Clarification Needed: User-Specific Actions from Mobile App Using Xen

[aashishtiwari]

I am currently working on a Flutter-based mobile application that needs to integrate with an existing XenForo forum.

On the web version, logged-in users can perform all user-specific actions such as:

• Creating posts
• Commenting/replying
• Liking content
• Performing other authenticated user tasks

However, when implementing the same functionality in a mobile app using the XenForo REST API, I am facing limitations.

From the official documentation, I understand that:

• API keys can only be generated from the Admin Control Panel
• Normal users cannot generate their own API keys
• There is no OAuth or user-level token-based authentication mechanism available by default

Because of this, my questions are:

1. Is it possible for a mobile application to allow user-specific actions (post, comment, like, etc.) using only XenForo REST APIs without a custom backend or plugin?
2. Is there any officially supported way for a mobile app user to authenticate securely and perform actions as that user, similar to how it works on the web?
3. If not, is the recommended approach to use a custom backend or develop a XenForo plugin to handle user authentication and session/token management?

I want to ensure that my implementation follows XenForo best practices and security guidelines.

Your clarification will help me decide the correct technical architecture for this project.

Thank you in advance for your guidance.