Send X-App-Key and X-App-Version to each operation in this reference. The AppKey identifies your mobile app and can ship with it. Keep provider credentials and administrative secrets on the server.
Register a device with POST /v2/auth/device and a JSON body containing device_id. Save the returned access_token and refresh_token securely. Send the access token as Authorization: Bearer <access_token> on protected requests.
When the access token expires, call POST /v2/auth/refresh with the same app headers and a JSON body containing refresh_token. Replace both stored tokens with the returned pair. Tokens are bound to the app that obtained them. If you receive token_app_mismatch, check that the AppKey and tokens belong to the same app.