> For the complete documentation index, see [llms.txt](https://docs.visualsentinel.com/llms.txt)

# Mobile apps (iOS, Android, Mac)

Native apps can use the same login flow: `POST /api/auth/login` returns a JWT. Send it as `Authorization: Bearer <jwt>` on every later request. CSRF is skipped for Bearer tokens. Refresh tokens with `POST /api/auth/refresh`, passing the refresh token in the request body (or the `X-Client-Type: mobile` header).

From the Visual Sentinel OpenAPI 3.1 specification at [https://docs.visualsentinel.com/openapi.json](https://docs.visualsentinel.com/openapi.json). Endpoint details are in the [API reference](https://docs.visualsentinel.com/index.md).