We want to change login to always happen on one specific domain (T348388: Use central login wiki for login (SUL3)). This will probably have some effect on Wikimedia mobile apps.

These apps currently use the clientlogin API to get CentralAuth cookies, and use those cookies on all requests. The clientlogin API is tightly coupled to the login UI and will change when the login UI changes. We plan to change the login UI on all wikis that aren't the central login wiki to redirect to the central login wiki; correspondingly, the clientlogin API will return a REDIRECT response, which the apps aren't prepared for. The old login flow will probably remain available but only behind a feature flag (such as adding a usesul3=0 parameter to the login page URL / login API request).

Apps will have to implement one of these changes:

• Switch to using the clientlogin API on the central domain. This should be a trivial change (but for now blocked on figuring out what the central domain will be - T363695: Create a Wikimedia login domain that can be served by any wiki).
• Keep using the clientlogin API on wherever they are logging in currently, but use the fallback flag (which will eventually go away, but not soon).

Given that code changes for apps take time, we have to make sure that either the fallback flag, or the clientlogin API on the central login wiki, is operational long enough before the clientlogin API behavior change on the other wikis.

Alternatively, we could have the SUL3 feature flag default to true on web but false on API.