If you are talking about browser based, just use the Auth class. Phone devices nowadays work just as similar as their desktop/table counterparts.

You can certainly create the REST API for login, and call that controller from inside another controller. So say you create all of your REST endpoints, and now you would like to create a frontend interface. Using the IoC container, you can call the API from with your frontend controller.

// Frontend Controller
public function login() {
       // Call the API
       $response = App::make('App\Controllers\Api\UserController')->login(); // Call login() method on controller located in App\Api\UserController
       $response = json_decode($response->getContent()); // $response now contains object from API
       
       // Do something here based on the JSON response from the API
}

My example uses Controllers being organized into subfolders. In order for this to work, you have to namespace the controller accordingly. Example for L4.x: app\controllers\api\UserController.php

namespace App\Controllers\Api
use App\Controllers\BaseController

class UserController extends \BaseController {

}