Appearance
Login flow
Three ways a user reaches the home page from the login page: Google OAuth, skipping auth entirely, or email + password. Every call on this page needs the brand x-auth-token; the customer JWT only exists after stage 4.
Play the flow
Three ways in — Google, skipping auth, or email with a password or a one-time code. Pick a path and press Play: the phone shows the screen each step is on, and each step names the call it makes and what the server does with it.
4:4713
batch
log in to your account or create one
more login options
skip for now
by continuing, you agree to our terms of use and privacy policy.
Space plays and pauses, ← and → step. Screens marked not designed yet are ones the documented flow requires but that have no design — they are drawn from the steps, not invented.
Stages
API calls by stage
| Stage | Action | API call | Auth |
|---|---|---|---|
| 1 | Login page loads | Nothing required. Branding/content, if the page shows any, comes from GET /api/v2/brand/mobile/cms | Brand |
| 2 | Login with Google | POST /api/v1/mobile/register/google-oauth — send email + oauth_access_token | Brand |
| 2 | Login with Apple (same slot, if the app offers it) | POST /api/v1/mobile/register/apple-oauth — oauth_access_token is the only accepted field | Brand |
| 3 | Skip for now | No call. The app keeps only x-auth-token and must use the guest mounts from here on — /mobile/open/tags-catalog, /mobile/open/syncBag, /mobile/open/discount/applicable, /mobile/create-order | Brand |
| 3 | Register for push before login | POST /api/v1/mobile/user-device-token — the guest mount stores the token with no userId | Brand |
| 4a–4c | Email + password login | POST /api/v1/mobile/login — one identifier (email or phoneNumber + phone_prefix) and one credential (password or otp). Returns the customer JWT | Brand |
| 4 | OTP instead of a password | POST /api/v1/mobile/send-otp, then the same login call with otp | Brand |
| 5 | Home page, signed in | GET /api/v1/mobile/user-detail · GET /api/v1/mobile/loyalty/customer · GET /api/v2/brand/mobile/loyalty/points | Customer |
| 5 | Home page content | GET /api/v2/brand/mobile/cms — platform required; 404 means nothing is published, not a failure | Brand |
| 5 | Register push for the signed-in user | POST /api/v1/user/mobile/user-device-token — platform is the uppercase enum key (IOS, ANDROID, WEB) | Customer |
Two things the API forces onto this screen
- reCAPTCHA is conditional.
recaptcha_tokenis required onloginandsend-otponly if the brand hasrecaptcha_requiredset. The app has to know that per brand before it can build the form. - A
+in an email is rejected on every customer-identity endpoint, andphone_prefixbecomes required the momentphoneNumberis present.
Paths
1. Google Login Page → Login with Google → Google OAuth → Home Page
2. Guest / skip Login Page → Skip for now → Home Page
3. Email + password Login Page → More login options → Email & Password Login Page → enter email → enter password → Login button → Home Page
Open questions
- Google OAuth failure or user-cancel path is not defined yet — where does it return to?
- Invalid credentials on the password login is not defined yet (inline error vs popup). Whatever the design, the client has to read it off the body:
handleCatchanswers HTTP 200 withsuccess: falsefor a bad password. Only the auth middleware itself returns 401. - "Skip for now" implies a guest session — unclear what the home page shows without an account. The API side of that is concrete, at least: the guest mounts listed at stage 3 exist for catalog, cart, discounts and order creation, and everything else (loyalty, wishlist, profile, receipts) is customer-only and will 401.
- The
google-oauthandapple-oauthendpoints are named register but serve as login for a returning user too. Worth confirming there is no separate "already registered" branch the app needs to handle. - Does the app need
referralCodeon the login/OAuth calls? All three accept it as a query param, which is how a referred install would attribute — see Refer a friend.