Formspring mobile apps authenticate with Sanctum personal access tokens scoped for native clients and call a thin BFF layer on top of the existing /api/v1 surface.
Auth
POST /api/v1/mobile/auth/login- email + password, returns token + workspaces (2FA supported)POST /api/v1/mobile/auth/logout- revoke the current device token- Passkeys and single sign-on are web sign-ins and do not issue mobile tokens; the mobile API signs in with email and password (with the two-factor step when it is on)
Send Authorization: Bearer <token>, X-Workspace-Id, and X-Client: mobile/<platform>/<version> on every request.
BFF highlights
| Endpoint | Purpose |
|---|---|
GET /api/v1/mobile/home |
Home digest (bookings, counts, attention items) |
GET /api/v1/mobile/submissions |
Unified inbox across forms, surveys, funnels |
GET /api/v1/mobile/appointments |
Booking list + confirm / decline / cancel |
GET /api/v1/mobile/search |
Permission-filtered fan-out search |
Mutations proxy to the per-product REST endpoints; the BFF adds cursor pagination, normalized shapes, and Idempotency-Key deduplication for offline replay.