You might get some ideas from https://laracasts.com/series/playing-with-php/episodes/5
Basically an app is getting data from an API. However if you required login, then the app stills pulls the data but the app needs credentials to be used.
Also of course look over:
https://laravel.com/docs/9.x/eloquent-resources#main-content
A mobile virus scanner works the same, normally you have a free version, where you can still pull in updates. But for all the features you need to be registered and have proper credentials.
A decent article https://aws.amazon.com/what-is/api/