
   "dependencies": {
@@ -72,5 +75,13 @@
       "version": ">=1.19.0",
       "onFail": "warn"
     }
+  },
+  "codegenConfig": {
+    "name": "RNTokenStorageSpec",
+    "type": "modules",
+    "jsSrcsDir": "src/specs",
+    "android": {
+      "javaPackageName": "com.okta.reactnativeplatform"
+    }
   }
 }
\ No newline at end of file
diff --git a/packages/react-native-platform/react-native-platform.podspec b/packages/react-native-platform/react-native-platform.podspec
new file mode 100644
index 0000000..ebbcfa0
--- /dev/null
+++ b/packages/react-native-platform/react-native-platform.podspec
@@ -0,0 +1,27 @@
+require 'json'
+
+package = JSON.parse(File.read(File.join(__dir__, 'package.json')))
+
+Pod::Spec.new do |s|
+  s.name         = "react-native-platform"
+  s.version      = package['version']
+  s.summary      = "Okta React Native Platform SDK"
+  s.description  = package['description'] || "Okta authentication platform for React Native"
+  s.homepage     = "https://github.com/okta/okta-client-javascript"
+  s.license      = package['license']
+  s.authors      = { "Okta" => "jared.perreault@okta.com" }
+  s.platforms    = { :ios => "13.0" }
+  s.source       = { :git => "https://github.com/okta/okta-client-javascript.git", :tag => "v#{s.version}" }
+
+  s.source_files = "ios/**/*.{h,m,mm,swift}"
+
+  s.pod_target_xcconfig = {
+    'DEFINES_MODULE' => 'YES',
+    'SWIFT_COMPILATION_MODE' => 'wholemodule'
+  }
+  
+  s.dependency "React-Core"
+  
+  # Enable Swift support
+  s.swift_version = "5.0"
+end
\ No newline at end of file
diff --git a/packages/react-native-platform/src/Credential/TokenStorage.ts b/packages/react-native-platform/src/Credential/TokenStorage.ts
new file mode 100644
index 0000000..368c560
--- /dev/null
+++ b/packages/react-native-platform/src/Credential/TokenStorage.ts
@@ -0,0 +1,205 @@
+/**
+ * @packageDocumentation
+ * @internal
+ */
+
+import {
+  Token,
+  type TokenStorage,
+  type TokenStorageEvents,
+  EventEmitter,
+  CredentialError
+} from '@okta/auth-foundation/core';
+import NativeTokenStorage from '../specs/NativeTokenStorageBridge.ts';
+
+
+/**
+ * React Native implementation of TokenStorage
+ * 
+ * Uses native bridge to store:
+ * - Tokens in secure storage (iOS Keychain / Android EncryptedSharedPreferences)
+ * - Metadata in regular storage (iOS UserDefaults / Android SharedPreferences)
+ * 
+ * @internal
+ */
+export class ReactNativeTokenStorage implements TokenStorage {
+  private static version = 1;
+
+  readonly emitter: EventEmitter<TokenStorageEvents> = new EventEmitter();
+
+  #defaultId: string | null | undefined = undefined;
+
+  get defaultTokenId (): string | null | undefined {
+    return this.#defaultId;
+  }
+
+  set defaultTokenId (id: string | null) {
+    this.#defaultId = id;
+  }
+
+  async loadDefaultTokenId (): Promise<string | null> {
+    if (this.defaultTokenId === undefined) {
+      const id = await NativeTokenStorage.getDefaultTokenId();
+      this.defaultTokenId = id;   // caches the value returned from storage
+      return id;
+    }
+
+    return this.defaultTokenId;
+  }
+
+  async setDefaultTokenId (id: string | null): Promise<void> {
+    if (id === this.defaultTokenId) {
+      return;
+    }
+
+    await NativeTokenStorage.setDefaultTokenId(id);
+    this.defaultTokenId = id;
+    this.emitter.emit('default_changed', { storage: this, id });
+  }
+
+  async allIDs (): Promise<string[]> {
+    return await NativeTokenStorage.getAllTokenIds();
+  }
+
+  async add (token: Token, metadata?: Token.Metadata): Promise<void> {
+    metadata ??= Token.Metadata(token);
+    if (token.id !== metadata.id) {
+      throw new CredentialError('metadataConsistency');
+    }
+    
+    // Check for duplicates
+    const existingToken = await this.get(token.id);
+    if (existingToken) {
+      // TODO: make TokenError
+      throw new CredentialError('duplicateTokenAdded');
+    }
+
+    const changedDefault = (await this.allIDs()).length === 0;
+    await this.writeTokenToStorage(token);
+    await this.writeMetadataToStorage(metadata);
+
+    this.emitter.emit('token_added', { storage: this, id: token.id, token });
+
+    if (changedDefault) {
+      await this.setDefaultTokenId(token.id);
+    }
+  }
+
+  async replace (id: string, token: Token): Promise<void> {
+    if (id !== token.id) {
+      throw new CredentialError(`Token id mismatch: ${id} !== ${token.id}`);
+    }
+
+    const metadata = await this.getMetadata(id);
+    if (token.id !== metadata?.id) {
+      throw new CredentialError('metadataConsistency');
+    }
+
+    await this.writeTokenToStorage(token);
+
+    this.emitter.emit('token_replaced', { storage: this, id, token });
+  }
+
+  async remove (id: string): Promise<void> {
+    // `Bridge.removeToken` will also delete the metadata from separate storage location
+    await NativeTokenStorage.removeToken(id);
+
+    this.emitter.emit('token_removed', { storage: this, id });
+
+    if (this.defaultTokenId === id) {
+      await this.setDefaultTokenId(null);
+    }
+  }
+
+  async get (id: string): Promise<Token | null> {
+    const raw = await NativeTokenStorage.getToken(id);
+
+    if (!raw) {
+      return null;
+    }
+
+    let json;
+    try {
+      json = JSON.parse(raw);
+    } catch (error) {
+      return await this.handleReadError(error, id);
+    }
+
+    const { token, v } = json;
+    
+    if (v !== ReactNativeTokenStorage.version) {
+      console.warn(`Token storage version mismatch: ${v} !== ${ReactNativeTokenStorage.version}`);
+    }
+
+    // Restore context from metadata
+    const metadata = await this.getMetadata(id);
+    if (metadata) {
+      token.context = Token.extractContext(metadata);
+    }
+
+    return new Token({ id, ...token });
+  }
+
+  async getMetadata (id: string): Promise<Token.Metadata | null> {
+    const raw = await NativeTokenStorage.getMetadata(id);
+    if (!raw) {
+      return null;
+    }
+
+    let json;
+    try {
+      json = JSON.parse(raw);
+    } catch (error) {
+      return await this.handleReadError(error, id);
+    }
+
+    const { metadata, v } = json;
+    
+    if (v !== ReactNativeTokenStorage.version) {
+      console.warn(`Token storage version mismatch: ${v} !== ${ReactNativeTokenStorage.version}`);
+    }
+
+    return metadata;
+  }
+
+  async setMetadata (metadata: Token.Metadata): Promise<void> {
+    await this.writeMetadataToStorage(metadata);
+    this.emitter.emit('metadata_updated', { storage: this, id: metadata.id, metadata });
+  }
+
+  async clear (): Promise<void> {
+    // NOTE: Bridge.clearTokens() also deletes `defaultTokenId`, no reason to make multiple bridge requests
+    await NativeTokenStorage.clearTokens();
+    
+    this.defaultTokenId = null;
+    this.emitter.emit('default_changed', { storage: this, id: null });
+  }
+
+  // Helper methods
+
+  protected async writeTokenToStorage (token: Token): Promise<void> {
+    const rawToken = token.toJSON();
+    delete rawToken.context; // Stored in metadata
+
+    const data = {
+      token: rawToken,
+      v: ReactNativeTokenStorage.version
+    };
+
+    await NativeTokenStorage.saveToken(token.id, JSON.stringify(data));
+  }
+
+  protected async writeMetadataToStorage (metadata: Token.Metadata): Promise<void> {
+    const data = {
+      metadata,
+      v: ReactNativeTokenStorage.version
+    };
+
+    await NativeTokenStorage.saveMetadata(metadata.id, JSON.stringify(data));
+  }
+
+  protected async handleReadError (error: unknown, id: string): Promise<null> {
+    await NativeTokenStorage.removeToken(id);
+    return null;
+  }
+}
\ No newline at end of file
diff --git a/packages/react-native-platform/src/index.ts b/packages/react-native-platform/src/index.ts
index 60c6d5d..2ab2a3d 100644
--- a/packages/react-native-platform/src/index.ts
+++ b/packages/react-native-platform/src/index.ts
@@ -22,7 +22,15 @@ import { Platform } from '@okta/auth-foundation/core';
 // eslint-disable-next-line no-restricted-imports
 import { PlatformDefaults } from './platform/defaults.ts';
 
+// Register the React Native Platform default singleton dependencies
 Platform.registerDefaultsLoader(() => PlatformDefaults);
 
+// Install the React Native WebCrypto Bridge Polyfill
 import { installWebCryptoPolyfill } from '@okta/react-native-webcrypto-bridge';
 export { installWebCryptoPolyfill };
+installWebCryptoPolyfill();
+
+// Override TokenStorage to use React Native Storage Bridge
+import { ReactNativeTokenStorage } from './Credential/TokenStorage.ts';
+import { Credential } from '@okta/auth-foundation/core';
+Credential.coordinator.tokenStorage = new ReactNativeTokenStorage();
diff --git a/packages/react-native-platform/src/specs/NativeTokenStorageBridge.ts b/packages/react-native-platform/src/specs/NativeTokenStorageBridge.ts
new file mode 100644
index 0000000..228e70b
--- /dev/null
+++ b/packages/react-native-platform/src/specs/NativeTokenStorageBridge.ts
@@ -0,0 +1,17 @@
+import type { TurboModule } from 'react-native';
+import { TurboModuleRegistry } from 'react-native';
+
+export interface Spec extends TurboModule {
+  saveToken (id: string, tokenData: string): Promise<void>;
+  getToken (id: string): Promise<string | null>;
+  removeToken (id: string): Promise<void>;
+  getAllTokenIds (): Promise<Array<string>>;
+  clearTokens (): Promise<void>;
+  saveMetadata (id: string, metadataData: string): Promise<void>;
+  getMetadata (id: string): Promise<string | null>;
+  removeMetadata (id: string): Promise<void>;
+  setDefaultTokenId (id: string | null): Promise<void>;
+  getDefaultTokenId (): Promise<string | null>;
+}
+
+export default TurboModuleRegistry.getEnforcing<Spec>('TokenStorageBridge');
diff --git a/packages/react-native-platform/test/jest.setupAfterEnv.ts b/packages/react-native-platform/test/jest.setupAfterEnv.ts
new file mode 100644
index 0000000..7ec420d
--- /dev/null
+++ b/packages/react-native-platform/test/jest.setupAfterEnv.ts
@@ -0,0 +1,8 @@
+import { Platform } from '@okta/auth-foundation/core';
+// eslint-disable-next-line no-restricted-imports
+import { PlatformDefaults } from 'src/platform/defaults';
+
+
+// Setups spa-platform Platform Dependencies within the Platform pattern
+// since files are loaded individually, rather than from the index.ts entrypoint
+Platform.registerDefaultsLoader(() => PlatformDefaults);
diff --git a/packages/react-native-platform/test/spec/TokenStorage.spec.ts b/packages/react-native-platform/test/spec/TokenStorage.spec.ts
new file mode 100644
index 0000000..d26d406
--- /dev/null
+++ b/packages/react-native-platform/test/spec/TokenStorage.spec.ts
@@ -0,0 +1,459 @@
+// Mock the native bridge
+jest.mock('src/specs/NativeTokenStorageBridge', () => {
+  return {
+    __esModule: true,
+    default: {
+      getAllTokenIds: jest.fn().mockResolvedValue([]),
+      getToken: jest.fn().mockResolvedValue(null),
+      saveToken: jest.fn().mockResolvedValue(undefined),
+      clearTokens: jest.fn().mockResolvedValue(undefined),
+      getMetadata: jest.fn().mockResolvedValue(null),
+      saveMetadata: jest.fn().mockResolvedValue(undefined),
+      removeToken: jest.fn().mockResolvedValue(undefined),
+      getDefaultTokenId: jest.fn().mockResolvedValue(null),
+      setDefaultTokenId: jest.fn().mockResolvedValue(undefined)
+    }
+  };
+});
+
+import { Token, CredentialError } from '@okta/auth-foundation/core';
+import { ReactNativeTokenStorage } from 'src/Credential/TokenStorage';
+import NativeTokenStorage from 'src/specs/NativeTokenStorageBridge';
+import { mockTokenResponse } from '@repo/jest-helpers/react-native/helpers';
+
+
+const makeTestToken = (id?: string, overrides = {}) => {
+  return new Token(mockTokenResponse(id, overrides));
+};
+
+describe('ReactNativeTokenStorage', () => {
+  let storage: ReactNativeTokenStorage;
+
+  beforeEach(() => {
+    storage = new ReactNativeTokenStorage();
+  });
+
+  describe('Default Token ID', () => {
+    it('should load default token ID from native storage', async () => {
+      const expectedId = 'default-token-id';
+      (NativeTokenStorage.getDefaultTokenId as jest.Mock).mockResolvedValue(
+        expectedId
+      );
+
+      const id = await storage.loadDefaultTokenId();
+
+      expect(id).toBe(expectedId);
+      expect(NativeTokenStorage.getDefaultTokenId).toHaveBeenCalled();
+    });
+
+    it('should cache default token ID after first load', async () => {
+      const expectedId = 'cached-token-id';
+      (NativeTokenStorage.getDefaultTokenId as jest.Mock).mockResolvedValue(
+        expectedId
+      );
+
+      // First call
+      await storage.loadDefaultTokenId();
+      // Second call
+      await storage.loadDefaultTokenId();
+
+      // Should only call native once
+      expect(NativeTokenStorage.getDefaultTokenId).toHaveBeenCalledTimes(1);
+    });
+
+    it('should return cached default token ID without calling native', async () => {
+      const expectedId = 'cached-id';
+      storage.defaultTokenId = expectedId;
+
+      const id = await storage.loadDefaultTokenId();
+
+      expect(id).toBe(expectedId);
+      expect(NativeTokenStorage.getDefaultTokenId).not.toHaveBeenCalled();
+    });
+
+    it('should set default token ID in native storage', async () => {
+      (NativeTokenStorage.setDefaultTokenId as jest.Mock).mockResolvedValue(
+        undefined
+      );
+
+      const tokenId = 'new-default-id';
+      await storage.setDefaultTokenId(tokenId);
+
+      expect(NativeTokenStorage.setDefaultTokenId).toHaveBeenCalledWith(
+        tokenId
+      );
+      expect(storage.defaultTokenId).toBe(tokenId);
+    });
+
+    it('should not call native if setting same default token ID', async () => {
+      const tokenId = 'same-id';
+      storage.defaultTokenId = tokenId;
+
+      await storage.setDefaultTokenId(tokenId);
+
+      expect(NativeTokenStorage.setDefaultTokenId).not.toHaveBeenCalled();
+    });
+
+    it('should emit default_changed event when setting default token ID', async () => {
+      (NativeTokenStorage.setDefaultTokenId as jest.Mock).mockResolvedValue(
+        undefined
+      );
+      const emitSpy = jest.spyOn(storage.emitter, 'emit');
+
+      const tokenId = 'new-default-id';
+      await storage.setDefaultTokenId(tokenId);
+
+      expect(emitSpy).toHaveBeenCalledWith('default_changed', {
+        storage,
+        id: tokenId,
+      });
+    });
+
+    it('should set default token ID to null', async () => {
+      (NativeTokenStorage.setDefaultTokenId as jest.Mock).mockResolvedValue(
+        undefined
+      );
+      storage.defaultTokenId = 'existing-id';
+
+      await storage.setDefaultTokenId(null);
+
+      expect(NativeTokenStorage.setDefaultTokenId).toHaveBeenCalledWith(null);
+      expect(storage.defaultTokenId).toBeNull();
+    });
+  });
+
+  describe('Token Operations', () => {
+    it('should add a new token', async () => {
+      (NativeTokenStorage.getAllTokenIds as jest.Mock).mockResolvedValue([]);
+      (NativeTokenStorage.saveToken as jest.Mock).mockResolvedValue(undefined);
+      (NativeTokenStorage.saveMetadata as jest.Mock).mockResolvedValue(
+        undefined
+      );
+      (NativeTokenStorage.setDefaultTokenId as jest.Mock).mockResolvedValue(
+        undefined
+      );
+      const emitSpy = jest.spyOn(storage.emitter, 'emit');
+
+      const token = makeTestToken();
+      await storage.add(token);
+
+      expect(NativeTokenStorage.saveToken).toHaveBeenCalled();
+      expect(NativeTokenStorage.saveMetadata).toHaveBeenCalled();
+      expect(emitSpy).toHaveBeenCalledWith('token_added', {
+        storage,
+        id: token.id,
+        token,
+      });
+    });
+
+    it('should set first token as default', async () => {
+      (NativeTokenStorage.getAllTokenIds as jest.Mock).mockResolvedValue([]);
+      (NativeTokenStorage.saveToken as jest.Mock).mockResolvedValue(undefined);
+      (NativeTokenStorage.saveMetadata as jest.Mock).mockResolvedValue(
+        undefined
+      );
+      (NativeTokenStorage.setDefaultTokenId as jest.Mock).mockResolvedValue(
+        undefined
+      );
+
+      const token = makeTestToken();
+      await storage.add(token);
+
+      expect(NativeTokenStorage.setDefaultTokenId).toHaveBeenCalledWith(
+        token.id
+      );
+    });
+
+    it('should throw error when adding duplicate token', async () => {
+      (NativeTokenStorage.getAllTokenIds as jest.Mock).mockResolvedValue([
+        'existing-token',
+      ]);
+      const tokenData = JSON.stringify({
+        token: makeTestToken('existing-token').toJSON(),
+        v: 1,
+      });
+      (NativeTokenStorage.getToken as jest.Mock).mockResolvedValue(tokenData);
+
+      const token = makeTestToken('existing-token');
+
+      await expect(storage.add(token)).rejects.toThrow(
+        CredentialError
+      );
+    });
+
+    it('should throw error when token and metadata IDs do not match', async () => {
+      const token = makeTestToken();
+      const metadata = Token.Metadata(makeTestToken());
+
+      await expect(storage.add(token, metadata)).rejects.toThrow(
+        'metadataConsistency'
+      );
+    });
+
+    it('should retrieve a token by ID', async () => {
+      const token = makeTestToken('test-id');
+      const tokenData = JSON.stringify({
+        token: token.toJSON(),
+        v: 1,
+      });
+      (NativeTokenStorage.getToken as jest.Mock).mockResolvedValue(tokenData);
+      (NativeTokenStorage.getMetadata as jest.Mock).mockResolvedValue(null);
+
+      const retrieved = await storage.get('test-id');
+
+      expect(retrieved).not.toBeNull();
+      expect(retrieved?.id).toBe('test-id');
+      expect(retrieved?.accessToken).toBe(token.accessToken);
+    });
+
+    it('should return null for non-existent token', async () => {
+      (NativeTokenStorage.getToken as jest.Mock).mockResolvedValue(null);
+
+      const retrieved = await storage.get('non-existent');
+
+      expect(retrieved).toBeNull();
+    });
+
+    it('should handle corrupted token data', async () => {
+      (NativeTokenStorage.getToken as jest.Mock).mockResolvedValue(
+        'invalid-json'
+      );
+      const removeTokenSpy = jest.spyOn(NativeTokenStorage, 'removeToken');
+      removeTokenSpy.mockResolvedValue(undefined);
+
+      const retrieved = await storage.get('corrupted-token');
+
+      expect(retrieved).toBeNull();
+      expect(removeTokenSpy).toHaveBeenCalledWith('corrupted-token');
+    });
+
+    it('should replace an existing token', async () => {
+      const token = makeTestToken();
+      (NativeTokenStorage.getToken as jest.Mock).mockResolvedValue(
+        JSON.stringify({ token, v: 1 })
+      );
+      (NativeTokenStorage.getMetadata as jest.Mock).mockResolvedValue(
+        JSON.stringify({ metadata: Token.Metadata(token), v: 1 })
+      );
+      const emitSpy = jest.spyOn(storage.emitter, 'emit');
+
+      const replacementToken = makeTestToken(token.id);
+      await storage.replace(replacementToken.id, replacementToken);
+
+      expect(NativeTokenStorage.saveToken).toHaveBeenCalled();
+      expect(emitSpy).toHaveBeenCalledWith('token_replaced', {
+        storage,
+        id: token.id,
+        token: replacementToken,
+      });
+    });
+
+    it('should throw error when replacing with mismatched IDs', async () => {
+      const token = makeTestToken('token-id');
+
+      await expect(storage.replace('different-id', token)).rejects.toThrow(
+        'Token id mismatch'
+      );
+    });
+
+    it('should remove a token', async () => {
+      (NativeTokenStorage.removeToken as jest.Mock).mockResolvedValue(
+        undefined
+      );
+      const emitSpy = jest.spyOn(storage.emitter, 'emit');
+
+      await storage.remove('token-to-remove');
+
+      expect(NativeTokenStorage.removeToken).toHaveBeenCalledWith(
+        'token-to-remove'
+      );
+      expect(emitSpy).toHaveBeenCalledWith('token_removed', {
+        storage,
+        id: 'token-to-remove',
+      });
+    });
+
+    it('should clear default token ID when removing active default', async () => {
+      (NativeTokenStorage.removeToken as jest.Mock).mockResolvedValue(
+        undefined
+      );
+      (NativeTokenStorage.setDefaultTokenId as jest.Mock).mockResolvedValue(
+        undefined
+      );
+      storage.defaultTokenId = 'default-token';
+
+      await storage.remove('default-token');
+
+      expect(NativeTokenStorage.setDefaultTokenId).toHaveBeenCalledWith(null);
+      expect(storage.defaultTokenId).toBeNull();
+    });
+
+    it('should not clear default token ID when removing non-default token', async () => {
+      (NativeTokenStorage.removeToken as jest.Mock).mockResolvedValue(
+        undefined
+      );
+      storage.defaultTokenId = 'default-token';
+
+      await storage.remove('other-token');
+
+      expect(NativeTokenStorage.setDefaultTokenId).not.toHaveBeenCalled();
+    });
+  });
+
+  describe('Metadata Operations', () => {
+    it('should retrieve metadata by token ID', async () => {
+      const metadata = Token.Metadata(makeTestToken('test-id'));
+      const metadataData = JSON.stringify({
+        metadata,
+        v: 1,
+      });
+      (NativeTokenStorage.getMetadata as jest.Mock).mockResolvedValue(
+        metadataData
+      );
+
+      const retrieved = await storage.getMetadata('test-id');
+
+      expect(retrieved).not.toBeNull();
+      expect(retrieved?.id).toBe('test-id');
+    });
+
+    it('should return null for non-existent metadata', async () => {
+      (NativeTokenStorage.getMetadata as jest.Mock).mockResolvedValue(null);
+
+      const retrieved = await storage.getMetadata('non-existent');
+
+      expect(retrieved).toBeNull();
+    });
+
+    it('should handle corrupted metadata', async () => {
+      (NativeTokenStorage.getMetadata as jest.Mock).mockResolvedValue(
+        'invalid-json'
+      );
+      const removeTokenSpy = jest.spyOn(NativeTokenStorage, 'removeToken');
+      removeTokenSpy.mockResolvedValue(undefined);
+
+      const retrieved = await storage.getMetadata('corrupted-metadata');
+
+      expect(retrieved).toBeNull();
+      expect(removeTokenSpy).toHaveBeenCalledWith('corrupted-metadata');
+    });
+
+    it('should set metadata for a token', async () => {
+      (NativeTokenStorage.saveMetadata as jest.Mock).mockResolvedValue(
+        undefined
+      );
+      const emitSpy = jest.spyOn(storage.emitter, 'emit');
+      const metadata = Token.Metadata(makeTestToken('test-id'));
+
+      await storage.setMetadata(metadata);
+
+      expect(NativeTokenStorage.saveMetadata).toHaveBeenCalled();
+      expect(emitSpy).toHaveBeenCalledWith('metadata_updated', {
+        storage,
+        id: 'test-id',
+        metadata,
+      });
+    });
+  });
+
+  describe('Token List Operations', () => {
+    it('should get all token IDs', async () => {
+      const tokenIds = ['token-1', 'token-2', 'token-3'];
+      (NativeTokenStorage.getAllTokenIds as jest.Mock).mockResolvedValue(
+        tokenIds
+      );
+
+      const ids = await storage.allIDs();
+
+      expect(ids).toEqual(tokenIds);
+      expect(NativeTokenStorage.getAllTokenIds).toHaveBeenCalled();
+    });
+
+    it('should return empty array when no tokens exist', async () => {
+      (NativeTokenStorage.getAllTokenIds as jest.Mock).mockResolvedValue([]);
+
+      const ids = await storage.allIDs();
+
+      expect(ids).toEqual([]);
+    });
+
+    it('should clear all tokens', async () => {
+      (NativeTokenStorage.clearTokens as jest.Mock).mockResolvedValue(
+        undefined
+      );
+      const emitSpy = jest.spyOn(storage.emitter, 'emit');
+      storage.defaultTokenId = 'some-default';
+
+      await storage.clear();
+
+      expect(NativeTokenStorage.clearTokens).toHaveBeenCalled();
+      expect(storage.defaultTokenId).toBeNull();
+      expect(emitSpy).toHaveBeenCalledWith('default_changed', {
+        storage,
+        id: null,
+      });
+    });
+  });
+
+  describe('Token Storage Version', () => {
+    it('should warn when token storage version does not match', async () => {
+      const warnSpy = jest.spyOn(console, 'warn').mockImplementation();
+      const tokenData = JSON.stringify({
+        token: makeTestToken('test-id').toJSON(),
+        v: 99, // Different version
+      });
+      (NativeTokenStorage.getToken as jest.Mock).mockResolvedValue(tokenData);
+      (NativeTokenStorage.getMetadata as jest.Mock).mockResolvedValue(null);
+
+      await storage.get('test-id');
+
+      expect(warnSpy).toHaveBeenCalledWith(
+        expect.stringContaining('Token storage version mismatch')
+      );
+      warnSpy.mockRestore();
+    });
+
+    it('should warn when metadata storage version does not match', async () => {
+      const warnSpy = jest.spyOn(console, 'warn').mockImplementation();
+      const metadataData = JSON.stringify({
+        metadata: Token.Metadata(makeTestToken('test-id')),
+        v: 99, // Different version
+      });
+      (NativeTokenStorage.getMetadata as jest.Mock).mockResolvedValue(
+        metadataData
+      );
+
+      await storage.getMetadata('test-id');
+
+      expect(warnSpy).toHaveBeenCalledWith(
+        expect.stringContaining('Token storage version mismatch')
+      );
+      warnSpy.mockRestore();
+    });
+  });
+
+  describe('Event Emitter', () => {
+    it('should have emitter property', () => {
+      expect(storage.emitter).toBeDefined();
+    });
+
+    it('should emit events when tokens are added', async () => {
+      (NativeTokenStorage.getToken as jest.Mock).mockResolvedValue(null);
+      (NativeTokenStorage.getAllTokenIds as jest.Mock).mockResolvedValue([]);
+      (NativeTokenStorage.saveToken as jest.Mock).mockResolvedValue(undefined);
+      (NativeTokenStorage.saveMetadata as jest.Mock).mockResolvedValue(undefined);
+      const listener = jest.fn();
+      storage.emitter.on('token_added', listener);
+
+      const token = makeTestToken('new-token');
+      const metadata = Token.Metadata(token);
+      await storage.add(token, metadata);
+
+      expect(listener).toHaveBeenCalledWith({
+        storage,
+        id: 'new-token',
+        token,
+      });
+    });
+  });
+});
diff --git a/packages/react-native-platform/test/tsconfig.json b/packages/react-native-platform/test/tsconfig.json
new file mode 100644
index 0000000..ab4620d
--- /dev/null
+++ b/packages/react-native-platform/test/tsconfig.json
@@ -0,0 +1,20 @@
+{
+  "extends": "@repo/typescript-config/jest.json",
+  "compilerOptions": {
+    "paths": {
+      "src/*": ["../src/*"]
+    },
+    "jsx": "react"
+  },
+  "lib": [
+    "dom"
+  ],
+  "include": [
+    "helpers/**/*.ts",
+    "spec/**/*.ts", 
+    "jest.setupAfterEnv.ts",
+  ],
+  "exclude": [
+    "node_modules"
+  ]
+}
\ No newline at end of file
diff --git a/packages/react-native-webcrypto-bridge/THIRD-PARTY-NOTICES.md b/packages/react-native-webcrypto-bridge/THIRD-PARTY-NOTICES.md
new file mode 100644
index 0000000..ca083fd
--- /dev/null
+++ b/packages/react-native-webcrypto-bridge/THIRD-PARTY-NOTICES.md
@@ -0,0 +1,48 @@
+# Third Party Notices
+
+This file contains third-party software licenses for @okta/react-native-webcrypto-bridge.
+
+## Runtime Dependencies
+
+react-native-webcrypto-bridge has no direct runtime dependencies. It uses peer dependencies only.
+
+## Peer Dependencies
+
+### React
+- Version: *
+- License: MIT
+- Repository: https://github.com/facebook/react
+- Description: A declarative, efficient, and flexible JavaScript library for building user interfaces.
+
+### React Native
+- Version: *
+- License: MIT
+- Repository: https://github.com/facebook/react-native
+- Description: A framework for building native applications using React.
+
+## iOS Dependencies
+
+### Runtime
+
+- React Core - MIT License
+- Foundation framework - Apple proprietary
+
+### Build Time
+
+- Xcode 15.0+ with Swift 5.0+ compiler
+
+## Android Dependencies
+
+### Runtime
+
+- kotlin-stdlib 2.1.0 - Apache-2.0 License
+- react-android 0.81.0 - MIT License
+- androidx.biometric 1.1.0 - Apache-2.0 License
+
+### Build Time
+
+- Android Gradle Plugin 8.1.0 - Apache-2.0 License
+- Kotlin Gradle Plugin 2.1.0 - Apache-2.0 License
+- Java 17 (minimum required)
+- Android SDK 35 (compile version) - Apache-2.0 License
+- Android SDK 24+ (minimum support version) - Apache-2.0 License
diff --git a/packages/react-native-webcrypto-bridge/babel.config.cjs b/packages/react-native-webcrypto-bridge/babel.config.cjs
deleted file mode 100644
index c7008d5..0000000
--- a/packages/react-native-webcrypto-bridge/babel.config.cjs
+++ /dev/null
@@ -1 +0,0 @@
-module.exports = { presets: ['module:@react-native/babel-preset'] };
diff --git a/packages/react-native-webcrypto-bridge/jest.config.js b/packages/react-native-webcrypto-bridge/jest.config.js
index 8d07ff6..3756e1a 100644
--- a/packages/react-native-webcrypto-bridge/jest.config.js
+++ b/packages/react-native-webcrypto-bridge/jest.config.js
@@ -1,28 +1,17 @@
-import { createJsWithBabelPreset } from 'ts-jest';
 import pkg from './package.json' with { type: 'json' };
 
 
-const jsWithBabelPreset = createJsWithBabelPreset({
-  tsconfig: '<rootDir>/test/tsconfig.json',
-  babelConfig: true,
-});
-
 const config = {
   displayName: '@okta/react-native-webcrypto-bridge',
-  preset: 'react-native',
+  preset: '@repo/jest-helpers/react-native',
   globals: {
     __PKG_NAME__: pkg.name,
     __PKG_VERSION__: pkg.version,
+    __DEV__: true     // required for `react-native` itself
   },
-  transform: jsWithBabelPreset.transform,
-  moduleFileExtensions: ['ts', 'tsx', 'js', 'jsx', 'json', 'node'],
-  setupFiles: ['<rootDir>/test/jest.setup.js'],
-  collectCoverageFrom: [
-    'src/**/*.ts'
-  ],
-  moduleNameMapper: {
-    '^src/(.*)$': '<rootDir>/src/$1'
-  }
+  setupFiles: [
+    '<rootDir>/test/jest.setup.ts'
+  ]
 };
 
 export default config;
diff --git a/packages/react-native-webcrypto-bridge/test/jest.setup.js b/packages/react-native-webcrypto-bridge/test/jest.setup.ts
similarity index 100%
rename from packages/react-native-webcrypto-bridge/test/jest.setup.js
rename to packages/react-native-webcrypto-bridge/test/jest.setup.ts
diff --git a/packages/spa-platform/src/Credential/TokenStorage.ts b/packages/spa-platform/src/Credential/TokenStorage.ts
index 04206eb..6658995 100644
--- a/packages/spa-platform/src/Credential/TokenStorage.ts
+++ b/packages/spa-platform/src/Credential/TokenStorage.ts
@@ -62,6 +62,10 @@ export class BrowserTokenStorage implements TokenStorage {
     return `${this.tokenPrefix}:v2:${id}`;
   }
 
+  async loadDefaultTokenId (): Promise<string | null> {
+    return this.defaultTokenId;
+  }
+
   async setDefaultTokenId (id: string | null): Promise<void> {
     if (id === this.defaultTokenId) {
       return;
diff --git a/tooling/jest-helpers/package.json b/tooling/jest-helpers/package.json
index 7d9a30f..f2b9c53 100644
--- a/tooling/jest-helpers/package.json
+++ b/tooling/jest-helpers/package.json
@@ -4,9 +4,11 @@
   "private": true,
   "files": [
     "browser/*",
-    "node/*"
+    "node/*",
+    "react-native/*"
   ],
   "devDependencies": {
+    "@babel/plugin-transform-class-static-block": "^7.28.6",
     "@types/jest": "^29.4.4",
     "@types/node": "^22.9.0",
     "jest": "^29.7.0",
diff --git a/tooling/jest-helpers/react-native/babel.config.js b/tooling/jest-helpers/react-native/babel.config.js
new file mode 100644
index 0000000..8431fc8
--- /dev/null
+++ b/tooling/jest-helpers/react-native/babel.config.js
@@ -0,0 +1,9 @@
+module.exports = {
+  presets: [
+    'module:@react-native/babel-preset',
+  ],
+  plugins: [
+    '@babel/plugin-transform-class-static-block'
+  ],
+};
+
diff --git a/tooling/jest-helpers/react-native/helpers.ts b/tooling/jest-helpers/react-native/helpers.ts
new file mode 100644
index 0000000..b7f768b
--- /dev/null
+++ b/tooling/jest-helpers/react-native/helpers.ts
@@ -0,0 +1 @@
+export * from '../helpers';
diff --git a/tooling/jest-helpers/react-native/jest-preset.js b/tooling/jest-helpers/react-native/jest-preset.js
new file mode 100644
index 0000000..6920b9b
--- /dev/null
+++ b/tooling/jest-helpers/react-native/jest-preset.js
@@ -0,0 +1,35 @@
+const { createJsWithBabelPreset } = require('ts-jest');
+const path = require('path');
+
+
+const jsWithBabelPreset = createJsWithBabelPreset({
+  tsconfig: '<rootDir>/test/tsconfig.json',
+  babelConfig: path.join(__dirname, 'babel.config.js')
+});
+
+module.exports = {
+  roots: ['<rootDir>'],
+  preset: 'react-native',
+  globals: {
+    __PKG_NAME__: 'PLACEHOLDER',
+    __PKG_VERSION__: 'PLACEHOLDER'
+  },
+  transform: jsWithBabelPreset.transform,
+  extensionsToTreatAsEsm: ['.ts'],
+  moduleFileExtensions: ['ts', 'tsx', 'js', 'jsx', 'json', 'node'],
+  restoreMocks: true,
+  clearMocks: true,
+  testMatch: [
+    '**/test/spec/**/*.{js,ts}'
+  ],
+  // Don't transform node_modules - mock them instead via jest.mock() in setup
+  transformIgnorePatterns: [
+    'node_modules/(?!(@okta)/)'
+  ],
+  collectCoverageFrom: [
+    'src/**/*.ts'
+  ],
+  moduleNameMapper: {
+    '^src/(.*)$': '<rootDir>/src/$1',
+  }
+};