Mobile auth

Control exposes the mobile_auth.* methods. All endpoints are POST at /api/v2/method/ unless noted GET.

Endpoint	What it does
`mobile_auth.login`	Login with username and password.
`mobile_auth.logout`	Logout and revoke refresh tokens.
`mobile_auth.send_login_otp`	Send an OTP to a mobile number.
`mobile_auth.verify_login_otp`	Verify the OTP and complete login.
`mobile_auth.refresh_token`	Exchange a refresh token for a new access/refresh pair.
`mobile_auth.permissions` (GET)	Get the current user's roles and doctype permissions.
`mobile_auth.get_translations` (GET)	Get translations. `all=1` for app + DB, `lang=hi,en` for multiple languages.
`mobile_auth.get_social_login_providers` (GET, guest)	Discover enabled social providers.
`mobile_auth.get_social_authorize_url` (guest)	Build a provider-direct OAuth authorize URL.
`mobile_auth.app_status`	Alias covering enabled state, package name, and minimum version.
`mobile_auth.configuration`	Alias for reading Mobile Configuration.
`mobile_auth.me`	Alias for fetching the current session's identity.
`mobile_sync.get_docs_with_children`	Bulk fetch for documents plus their child rows.
`mobile_sync.sync_details`	Sync state for a doctype.
`mobile_sync.get_translations`	Sync-path translation fetch.
`mobile_sync.report_error`	Posts an aggregated failed-push report from the SDK's error collector.

Token lifetimes

access_token expires in 24 hours. refresh_token expires in 30 days and rotates on every refresh.

{
  "user": "user@example.com",
  "full_name": "User Name",
  "language": "en",
  "access_token": "...",
  "refresh_token": "...",
  "offline_enabled": false,
  "mobile_form_names": [...],
  "roles": ["Mobile User", "All"],
  "permissions": [
    { "doctype": "Customer", "read": true, "write": true, "create": true, "delete": false, "submit": false, "cancel": false, "amend": false }
  ]
}

offline_enabled only appears when the parent enabled flag on Mobile Configuration is on. mobile_form_names is built from the Forms Configuration table. See Configuration.

Create an OAuth Client in Frappe.
Set its redirect URI to exactly frappemobilesdk://oauth/callback.
Configure a Social Login Key for each provider you want.

The client_id sent to get_social_authorize_url is the Frappe OAuth Client ID, not the provider's own client ID. client_secret is never returned by any endpoint.

Try it yourself

A Bruno collection with every endpoint pre-built is in the repository: API/.

mForm Docs

Token lifetimes

What the login response carries

OAuth and social login setup

Try it yourself