I am looking into writing an API that will be accessed by mobile devices (We also own the mobile application, there are no 3rd parties involved).
As part of the login flow we have been instructed to use an email/password registration flow, followed by the creation of a 5-digit pin number which would allow the user access to the application upon next opening the application.
This seems to be at odds with the majority of authentication flows available such as oAuth as there seems to be no indication of using a further pin authentication for login.
There are plenty of applications that do seem to do this however, so I wonder are they rolling their own solution? Or a combination of typical services and then hosting something themselves?
I am struggling with the concept of ensuring the unique device is also tied to the pin in order to authenticate requests correctly within the API.
Pointers welcome, but for something that I see is quite common in mobile applications, there seems to be precious little detail out there with regards to the security aspects of this kind of authentication?