Native uses the same reset API

iOS ResetPasswordFlow and Android splash call POST /api/v1/auth/reset. Same 8+ rule.

iOS ResetPasswordFlow and Android splash forgot call POST /api/v1/auth/reset after the code is pasted. They do not mint a Keychain or EncryptedPrefs session from this POST alone.

GET /api/v1/reset?q= lists these topics in-app. Impersonation stays web-only.

Set a new password form Open related page Forgot password