Your CRM.
In your pocket.

Venti signs in through Twenty CRM's native OAuth 2.0 authorization-code flow using PKCE (RFC 7636) opened in the system browser.

Manual Setup (Fallback for Self-Hosted Instances):
If your self-hosted instance does not have dynamic registration enabled, configure your application manually in 4 easy steps:

1. Open Twenty CRM in your browser: Log into your instance and go to Settings → Applications.
2. Create a new Application: Click Create Application (or New Application) and enter a name (e.g. "TwentyMobile").
3. Register the Redirect URI: Copy the exact Redirect URI displayed in Venti's OAuth screen and paste it into the application settings on Twenty CRM:

4. Obtain the Client ID: Save the application on Twenty CRM and copy the generated Client ID (and Client Secret, if issued).
5. Sign in from Venti: Paste the Client ID into Venti and tap Sign in with Browser. Authorize with your Google or SSO account: the system browser safely redirects back into the app using the registered pocketcrm://oauth/callback scheme.

When authenticating through the system browser for the first time without an existing browser session, Twenty CRM's Single Page Application (SPA) routes successful logins to the workspace dashboard instead of remembering the initial authorization prompt.

Note: Once your browser has authenticated your session, subsequent logins or token refreshes will detect your session immediately and display the consent prompt directly without landing on the dashboard.

Venti supports RFC 7591 Dynamic Client Registration. When connecting to a supported instance (like Twenty Cloud), the app registers itself automatically with the CRM and securely stores its assigned Client ID on your device.

When you uninstall and reinstall Venti:

1. Your device's operating system (iOS or Android) completely wipes the app's local secure storage, including the previous Client ID.
2. On the fresh install, Venti detects no local credentials and automatically requests a new registration from Twenty CRM.
3. Twenty CRM registers the new install with its own unique Client ID, resulting in a new "TwentyMobile" entry in Settings → Applications.

Yes, absolutely. Standard credentials login is fully supported for all workspace members and administrators.

• Two-Factor Authentication (2FA / OTP): If your Twenty account has 2FA enabled, Venti automatically detects the pending challenge and opens a dedicated 6-digit OTP verification screen with smart clipboard pasting.
• Automated Captcha Solving: If your Twenty CRM instance enforces Cloudflare Turnstile or Google reCAPTCHA, Venti resolves the verification challenge invisibly in the background so you never get blocked by security checks.
• Workflow Execution: Logging in with Email & Password provides a user-scoped JWT token, which is required if you plan to execute Twenty manual workflows.

API Key authentication is ideal for quick administrator access or developer environments:

1. In Twenty CRM, navigate to Settings → Developers → API Keys.
2. Click Create API Key, assign your desired permissions (e.g. read/write access), and copy the secret token.
3. In Venti, select Login with API Key and paste the key.

Venti supports Apple's native Contacts Provider API introduced in iOS 18:

1. Open Venti and go to Settings → iOS Contacts.
2. Toggle on "Show Twenty people in iOS Contacts".
3. Open the native Apple Contacts app on your iPhone or iPad: you will see a live, dedicated container named Twenty.

Embedded in-app WebViews present serious security concerns for federated login:

• Protection Against Credential Sniffing: Embedded webviews allow host applications to inspect entered passwords and cookies. Major identity providers (including Google) intentionally block logins from generic WebViews with errors like disallowed_useragent.
• Native Platform Security: Venti uses Chrome Custom Tabs on Android and ASWebAuthenticationSession on iOS. Your credentials are typed strictly into Google or your SSO provider.
• Ephemeral Isolation: Authentication sessions run with ephemeral flags, guaranteeing that shared or corporate devices never leak cookies or inherit previous users' accounts.

The Business Card Scanner lets you capture new leads on the go in seconds:

1. From the Contacts screen, tap the Scan Card button.
2. Capture a photo of the card with your camera, or pick an existing image from your photo album.
3. The on-device OCR engine parses full names, company, email addresses, phone numbers, and websites with smart heuristics.
4. Review and edit any extracted fields, then tap save: Venti creates the contact in Twenty CRM immediately with optimistic UI updates.

Venti schedules local push notifications directly on your phone so you never miss an important customer follow-up:

• Schedule Timing: Tasks with scheduled due dates trigger a notification 30 minutes before the deadline as well as at the exact due time.
• Android Setup: Android aggressive power management (Doze mode) can delay alarms. For instant reminders, navigate to Settings → Apps → Venti → Battery and set it to "Unrestricted".
• iOS Setup: Ensure you accept the notification permission prompt during onboarding, or verify under iOS Settings → Venti → Notifications.

Yes. From any Contact Detail view, tap the Share action in the top AppBar.

Venti generates a standard RFC vCard file containing the contact's full name, linked company, emails, phone numbers, and address. You can send it instantly via AirDrop, WhatsApp, Telegram, email, or import it into your personal address book.

In Twenty CRM, the backend GraphQL mutation for triggering manual workflows requires a verified User Identity (JWT token).

• If you logged in using an API Key, Twenty CRM's server treats the connection as an automated system key and returns FORBIDDEN (403) when attempting to run user workflows.
• How to fix: Log out and reconnect using your Email & Password or Google / SSO. This establishes a full user session and enables the interactive Slide-to-Execute workflow button.

Yes, with full schema introspection! Venti dynamically queries your Twenty CRM metadata schema over GraphQL.

• Standard & Custom Objects: In addition to Contacts, Companies, and Tasks, all custom workspace entities (such as Opportunities or custom tables) appear in the More tab.
• Customizable Layout: Tap the ⚙ settings icon on any dynamic object detail view to toggle field visibility and adjust display order. Your preferences are persisted securely on your phone.
• Composite Fields: Full support for complex data types including Currency, Address, Phone, and Relation Pickers (linking companies and contacts).

No, zero CRM data, customer records, or credentials are ever collected or intermediated.

Venti connects directly from your mobile device to your own Twenty CRM instance over encrypted HTTPS. Sensitive tokens and credentials never leave your hardware-backed keychain (Apple Keychain / Android Keystore).

The code is 100% open-source under the AGPL-3.0 license on GitHub for full auditability.

No duplicate apps are created — team onboarding is seamless and clean!

• Shared App per Workspace: When the first user or workspace admin connects Venti to their Twenty CRM instance via SSO / Google login, its verified Client ID is published to the workspace entry, so teammates reuse that same authorized application named Venti instead of creating their own.
• Zero-Knowledge Shared Registry: Subsequent team members entering the same workspace URL automatically discover this pre-existing Client ID. They don't have to navigate to CRM Settings, create applications, or copy-paste UUIDs. Only applications that the instance itself confirms (and that are named Venti) are accepted, and lookups are rate-limited.
• Self-Healing on Deletion: If a CRM admin ever deletes the Venti application in Twenty CRM (Settings → Applications), the next check detects the removal and purges the stale registry record. On instances that support Dynamic Client Registration the app re-provisions itself automatically; on self-hosted instances without it, Venti simply asks for a new Client ID.
• Zero-Knowledge Guarantee: The shared registry only stores the public hostname mapped to the public Client ID UUID (plus timestamps and the previously overwritten IDs, for auditing). It never sees, stores, or handles secrets, passwords, access tokens, refresh tokens, user accounts, or CRM data. You can disable it entirely or self-host it with --dart-define=OAUTH_REGISTRY_URL=.