After your backend has verified who the app user is (OTP login), mint a short-lived token bound to their phone, email and/or your own user id (plus an optional name for a contact it may create) and hand it to the app. The app sends it with its device registration (contactToken) and the device is linked to that contact. Default lifetime 15 minutes, maximum 1 hour. channelId is needed only when you have more than one push app.

Authenticate with your organisation API token (Bearer). Roles: CRM_ADMIN, ACCOUNT_OWNER or CRM_BOT.