Developing Admin Panel for Mobile App Management
Mobile app launched, users registered—and turns out there's no way to block account without direct SQL query, change banner without deploy, or view stats without Excel export. Admin panel is infrastructure typically postponed and later built in a rush.
What Exactly Goes Into Admin Panel for Mobile App
Depends on app type, but typical composition:
- User management: list with search/filtering, profile view, ban/unban, manual verification, action history
- Content management: CRUD for app entities (products, posts, events), user content moderation
- Push notifications: manual send to user segments, templates, send history, delivery stats
- Analytics: DAU/MAU, retention, conversion funnels, technical metrics (crash rate, ANR rate)
- Feature flags: enable/disable features without deploy, A/B-test configuration
- Configuration: app parameters (limits, texts, URLs) without release
Technical Stack and Architecture
Backend API for Admin
Admin panel works with same backend services as mobile app, but through separate endpoint set with broader rights. Important: don't give mobile client admin rights via same token. Admin API—separate authentication (separate OAuth2 client_id or separate service), separate middleware with role checks.
On Laravel—spatie/laravel-permission for roles and permissions. Roles: super_admin, content_moderator, support. Each admin action logged in activity_log (spatie/laravel-activitylog package): who, when, what changed, old and new values. Without this log, analyzing incident is impossible.
On Node.js/NestJS—@nestjs/passport + casl for ABAC (Attribute-Based Access Control). For audit log—middleware writing to separate table or sending events to Kafka/RabbitMQ.
Frontend Admin Panel
Three main paths:
React + headless UI (Tanstack Table, React Hook Form, Shadcn/ui). Maximum flexibility, build ourselves. Suits if non-standard UX requirements or tight integration with existing design system. Tanstack Table for tables with server pagination, sorting, filtering—one of best options available. React Query for request caching and invalidation.
React Admin (marmelab). Quick start—List, Edit, Create, Show components out of box. Good if data is CRUD-like. Starts limiting when non-standard business logic or complex dashboards needed.
Retool / AppSmith (low-code). Development speed maximum, deploys in day. Cons: vendor lock-in, customization limits, paid tiers at scale, some clients against SaaS data placement.
For most mobile products—React + Tanstack Table + React Query + Shadcn/ui. Not a reinvention, not low-code, scales well.
Managing Push Notifications from Panel
Firebase Cloud Messaging integration via Admin SDK. Panel allows selecting user segment (by registration date, platform, activity, custom tags), writing text and title, scheduling send or send immediately.
On backend: FirebaseAdmin.messaging().sendMulticast() for group send (max 500 tokens at once, need batch send for large segments). Or via Firebase Topics for predefined groups. Send result—BatchResponse with successCount and failureCount—save for history.
Important: FCM tokens expire. FirebaseMessagingException with UNREGISTERED code—signal to delete token from database. Do this automatically in send handler.
Feature Flags
Simplest implementation: feature_flags (key, enabled, rollout_percentage, updated_at) table. Mobile app requests flags on start and caches. Panel allows enabling/disabling and configuring rollout percentage.
For complex scenarios—Firebase Remote Config or LaunchDarkly. Remote Config free and sufficient for 90% tasks: panel in Firebase Console, SDK on mobile with fetch() + activate(), minimumFetchInterval in seconds for query frequency control.
Admin Panel Security
- Separate domain or subdomain (
admin.yourapp.com), notyourapp.com/admin - MFA mandatory for all admin accounts
- IP-whitelist if team works from fixed offices
- Rate limiting on all endpoints
- HTTPS only, HSTS
- Sessions with short TTL (8 hours), auto-logout on inactivity
- Content Security Policy headers
Timeline: 1 week to 3 months. Basic CRUD panel with user management and push—1–2 weeks. Full system with analytics, feature flags, complex role model and audit log—1–3 months depending on scope.