Mobile / Native Auth0 (operators)

Audience: Platform operators configuring Auth0 for the iOS client

Hardhat Flow’s API already accepts Auth0 access tokens for the shared API audience. The mobile app needs a Native Auth0 application (separate from the web SPA), Authorization Code with PKCE, and refresh-token rotation.

What changes in Auth0

1. Create a Native application (do not reuse “Hardhat Flow Web”).
2. Register iOS callback and logout URLs (custom scheme or Universal Links).
3. Authorize the existing Hardhat Flow API (same identifier as AUTH0_API_AUDIENCE).
4. Enable refresh token rotation and reuse detection.

No new backend environment variables are required for native JWT validation. Mobile build config needs the Native Client ID only (public client — no secret in the app).

Where to read the full runbook

Detailed steps, claim requirements, and the operator checklist live in the repository mobile docs (not duplicated here):

• Native runbook: docs/mobile/NATIVE_AUTH.md
• API contract / schema: docs/mobile/API_CONTRACT.md · live schema at /api/schema/
• Existing SPA/API/M2M setup: repository docs/AUTH0_SETUP.md

Verification

• Dashboard configuration can be completed before the Flutter app exists.
• End-to-end native login against staging is verified when the mobile client milestone is authorized — do not mark device login done from Auth0 settings alone.