Loading
Mobile app — staff sign-in
Your team's login. Separate from your customers', on purpose.
Staff and customers share one app, not one login. Techs and owners sign in with the email + password they already use on the web dashboard — same Better-Auth account, same permissions, no second set of credentials to manage. The session token lands in Expo SecureStore and rides along as a Bearer header on every request after that, so the app doesn't ask again until the token expires or someone signs out.
No credit card
Cancel anytime
Features, zoomed in
The parts that actually move the needle.
Three capabilities built specifically for the day-to-day of a working shop.
Deep dive · 01
One account, one password, two apps
There's no separate 'mobile account' to provision. A tech's email + password is the same credential they'd use to log into the web dashboard from a shop computer — same Better-Auth user row, same role, same shop membership. Nothing to keep in sync, nothing that can drift out of date between web and mobile.
- Signs in against the same /api/auth/sign-in/email endpoint the web app uses
- Role + shop membership come from the same account, not a mobile-specific copy
- New hire gets one invite, works on both web and mobile immediately
Deep dive · 02
Signed in once, not every time you background the app
The session token comes back from Better-Auth's bearer plugin, gets written to SecureStore, and every subsequent API call attaches it as an Authorization: Bearer header. Close the app, reopen it a week later — still signed in, because the token lives on-device instead of a cookie the OS can drop.
- Token persists across app restarts and phone reboots
- No re-auth prompt on every launch
- Sign out clears the SecureStore key without touching the customer session on the same device
What's included
The full capability list.
Everything that ships on day one. No feature-gating surprises inside a single plan.
- Email + password against the same Better-Auth account as the web app
- Session token stored in Expo SecureStore, encrypted at rest
- Token sent as Authorization: Bearer on every tRPC call after sign-in
- Same role + permission model as web — no separate mobile permission set
- Separate SecureStore key from the customer session, so one device can hold both
See every angle
A tour of the screens
Every meaningful view, the path through it, and the moments that matter — so you know exactly what you're buying.
Staff sign-in
Email + password, the same Better-Auth account as the web dashboard.
No separate mobile-only credential.
Straight to Today after signing in
The Bearer token lands in SecureStore on sign-in and rides along on every request from there — no re-login on restart..
Who it's for
Built specifically for…
- Techs and installers who need the app open all day without re-logging-in
- Shop owners who want one credential to manage per employee, not one per platform
- Multi-location teams where the same login should work at any shop they're a member of
What it replaces
The old way…
- A separate mobile-only account with its own password to reset
- Re-entering credentials every time the app gets backgrounded
- Shared logins because setting up individual mobile accounts felt like too much overhead
How it works
Set it up once. Run it forever.
- 1
1. Enter email + password
Same credential as the web dashboard — no separate mobile signup or invite.
- 2
2. Token lands in SecureStore
Better-Auth's bearer plugin returns a session token, which the app writes to encrypted on-device storage.
- 3
3. Every call rides on that token
The app attaches Authorization: Bearer <token> to every tRPC request from then on — no cookies, no re-prompting.
What this looks like in a shop
Marcus starts his shift, opens SalesThumb on his phone, and signs in with the same email + password he uses at the front-desk computer. He doesn't touch the login screen again for weeks — the app stays signed in through restarts, dead batteries, and a phone swap mid-month (same credentials, new device). If he ever needs to check his own warranty as a customer, that's a completely separate flow with its own session — the two never collide.
Questions
Good to know.
- Does this share a password with the web login?
- Yes — same Better-Auth account. Change the password on web and it applies to mobile the next time the mobile token expires or the user signs out.
- Can a phone stay signed in as both a customer and a staff member?
- Yes. Staff and customer sessions are stored under different SecureStore keys, so a technician testing the customer login on their own phone doesn't get signed out of their staff session.
- What happens if someone loses their phone?
- An owner or admin can revoke the account's sessions from the web dashboard, which invalidates the mobile token on next use.
Fits in with
Works with your stack
Be
Better-Auth
Issues and validates the staff session
Ex
Expo SecureStore
On-device encrypted token storage
Explore more
Pairs well with
Customer login
One Expo app, two login flows. Customers type name + phone, get a 6-digit SMS code, land in their own portal. Staff use email + password. Role decides which tabs they see.
Learn more
Role-based tabs
Two dimensions decide what a teammate can open: mobile_role (INSTALLER / SALES / BOTH / NONE) gates the field tabs, membership role (OWNER / ADMIN / MANAGER) gates the manager Dashboard. Set once in Settings → Team, enforced everywhere.
Learn more
Mobile Apps
The installer app shows today's schedule, captures photos, clocks in/out, and updates job status. The customer app shows their active job's progress, appointments, quotes, invoices, and warranty status — as the SalesThumb app with your shop's name on it today. (A fully white-labeled app under your own brand in the App Store is on the roadmap.)
Learn more