Log inApps
Native uses the same password
iOS LoginForm and Android splash call POST /api/v1/auth/login. Same password, HS256 session.
iOS LoginForm and Android splash sign-in call POST /api/v1/auth/login with the same password. They do not mint a Keychain or EncryptedPrefs session without a 200.
GET /api/v1/login?q= lists these topics in-app. Impersonation stays web-only.