diff --git a/openframe-authorization-service-core/src/main/java/com/openframe/authz/dto/SsoInvitationAcceptRequest.java b/openframe-authorization-service-core/src/main/java/com/openframe/authz/dto/SsoInvitationAcceptRequest.java
index c0a158c83..bb26e67a5 100644
--- a/openframe-authorization-service-core/src/main/java/com/openframe/authz/dto/SsoInvitationAcceptRequest.java
+++ b/openframe-authorization-service-core/src/main/java/com/openframe/authz/dto/SsoInvitationAcceptRequest.java
@@ -15,4 +15,6 @@ public class SsoInvitationAcceptRequest {
     private String provider;
     private Boolean switchTenant;
     private String redirectTo;
+    /** Mobile-app flow: forwarded to {@code /oauth/continue} — see {@link SsoTenantRegistrationInitRequest#isAuthMobile()}. */
+    private boolean authMobile;
 }
diff --git a/openframe-authorization-service-core/src/main/java/com/openframe/authz/dto/SsoTenantRegistrationInitRequest.java b/openframe-authorization-service-core/src/main/java/com/openframe/authz/dto/SsoTenantRegistrationInitRequest.java
index 7715ea781..de5bfc1ba 100644
--- a/openframe-authorization-service-core/src/main/java/com/openframe/authz/dto/SsoTenantRegistrationInitRequest.java
+++ b/openframe-authorization-service-core/src/main/java/com/openframe/authz/dto/SsoTenantRegistrationInitRequest.java
@@ -38,6 +38,13 @@ public class SsoTenantRegistrationInitRequest {
     // Optional final redirect target (absolute or allowed host)
     private String redirectTo;
 
+    /**
+     * Mobile-app flow: forwarded to the BFF {@code /oauth/continue} after finalization so the
+     * callback attaches the one-time ticket the app exchanges for tokens (same contract as
+     * {@code /oauth/login?authMobile=true}).
+     */
+    private boolean authMobile;
+
     private RegistrationAttribution attribution;
 }
 
diff --git a/openframe-authorization-service-core/src/main/java/com/openframe/authz/security/SsoInviteCookiePayload.java b/openframe-authorization-service-core/src/main/java/com/openframe/authz/security/SsoInviteCookiePayload.java
index 783db9c3e..fdf2a7950 100644
--- a/openframe-authorization-service-core/src/main/java/com/openframe/authz/security/SsoInviteCookiePayload.java
+++ b/openframe-authorization-service-core/src/main/java/com/openframe/authz/security/SsoInviteCookiePayload.java
@@ -6,6 +6,7 @@ public record SsoInviteCookiePayload(
         Boolean switchTenant,
         String provider,
         String redirectTo,
+        boolean authMobile,
         long iat,
         long exp
 ) implements SsoCookiePayload {
diff --git a/openframe-authorization-service-core/src/main/java/com/openframe/authz/security/SsoTenantRegCookiePayload.java b/openframe-authorization-service-core/src/main/java/com/openframe/authz/security/SsoTenantRegCookiePayload.java
index 834958ce9..0780178f5 100644
--- a/openframe-authorization-service-core/src/main/java/com/openframe/authz/security/SsoTenantRegCookiePayload.java
+++ b/openframe-authorization-service-core/src/main/java/com/openframe/authz/security/SsoTenantRegCookiePayload.java
@@ -8,6 +8,7 @@ public record SsoTenantRegCookiePayload(
         String tenantDomain,
         String provider,
         String redirectTo,
+        boolean authMobile,
         String accessCode,
         RegistrationAttribution attribution,
         long iat,
diff --git a/openframe-authorization-service-core/src/main/java/com/openframe/authz/security/flow/InviteSsoHandler.java b/openframe-authorization-service-core/src/main/java/com/openframe/authz/security/flow/InviteSsoHandler.java
index ff65a4c94..d6eb75c92 100644
--- a/openframe-authorization-service-core/src/main/java/com/openframe/authz/security/flow/InviteSsoHandler.java
+++ b/openframe-authorization-service-core/src/main/java/com/openframe/authz/security/flow/InviteSsoHandler.java
@@ -60,7 +60,7 @@ public void handle(HttpServletRequest request, HttpServletResponse response, Aut
         String targetTenantId = userCreated.getTenantId();
 
         // Clear SSO flow cookie but KEEP session to allow OAuth continue
-        clearFlowCookieAndRedirect(response, cookie, targetTenantId, payload.redirectTo());
+        clearFlowCookieAndRedirect(response, cookie, targetTenantId, payload.redirectTo(), payload.authMobile());
     }
 
 }
diff --git a/openframe-authorization-service-core/src/main/java/com/openframe/authz/security/flow/SsoFlowHandler.java b/openframe-authorization-service-core/src/main/java/com/openframe/authz/security/flow/SsoFlowHandler.java
index f63e3da00..08197ee16 100644
--- a/openframe-authorization-service-core/src/main/java/com/openframe/authz/security/flow/SsoFlowHandler.java
+++ b/openframe-authorization-service-core/src/main/java/com/openframe/authz/security/flow/SsoFlowHandler.java
@@ -91,13 +91,17 @@ default String[] resolveNames(HttpServletRequest request, Authentication authent
     default void clearFlowCookieAndRedirect(HttpServletResponse response,
                                             Cookie flowCookie,
                                             String tenantId,
-                                            String redirectTo) {
+                                            String redirectTo,
+                                            boolean authMobile) {
         clearCookie(response, flowCookie.getName());
         String path = "/oauth/continue?tenantId=" +
                 encode(tenantId, UTF_8);
         if (hasText(redirectTo)) {
             path += "&redirectTo=" + encode(redirectTo, UTF_8);
         }
+        if (authMobile) {
+            path += "&authMobile=true";
+        }
         foundAtRoot(response, path);
     }
 }
diff --git a/openframe-authorization-service-core/src/main/java/com/openframe/authz/security/flow/TenantRegSsoHandler.java b/openframe-authorization-service-core/src/main/java/com/openframe/authz/security/flow/TenantRegSsoHandler.java
index a4c14a6a4..3137902ed 100644
--- a/openframe-authorization-service-core/src/main/java/com/openframe/authz/security/flow/TenantRegSsoHandler.java
+++ b/openframe-authorization-service-core/src/main/java/com/openframe/authz/security/flow/TenantRegSsoHandler.java
@@ -70,7 +70,7 @@ public void handle(HttpServletRequest request, HttpServletResponse response, Aut
 
         var tenant = registrationService.registerTenant(reg);
 
-        clearFlowCookieAndRedirect(response, cookie, tenant.getId(), payload.redirectTo());
+        clearFlowCookieAndRedirect(response, cookie, tenant.getId(), payload.redirectTo(), payload.authMobile());
     }
 
 }
diff --git a/openframe-authorization-service-core/src/main/java/com/openframe/authz/service/sso/SsoInvitationService.java b/openframe-authorization-service-core/src/main/java/com/openframe/authz/service/sso/SsoInvitationService.java
index 3bc9c3e99..54a370f27 100644
--- a/openframe-authorization-service-core/src/main/java/com/openframe/authz/service/sso/SsoInvitationService.java
+++ b/openframe-authorization-service-core/src/main/java/com/openframe/authz/service/sso/SsoInvitationService.java
@@ -36,6 +36,7 @@ public SsoAuthorizeData startAccept(SsoInvitationAcceptRequest request) {
                 request.getSwitchTenant(),
                 provider,
                 request.getRedirectTo(),
+                request.isAuthMobile(),
                 now,
                 now + COOKIE_TTL_SECONDS
         );
diff --git a/openframe-authorization-service-core/src/main/java/com/openframe/authz/service/sso/SsoTenantRegistrationService.java b/openframe-authorization-service-core/src/main/java/com/openframe/authz/service/sso/SsoTenantRegistrationService.java
index 42c6562b0..306c19dd6 100644
--- a/openframe-authorization-service-core/src/main/java/com/openframe/authz/service/sso/SsoTenantRegistrationService.java
+++ b/openframe-authorization-service-core/src/main/java/com/openframe/authz/service/sso/SsoTenantRegistrationService.java
@@ -77,6 +77,7 @@ private SsoTenantRegCookiePayload buildCookiePayload(SsoTenantRegistrationInitRe
                 request.getTenantDomain(),
                 provider,
                 request.getRedirectTo(),
+                request.isAuthMobile(),
                 request.getAccessCode(),
                 boundedAttribution(request.getAttribution()),
                 issuedAt,