Skip to content
WhoTookWhat

Mobile app

Scan, check out, reserve, log maintenance, and walk an audit from a phone.

The mobile app uses the same account as the website. It talks to the REST API, not the /admin pages.

Sign in

Create an account in the app (name, email, password) or continue with Google, Microsoft, or Apple on a development or production build. If the account has not accepted the Terms of Service, the app opens Accept terms. New social identities create an account when the provider email is verified and terms are accepted on that screen. You can also request a password-reset email; the link opens the app (or the website) to choose a new password.

If the account has two-factor, finish with an authenticator code, a recovery code, or Use passkey on a development build (not Expo Go). Mobile tokens last 90 days; sign in again when they expire.

If sign-in returns terms_required, accept terms in the app (POST /auth/terms) with the same password or social proof. Register and new social use 422 on terms, then retry with terms: true.

The Account screen can link or unlink a social provider, remove extra emails, enrol or delete passkeys, and enrol an authenticator on a development or production build (not Expo Go). You cannot delete the last remaining sign-in method.

The Organisations screen lists memberships, pending invites for your verified emails, and Create an Organisation (name and optional logo). That starts the same trial as the website. You can change the logo after create. Owners and managers can invite, cancel, change a role, or remove a member from the Members screen. Owners open billing in the system browser on the website subscription page.

Later requests send Authorization: Bearer <token>. Pick the Organisation from the list and the app sends it as X-Organisation-Id.

If this Organisation requires an authenticator or passkey and you have not added one, the app shows a dedicated screen. Enrol a passkey or authenticator from Account, then pick the Organisation again. The Organisation list and tenant routes stay blocked until you have a factor.

What it is for

Interactive API docs: /docs/api. That page is only for signed-in Owner or Manager members of at least one Organisation (not Staff, and not guests). Locally and in production the same role gate applies.

If the Organisation is view-only, reads still work and writes fail.