A system comprising: a client device in communication via a network with a server and a common gateway interface; a native app executing on one or more hardware processors of the client device configured to receive a device session token from the server for authenticating a device session between the native app and the server, the device session token used as credentials authenticating a user for the device session between the server and the native app executing on the client device; and an embedded web browser executing on one or more hardware processors of the client device, wherein: the native app is configured to invoke the embedded web browser and the native app is configured to pass the device session token to the embedded web browser for authentication of a web session between the embedded web browser and the common gateway interface that continues the device session without requiring additional authentication; and the embedded web browser is configured to pass the device session token to the common gateway interface and to receive from the common gateway interface a web flow authorization token, converted from the device session token used as the credentials for authenticating the user for the device session between the server and the native app executing on the client device, for authenticating the web session as a continuation of the device session authenticated by the device session token, wherein the web flow authorization token and the device session token both share the same underlying device session and the device session remains active while the web session is active. a client device in communication via a network with a server and a common gateway interface; a native app executing on one or more hardware processors of the client device configured to receive a device session token from the server for authenticating a device session between the native app and the server, the device session token used as credentials authenticating a user for the device session between the server and the native app executing on the client device; and an embedded web browser executing on one or more hardware processors of the client device, wherein: the native app is configured to invoke the embedded web browser and the native app is configured to pass the device session token to the embedded web browser for authentication of a web session between the embedded web browser and the common gateway interface that continues the device session without requiring additional authentication; and the embedded web browser is configured to pass the device session token to the common gateway interface and to receive from the common gateway interface a web flow authorization token, converted from the device session token used as the credentials for authenticating the user for the device session between the server and the native app executing on the client device, for authenticating the web session as a continuation of the device session authenticated by the device session token, wherein the web flow authorization token and the device session token both share the same underlying device session and the device session remains active while the web session is active. the native app is configured to invoke the embedded web browser and the native app is configured to pass the device session token to the embedded web browser for authentication of a web session between the embedded web browser and the common gateway interface that continues the device session without requiring additional authentication; and the embedded web browser is configured to pass the device session token to the common gateway interface and to receive from the common gateway interface a web flow authorization token, converted from the device session token used as the credentials for authenticating the user for the device session between the server and the native app executing on the client device, for authenticating the web session as a continuation of the device session authenticated by the device session token, wherein the web flow authorization token and the device session token both share the same underlying device session and the device session remains active while the web session is active.