We've recently overhauled the backend to our mobile app from having a very basic authentication mechanism that went through the API to having both an authentication server and an API server, with the auth server issuing OAuth2 JWT tokens (authorization code flow) for login and the API authenticating clients based on these tokens. We open the mobile device's browser, attached to the app, so that the user can enter their credentials straight into the auth server's web interface and the password never has to go through the app, which is a potential security risk.
We've also switched to using the same mechanism of opening the mobile device's browser for our "register user" and "change password" functionality, in both cases because these are also times when the user will be entering a password, and we don't want it to go through the app.
However, I'm not sure about our "forgot password" functionality. This is still using the app's UI to go through the API server at the moment because the user isn't having to enter a password (just an e-mail address to which a password reset link is sent) and so no password is exposed to the app, and as the API and auth server are sharing a user credentials database the API is able to generate the password reset link and store it in the DB, but should we be exposing this functionality on the auth server instead as a web interface similar to how we're doing register, login, and change password? If so, why? What are the pros and cons?