diff --git a/app/actions/remote/entry/login.ts b/app/actions/remote/entry/login.ts
index f70a30500..a605b92ce 100644
--- a/app/actions/remote/entry/login.ts
+++ b/app/actions/remote/entry/login.ts
@@ -35,7 +35,7 @@ export async function loginEntry({serverUrl}: AfterLoginArgs): Promise<{error?:
         const credentials = await getServerCredentials(serverUrl);
         if (credentials?.token) {
             SecurityManager.addServer(serverUrl, clData.config, true);
-            WebsocketManager.createClient(serverUrl, credentials.token);
+            WebsocketManager.createClient(serverUrl, credentials.token, credentials.preauthSecret);
             await WebsocketManager.initializeClient(serverUrl, 'Login');
             SecurityManager.setActiveServer(serverUrl);
         }
diff --git a/app/actions/remote/general.ts b/app/actions/remote/general.ts
index 92ee79ebe..853f5d0a2 100644
--- a/app/actions/remote/general.ts
+++ b/app/actions/remote/general.ts
@@ -34,10 +34,10 @@ async function getDeviceIdForPing(serverUrl: string, checkDeviceId: boolean) {
 }
 
 // Default timeout interval for ping is 5 seconds
-export const doPing = async (serverUrl: string, verifyPushProxy: boolean, timeoutInterval = 5000) => {
+export const doPing = async (serverUrl: string, verifyPushProxy: boolean, timeoutInterval = 5000, preauthSecret?: string) => {
     let client: Client;
     try {
-        client = await NetworkManager.createClient(serverUrl);
+        client = await NetworkManager.createClient(serverUrl, undefined, preauthSecret);
     } catch (error) {
         return {error};
     }
diff --git a/app/actions/remote/session.test.ts b/app/actions/remote/session.test.ts
index f22013c1a..b36a35511 100644
--- a/app/actions/remote/session.test.ts
+++ b/app/actions/remote/session.test.ts
@@ -46,7 +46,7 @@ const throwFunc = () => {
 const mockClient = {
     login: jest.fn(() => user1),
     setCSRFToken: jest.fn(),
-    setBearerToken: jest.fn(),
+    setClientCredentials: jest.fn(),
     getClientConfigOld: jest.fn(() => ({})),
     getClientLicenseOld: jest.fn(() => ({})),
     getSessions: jest.fn(() => [session1]),
diff --git a/app/actions/remote/session.ts b/app/actions/remote/session.ts
index 8327bdfa5..40d426e13 100644
--- a/app/actions/remote/session.ts
+++ b/app/actions/remote/session.ts
@@ -300,7 +300,7 @@ export const sendPasswordResetEmail = async (serverUrl: string, email: string) =
     }
 };
 
-export const ssoLogin = async (serverUrl: string, serverDisplayName: string, serverIdentifier: string, bearerToken: string, csrfToken: string): Promise<LoginActionResponse> => {
+export const ssoLogin = async (serverUrl: string, serverDisplayName: string, serverIdentifier: string, bearerToken: string, csrfToken: string, preauthSecret?: string): Promise<LoginActionResponse> => {
     const database = DatabaseManager.appDatabase?.database;
     if (!database) {
         return {error: 'App database not found', failed: true};
@@ -309,7 +309,7 @@ export const ssoLogin = async (serverUrl: string, serverDisplayName: string, ser
     try {
         const client = NetworkManager.getClient(serverUrl);
 
-        client.setBearerToken(bearerToken);
+        client.setClientCredentials(bearerToken, preauthSecret);
         client.setCSRFToken(csrfToken);
 
         // Setting up active database for this SSO login flow
diff --git a/app/client/rest/base.ts b/app/client/rest/base.ts
index b3a7ad030..9978e751e 100644
--- a/app/client/rest/base.ts
+++ b/app/client/rest/base.ts
@@ -9,11 +9,11 @@ import ClientTracking from './tracking';
 import type {APIClientInterface} from '@mattermost/react-native-network-client';
 
 export default class ClientBase extends ClientTracking {
-    constructor(apiClient: APIClientInterface, serverUrl: string, bearerToken?: string, csrfToken?: string) {
+    constructor(apiClient: APIClientInterface, serverUrl: string, bearerToken?: string, csrfToken?: string, preauthSecret?: string) {
         super(apiClient);
 
-        if (bearerToken) {
-            this.setBearerToken(bearerToken);
+        if (bearerToken || preauthSecret) {
+            this.setClientCredentials(bearerToken || '', preauthSecret || '');
         }
         if (csrfToken) {
             this.setCSRFToken(csrfToken);
diff --git a/app/client/rest/constants.ts b/app/client/rest/constants.ts
index c02ba7c0c..5aeb125f0 100644
--- a/app/client/rest/constants.ts
+++ b/app/client/rest/constants.ts
@@ -10,6 +10,7 @@ export const HEADER_REQUESTED_WITH = 'X-Requested-With';
 export const HEADER_TOKEN = 'Token';
 export const HEADER_USER_AGENT = 'User-Agent';
 export const HEADER_X_CSRF_TOKEN = 'X-CSRF-Token';
+export const HEADER_X_MATTERMOST_PREAUTH_SECRET = 'X-Mattermost-Preauth-Secret';
 export const HEADER_X_VERSION_ID = 'X-Version-Id';
 export const DEFAULT_LIMIT_BEFORE = 30;
 export const DEFAULT_LIMIT_AFTER = 30;
diff --git a/app/client/rest/index.ts b/app/client/rest/index.ts
index f6929880f..ce3a68252 100644
--- a/app/client/rest/index.ts
+++ b/app/client/rest/index.ts
@@ -78,8 +78,8 @@ class Client extends mix(ClientBase).with(
     ClientPlaybooks,
 ) {
     // eslint-disable-next-line no-useless-constructor
-    constructor(apiClient: APIClientInterface, serverUrl: string, bearerToken?: string, csrfToken?: string) {
-        super(apiClient, serverUrl, bearerToken, csrfToken);
+    constructor(apiClient: APIClientInterface, serverUrl: string, bearerToken?: string, csrfToken?: string, preauthSecret?: string) {
+        super(apiClient, serverUrl, bearerToken, csrfToken, preauthSecret);
     }
 }
 
diff --git a/app/client/rest/tracking.test.ts b/app/client/rest/tracking.test.ts
index 05997da08..280842307 100644
--- a/app/client/rest/tracking.test.ts
+++ b/app/client/rest/tracking.test.ts
@@ -92,10 +92,10 @@ describe('ClientTracking', () => {
 
     it('should set bearer token', () => {
         const token = 'testToken';
-        client.setBearerToken(token);
+        client.setClientCredentials(token);
 
         expect(client.requestHeaders[ClientConstants.HEADER_AUTH]).toBe(`${ClientConstants.HEADER_BEARER} ${token}`);
-        expect(require('@init/credentials').setServerCredentials).toHaveBeenCalledWith(apiClientMock.baseUrl, token);
+        expect(require('@init/credentials').setServerCredentials).toHaveBeenCalledWith(apiClientMock.baseUrl, token, undefined);
     });
 
     it('should set CSRF token', () => {
@@ -107,7 +107,7 @@ describe('ClientTracking', () => {
 
     it('should get request headers', () => {
         client.setCSRFToken('csrfToken');
-        client.setBearerToken('testToken');
+        client.setClientCredentials('testToken');
 
         const headers = client.getRequestHeaders('POST');
         expect(headers[ClientConstants.HEADER_AUTH]).toBe(`${ClientConstants.HEADER_BEARER} testToken`);
@@ -823,5 +823,59 @@ describe('ClientTracking', () => {
             expect(result).toBe(100);
         });
     });
+
+    describe('setClientCredentials', () => {
+        it('should set shared password header when provided', () => {
+            client.setClientCredentials('bearer-token', 'shared-password');
+
+            expect(client.requestHeaders[ClientConstants.HEADER_AUTH]).toBe(`${ClientConstants.HEADER_BEARER} bearer-token`);
+            expect(client.requestHeaders[ClientConstants.HEADER_X_MATTERMOST_PREAUTH_SECRET]).toBe('shared-password');
+        });
+
+        it('should remove shared password header when undefined', () => {
+            // First set a shared password
+            client.setClientCredentials('bearer-token', 'shared-password');
+            expect(client.requestHeaders[ClientConstants.HEADER_X_MATTERMOST_PREAUTH_SECRET]).toBe('shared-password');
+
+            // Then remove it by setting undefined
+            client.setClientCredentials('bearer-token', undefined);
+            expect(client.requestHeaders[ClientConstants.HEADER_X_MATTERMOST_PREAUTH_SECRET]).toBeUndefined();
+        });
+
+        it('should remove shared password header when empty string', () => {
+            // First set a shared password
+            client.setClientCredentials('bearer-token', 'shared-password');
+            expect(client.requestHeaders[ClientConstants.HEADER_X_MATTERMOST_PREAUTH_SECRET]).toBe('shared-password');
+
+            // Then remove it by setting empty string
+            client.setClientCredentials('bearer-token', '');
+            expect(client.requestHeaders[ClientConstants.HEADER_X_MATTERMOST_PREAUTH_SECRET]).toBeUndefined();
+        });
+
+        it('should always set bearer token correctly', () => {
+            client.setClientCredentials('test-bearer', 'shared-password');
+            expect(client.requestHeaders[ClientConstants.HEADER_AUTH]).toBe(`${ClientConstants.HEADER_BEARER} test-bearer`);
+
+            client.setClientCredentials('new-bearer', undefined);
+            expect(client.requestHeaders[ClientConstants.HEADER_AUTH]).toBe(`${ClientConstants.HEADER_BEARER} new-bearer`);
+        });
+
+        it('should handle multiple header updates correctly', () => {
+            // Set initial credentials
+            client.setClientCredentials('bearer1', 'password1');
+            expect(client.requestHeaders[ClientConstants.HEADER_AUTH]).toBe(`${ClientConstants.HEADER_BEARER} bearer1`);
+            expect(client.requestHeaders[ClientConstants.HEADER_X_MATTERMOST_PREAUTH_SECRET]).toBe('password1');
+
+            // Update to new password
+            client.setClientCredentials('bearer2', 'password2');
+            expect(client.requestHeaders[ClientConstants.HEADER_AUTH]).toBe(`${ClientConstants.HEADER_BEARER} bearer2`);
+            expect(client.requestHeaders[ClientConstants.HEADER_X_MATTERMOST_PREAUTH_SECRET]).toBe('password2');
+
+            // Remove password
+            client.setClientCredentials('bearer3', undefined);
+            expect(client.requestHeaders[ClientConstants.HEADER_AUTH]).toBe(`${ClientConstants.HEADER_BEARER} bearer3`);
+            expect(client.requestHeaders[ClientConstants.HEADER_X_MATTERMOST_PREAUTH_SECRET]).toBeUndefined();
+        });
+    });
 });
 /* eslint-enable max-lines */
diff --git a/app/client/rest/tracking.ts b/app/client/rest/tracking.ts
index b0407d0c7..d86486539 100644
--- a/app/client/rest/tracking.ts
+++ b/app/client/rest/tracking.ts
@@ -72,9 +72,17 @@ export default class ClientTracking {
         this.apiClient = apiClient;
     }
 
-    setBearerToken(bearerToken: string) {
+    setClientCredentials(bearerToken: string, preauthSecret?: string) {
         this.requestHeaders[ClientConstants.HEADER_AUTH] = `${ClientConstants.HEADER_BEARER} ${bearerToken}`;
-        setServerCredentials(this.apiClient.baseUrl, bearerToken);
+
+        if (preauthSecret) {
+            this.requestHeaders[ClientConstants.HEADER_X_MATTERMOST_PREAUTH_SECRET] = preauthSecret;
+        } else {
+            // Remove shared password header when undefined
+            delete this.requestHeaders[ClientConstants.HEADER_X_MATTERMOST_PREAUTH_SECRET];
+        }
+
+        setServerCredentials(this.apiClient.baseUrl, bearerToken, preauthSecret);
     }
 
     setCSRFToken(csrfToken: string) {
@@ -412,7 +420,8 @@ export default class ClientTracking {
 
         const bearerToken = headers[ClientConstants.HEADER_TOKEN] || headers[ClientConstants.HEADER_TOKEN.toLowerCase()];
         if (bearerToken) {
-            this.setBearerToken(bearerToken);
+            const existingSharedPassword = this.requestHeaders[ClientConstants.HEADER_X_MATTERMOST_PREAUTH_SECRET];
+            this.setClientCredentials(bearerToken, existingSharedPassword);
         }
 
         if (response.ok) {
diff --git a/app/client/websocket/index.ts b/app/client/websocket/index.ts
index 214fd55e4..7ed730d6b 100644
--- a/app/client/websocket/index.ts
+++ b/app/client/websocket/index.ts
@@ -4,6 +4,7 @@
 import {type ClientHeaders, getOrCreateWebSocketClient, type WebSocketClientInterface, WebSocketReadyState} from '@mattermost/react-native-network-client';
 import {Platform} from 'react-native';
 
+import * as ClientConstants from '@client/rest/constants';
 import {WebsocketEvents} from '@constants';
 import DatabaseManager from '@database/manager';
 import {getConfigValue} from '@queries/servers/system';
@@ -26,6 +27,7 @@ export default class WebSocketClient {
     private connectionTimeout: NodeJS.Timeout | undefined;
     private connectionId = '';
     private token: string;
+    private preauthSecret?: string;
     private stop = false;
     private url = '';
     private serverUrl: string;
@@ -58,9 +60,10 @@ export default class WebSocketClient {
     private closeCallback?: (connectFailCount: number) => void;
     private connectingCallback?: () => void;
 
-    constructor(serverUrl: string, token: string) {
+    constructor(serverUrl: string, token: string, preauthSecret?: string) {
         this.token = token;
         this.serverUrl = serverUrl;
+        this.preauthSecret = preauthSecret;
     }
 
     public async initialize(opts = {}, shouldSkipSync = false) {
@@ -134,6 +137,13 @@ export default class WebSocketClient {
                 // iOS is using he underlying cookieJar
                 headers.Authorization = `Bearer ${this.token}`;
             }
+
+            // Add shared password header if available
+            if (this.preauthSecret) {
+                headers[ClientConstants.HEADER_X_MATTERMOST_PREAUTH_SECRET] = this.preauthSecret;
+                logDebug('WebSocket: Added shared password header for', this.serverUrl);
+            }
+
             const {client} = await getOrCreateWebSocketClient(this.url, {headers, timeoutInterval: WEBSOCKET_TIMEOUT});
 
             // Check again if the client is the same, to avoid race conditions
diff --git a/app/init/credentials.ts b/app/init/credentials.ts
index ed8ed1176..74bb0ce59 100644
--- a/app/init/credentials.ts
+++ b/app/init/credentials.ts
@@ -44,7 +44,7 @@ export const getActiveServerUrl = async () => {
     return serverUrl || undefined;
 };
 
-export const setServerCredentials = (serverUrl: string, token: string) => {
+export const setServerCredentials = (serverUrl: string, token: string, preauthSecret?: string) => {
     if (!(serverUrl && token)) {
         return;
     }
@@ -60,14 +60,29 @@ export const setServerCredentials = (serverUrl: string, token: string) => {
             accessGroup,
             securityLevel: KeyChain.SECURITY_LEVEL.SECURE_SOFTWARE,
         };
+
+        // Store main token credentials (clean format)
         KeyChain.setInternetCredentials(serverUrl, token, token, options);
+
+        // Store preauth secret separately if provided
+        if (preauthSecret) {
+            KeyChain.setGenericPassword('preshared_secret', preauthSecret, {
+                server: serverUrl,
+                ...options,
+            });
+        }
     } catch (e) {
         logWarning('could not set credentials', e);
     }
 };
 
 export const removeServerCredentials = async (serverUrl: string) => {
-    return KeyChain.resetInternetCredentials({server: serverUrl});
+    await KeyChain.resetInternetCredentials({server: serverUrl});
+    try {
+        await KeyChain.resetGenericPassword({server: serverUrl});
+    } catch (e) {
+        // Preauth secret might not exist, ignore errors
+    }
 };
 
 export const removeActiveServerCredentials = async () => {
@@ -79,23 +94,42 @@ export const removeActiveServerCredentials = async () => {
 
 export const getServerCredentials = async (serverUrl: string): Promise<ServerCredential|null> => {
     try {
+        // Get main credentials
         const credentials = await KeyChain.getInternetCredentials(serverUrl);
 
-        if (credentials) {
-            // TODO: Pre-Gekidou we were concatenating the deviceToken and the userId in
-            // credentials.username so we need to check the length of credentials.username.split(',').
-            // This check should be removed at some point. https://mattermost.atlassian.net/browse/MM-43483
-            const parts = credentials.username.split(',');
-            const userId = parts[parts.length - 1];
-
-            const token = credentials.password;
-
-            if (token && token !== 'undefined') {
-                return {serverUrl, userId, token};
-            }
+        if (!credentials) {
+            return null;
         }
 
-        return null;
+        // TODO: Pre-Gekidou we were concatenating the deviceToken and the userId in
+        // credentials.username so we need to check the length of credentials.username.split(',').
+        // This check should be removed at some point. https://mattermost.atlassian.net/browse/MM-43483
+        const parts = credentials.username.split(',');
+        const userId = parts[parts.length - 1];
+        const token = credentials.password;
+
+        if (!token || token === 'undefined') {
+            return null;
+        }
+
+        // Get preauth secret separately
+        let preauthSecret: string | undefined;
+        try {
+            const preauthCredentials = await KeyChain.getGenericPassword({
+                server: serverUrl,
+            });
+            preauthSecret = preauthCredentials ? preauthCredentials.password : undefined;
+        } catch (e) {
+            // Preauth secret is optional, so ignore errors
+            preauthSecret = undefined;
+        }
+
+        return {
+            serverUrl,
+            userId,
+            token,
+            preauthSecret,
+        };
     } catch (e) {
         return null;
     }
diff --git a/app/managers/network_manager.ts b/app/managers/network_manager.ts
index 64b45624f..61dde731d 100644
--- a/app/managers/network_manager.ts
+++ b/app/managers/network_manager.ts
@@ -76,9 +76,9 @@ class NetworkManagerSingleton {
     };
 
     public init = async (serverCredentials: ServerCredential[]) => {
-        for await (const {serverUrl, token} of serverCredentials) {
+        for await (const {serverUrl, token, preauthSecret} of serverCredentials) {
             try {
-                await this.createClient(serverUrl, token);
+                await this.createClient(serverUrl, token, preauthSecret);
             } catch (error) {
                 logError('NetworkManager init error', error);
             }
@@ -99,12 +99,13 @@ class NetworkManagerSingleton {
         return client;
     };
 
-    public createClient = async (serverUrl: string, bearerToken?: string) => {
-        const config = await this.buildConfig();
+    public createClient = async (serverUrl: string, bearerToken?: string, preauthSecret?: string) => {
+        const config = await this.buildConfig(preauthSecret);
+
         try {
             const {client} = await getOrCreateAPIClient(serverUrl, config, this.clientErrorEventHandler);
             const csrfToken = await getCSRFFromCookie(serverUrl);
-            this.clients[serverUrl] = new Client(client, serverUrl, bearerToken, csrfToken);
+            this.clients[serverUrl] = new Client(client, serverUrl, bearerToken, csrfToken, preauthSecret);
         } catch (error) {
             throw new ClientError(serverUrl, {
                 message: 'Can’t find this server. Check spelling and URL format.',
@@ -120,11 +121,12 @@ class NetworkManagerSingleton {
         return this.clients[serverUrl];
     };
 
-    private buildConfig = async () => {
+    private buildConfig = async (preauthSecret?: string) => {
         const userAgent = `Mattermost Mobile/${nativeApplicationVersion}+${nativeBuildVersion} (${osName}; ${osVersion}; ${modelName})`;
         const managedConfig = ManagedApp.enabled ? Emm.getManagedConfig<ManagedConfig>() : undefined;
         const headers: Record<string, string> = {
             [ClientConstants.HEADER_USER_AGENT]: userAgent,
+            ...(preauthSecret ? {[ClientConstants.HEADER_X_MATTERMOST_PREAUTH_SECRET]: preauthSecret} : {}),
             ...this.DEFAULT_CONFIG.headers,
         };
 
diff --git a/app/managers/websocket_manager.test.ts b/app/managers/websocket_manager.test.ts
index 22e8005f3..3c5938e86 100644
--- a/app/managers/websocket_manager.test.ts
+++ b/app/managers/websocket_manager.test.ts
@@ -90,7 +90,7 @@ describe('WebsocketManager', () => {
             await manager.init(mockCredentials);
 
             expect(NetInfo.fetch).toHaveBeenCalled();
-            expect(WebSocketClient).toHaveBeenCalledWith(mockServerUrl, mockToken);
+            expect(WebSocketClient).toHaveBeenCalledWith(mockServerUrl, mockToken, undefined);
             expect(NetInfo.addEventListener).toHaveBeenCalled();
         });
 
diff --git a/app/managers/websocket_manager.ts b/app/managers/websocket_manager.ts
index 7f8738fde..d0736fdf4 100644
--- a/app/managers/websocket_manager.ts
+++ b/app/managers/websocket_manager.ts
@@ -48,10 +48,10 @@ class WebsocketManagerSingleton {
         this.netConnected = Boolean(netInfo.isConnected);
         this.netType = netInfo.type;
         serverCredentials.forEach(
-            ({serverUrl, token}) => {
+            ({serverUrl, token, preauthSecret}) => {
                 try {
                     DatabaseManager.getServerDatabaseAndOperator(serverUrl);
-                    this.createClient(serverUrl, token);
+                    this.createClient(serverUrl, token, preauthSecret);
                 } catch (error) {
                     logError('WebsocketManager init error', error);
                 }
@@ -80,12 +80,12 @@ class WebsocketManagerSingleton {
         this.getConnectedSubject(serverUrl).next('not_connected');
     };
 
-    public createClient = (serverUrl: string, bearerToken: string) => {
+    public createClient = (serverUrl: string, bearerToken: string, preauthSecret?: string) => {
         if (this.clients[serverUrl]) {
             this.invalidateClient(serverUrl);
         }
 
-        const client = new WebSocketClient(serverUrl, bearerToken);
+        const client = new WebSocketClient(serverUrl, bearerToken, preauthSecret);
 
         client.setFirstConnectCallback(() => this.onFirstConnect(serverUrl));
         client.setEventCallback((evt: WebSocketMessage) => handleWebSocketEvent(serverUrl, evt));
diff --git a/app/screens/login/sso_options.tsx b/app/screens/login/sso_options.tsx
index 37f3fd4b2..6039b66c7 100644
--- a/app/screens/login/sso_options.tsx
+++ b/app/screens/login/sso_options.tsx
@@ -69,7 +69,10 @@ const SsoOptions = ({goToSso, ssoOnly, ssoOptions, theme}: Props) => {
         };
 
         componentArray.push(
-            <View style={styleButtonWrapper}>
+            <View
+                style={styleButtonWrapper}
+                key={ssoType}
+            >
                 <Button
                     key={ssoType}
                     onPress={handlePress}
diff --git a/app/screens/server/form.tsx b/app/screens/server/form.tsx
index 629258627..b9d4da6f5 100644
--- a/app/screens/server/form.tsx
+++ b/app/screens/server/form.tsx
@@ -1,11 +1,12 @@
 // Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
 // See LICENSE.txt for license information.
 
-import React, {type RefObject, useCallback, useRef} from 'react';
+import React, {type RefObject, useCallback, useRef, useState} from 'react';
 import {defineMessages, useIntl} from 'react-intl';
-import {Keyboard, View} from 'react-native';
+import {Keyboard, Pressable, View} from 'react-native';
 
 import Button from '@components/button';
+import CompassIcon from '@components/compass_icon';
 import FloatingTextInput, {type FloatingTextInputRef} from '@components/floating_text_input_label';
 import FormattedText from '@components/formatted_text';
 import {useAvoidKeyboard} from '@hooks/device';
@@ -23,8 +24,10 @@ type Props = {
     disableServerUrl: boolean;
     handleConnect: () => void;
     handleDisplayNameTextChanged: (text: string) => void;
+    handlePreauthSecretTextChanged: (text: string) => void;
     handleUrlTextChanged: (text: string) => void;
     keyboardAwareRef: RefObject<KeyboardAwareScrollView>;
+    preauthSecret?: string;
     theme: Theme;
     url?: string;
     urlError?: string;
@@ -49,6 +52,24 @@ const getStyleSheet = makeStyleSheetFromTheme((theme: Theme) => ({
         marginTop: 8,
         ...typography('Body', 75, 'Regular'),
     },
+    advancedOptionsContainer: {
+        width: '100%',
+        marginTop: 16,
+    },
+    advancedOptionsHeader: {
+        flexDirection: 'row',
+        alignItems: 'center',
+        justifyContent: 'flex-start',
+        paddingVertical: 12,
+        paddingHorizontal: 4,
+    },
+    advancedOptionsTitle: {
+        color: theme.linkColor,
+        ...typography('Body', 75, 'SemiBold'),
+    },
+    advancedOptionsContent: {
+        width: '100%',
+    },
     connectButtonContainer: {
         width: '100%',
         marginTop: 32,
@@ -66,6 +87,18 @@ const messages = defineMessages({
         id: 'mobile.components.select_server_view.connecting',
         defaultMessage: 'Connecting',
     },
+    advancedOptions: {
+        id: 'mobile.components.select_server_view.advancedOptions',
+        defaultMessage: 'Advanced Options',
+    },
+    preauthSecret: {
+        id: 'mobile.components.select_server_view.sharedSecret',
+        defaultMessage: 'Pre-authentication secret',
+    },
+    preauthSecretHelp: {
+        id: 'mobile.components.select_server_view.sharedSecretHelp',
+        defaultMessage: 'The pre-authentication secret shared by the administrator',
+    },
 });
 
 const ServerForm = ({
@@ -77,17 +110,22 @@ const ServerForm = ({
     disableServerUrl,
     handleConnect,
     handleDisplayNameTextChanged,
+    handlePreauthSecretTextChanged,
     handleUrlTextChanged,
     keyboardAwareRef,
+    preauthSecret = '',
     theme,
     url = '',
     urlError,
 }: Props) => {
     const {formatMessage} = useIntl();
     const displayNameRef = useRef<FloatingTextInputRef>(null);
+    const preauthSecretRef = useRef<FloatingTextInputRef>(null);
     const urlRef = useRef<FloatingTextInputRef>(null);
     const styles = getStyleSheet(theme);
 
+    const [showAdvancedOptions, setShowAdvancedOptions] = useState(false);
+
     useAvoidKeyboard(keyboardAwareRef);
 
     const onConnect = useCallback(() => {
@@ -99,6 +137,18 @@ const ServerForm = ({
         displayNameRef.current?.focus();
     }, []);
 
+    const onDisplayNameSubmit = useCallback(() => {
+        if (showAdvancedOptions) {
+            preauthSecretRef.current?.focus();
+        } else {
+            onConnect();
+        }
+    }, [showAdvancedOptions, onConnect]);
+
+    const toggleAdvancedOptions = useCallback(() => {
+        setShowAdvancedOptions(!showAdvancedOptions);
+    }, [showAdvancedOptions]);
+
     const connectButtonTestId = buttonDisabled ? 'server_form.connect.button.disabled' : 'server_form.connect.button';
 
     return (
@@ -108,7 +158,6 @@ const ServerForm = ({
                     autoCorrect={false}
                     autoCapitalize={'none'}
                     autoFocus={autoFocus}
-                    blurOnSubmit={false}
                     containerStyle={styles.enterServer}
                     enablesReturnKeyAutomatically={true}
                     editable={!disableServerUrl}
@@ -139,15 +188,16 @@ const ServerForm = ({
                         defaultMessage: 'Display Name',
                     })}
                     onChangeText={handleDisplayNameTextChanged}
-                    onSubmitEditing={onConnect}
+                    onSubmitEditing={onDisplayNameSubmit}
                     ref={displayNameRef}
-                    returnKeyType='done'
+                    returnKeyType={showAdvancedOptions ? 'next' : 'done'}
                     spellCheck={false}
                     testID='server_form.server_display_name.input'
                     theme={theme}
                     value={displayName}
                 />
             </View>
+
             {!displayNameError &&
             <FormattedText
                 defaultMessage={'Choose a display name for your server'}
@@ -156,6 +206,51 @@ const ServerForm = ({
                 testID={'server_form.display_help'}
             />
             }
+
+            <View style={styles.advancedOptionsContainer}>
+                <Pressable
+                    onPress={toggleAdvancedOptions}
+                    style={styles.advancedOptionsHeader}
+                    testID='server_form.advanced_options.toggle'
+                >
+                    <CompassIcon
+                        name={showAdvancedOptions ? 'chevron-up' : 'chevron-down'}
+                        size={20}
+                        style={styles.advancedOptionsTitle}
+                    />
+                    <FormattedText
+                        defaultMessage='Advanced Options'
+                        id='mobile.components.select_server_view.advancedOptions'
+                        style={styles.advancedOptionsTitle}
+                    />
+                </Pressable>
+
+                {showAdvancedOptions && (
+                    <View style={styles.advancedOptionsContent}>
+                        <FloatingTextInput
+                            autoCorrect={false}
+                            autoCapitalize={'none'}
+                            enablesReturnKeyAutomatically={true}
+                            label={formatMessage(messages.preauthSecret)}
+                            onChangeText={handlePreauthSecretTextChanged}
+                            onSubmitEditing={onConnect}
+                            ref={preauthSecretRef}
+                            returnKeyType='done'
+                            secureTextEntry={true}
+                            spellCheck={false}
+                            testID='server_form.preauth_secret.input'
+                            theme={theme}
+                            value={preauthSecret}
+                        />
+                        <FormattedText
+                            {...messages.preauthSecretHelp}
+                            style={styles.chooseText}
+                            testID='server_form.preauth_secret_help'
+                        />
+                    </View>
+                )}
+            </View>
+
             <View style={styles.connectButtonContainer}>
                 <Button
                     disabled={buttonDisabled}
diff --git a/app/screens/server/index.tsx b/app/screens/server/index.tsx
index 5815579d5..da9557b01 100644
--- a/app/screens/server/index.tsx
+++ b/app/screens/server/index.tsx
@@ -55,12 +55,17 @@ const getStyleSheet = makeStyleSheetFromTheme((theme: Theme) => ({
     appInfo: {
         color: changeOpacity(theme.centerChannelColor, 0.56),
     },
+    appVersionContainer: {
+        alignItems: 'center',
+        paddingHorizontal: 20,
+        marginTop: 24,
+    },
     flex: {
         flex: 1,
     },
     scrollContainer: {
         alignItems: 'center',
-        height: '90%',
+        flexGrow: 1,
         justifyContent: 'center',
     },
 }));
@@ -85,6 +90,7 @@ const Server = ({
     const [connecting, setConnecting] = useState(false);
     const [displayName, setDisplayName] = useState<string>('');
     const [buttonDisabled, setButtonDisabled] = useState(true);
+    const [preauthSecret, setPreauthSecret] = useState<string>('');
     const [url, setUrl] = useState<string>('');
     const [displayNameError, setDisplayNameError] = useState<string | undefined>();
     const [urlError, setUrlError] = useState<string | undefined>();
@@ -191,6 +197,7 @@ const Server = ({
             launchType,
             license,
             serverDisplayName: displayName,
+            serverPreauthSecret: preauthSecret.trim() || undefined,
             serverUrl,
             ssoOptions,
             theme,
@@ -268,6 +275,10 @@ const Server = ({
         setUrl(text);
     }, []);
 
+    const handlePreauthSecretTextChanged = useCallback((text: string) => {
+        setPreauthSecret(text);
+    }, []);
+
     const isServerUrlValid = (serverUrl?: string) => {
         const testUrl = sanitizeUrl(serverUrl ?? url);
         if (!isValidUrl(testUrl)) {
@@ -289,7 +300,7 @@ const Server = ({
             cancelPing = undefined;
         };
 
-        const ping = await getServerUrlAfterRedirect(pingUrl, !retryWithHttp);
+        const ping = await getServerUrlAfterRedirect(pingUrl, !retryWithHttp, preauthSecret.trim() || undefined);
         if (!ping.url) {
             cancelPing();
             if (retryWithHttp) {
@@ -302,7 +313,7 @@ const Server = ({
             }
             return;
         }
-        const result = await doPing(ping.url, true, managedConfig?.timeout ? parseInt(managedConfig?.timeout, 10) : undefined);
+        const result = await doPing(ping.url, true, managedConfig?.timeout ? parseInt(managedConfig?.timeout, 10) : undefined, preauthSecret.trim() || undefined);
 
         if (canceled) {
             return;
@@ -402,14 +413,21 @@ const Server = ({
                         disableServerUrl={disableServerUrl}
                         handleConnect={handleConnect}
                         handleDisplayNameTextChanged={handleDisplayNameTextChanged}
+                        handlePreauthSecretTextChanged={handlePreauthSecretTextChanged}
                         handleUrlTextChanged={handleUrlTextChanged}
                         keyboardAwareRef={keyboardAwareRef}
+                        preauthSecret={preauthSecret}
                         theme={theme}
                         url={url}
                         urlError={urlError}
                     />
+                    <View style={styles.appVersionContainer}>
+                        <AppVersion
+                            textStyle={styles.appInfo}
+                            isWrapped={false}
+                        />
+                    </View>
                 </KeyboardAwareScrollView>
-                <AppVersion textStyle={styles.appInfo}/>
             </AnimatedSafeArea>
         </View>
     );
diff --git a/app/screens/sso/index.tsx b/app/screens/sso/index.tsx
index 431a9d845..7968ca540 100644
--- a/app/screens/sso/index.tsx
+++ b/app/screens/sso/index.tsx
@@ -31,6 +31,7 @@ interface SSOProps extends LaunchProps {
     license: Partial<ClientLicense>;
     ssoType: string;
     serverDisplayName: string;
+    serverPreauthSecret?: string;
     theme: Theme;
 }
 
@@ -45,7 +46,7 @@ const styles = StyleSheet.create({
 const SSO = ({
     closeButtonId, componentId, config, extra,
     launchError, launchType, serverDisplayName,
-    serverUrl, ssoType, theme,
+    serverPreauthSecret, serverUrl, ssoType, theme,
 }: SSOProps) => {
     const [loginError, setLoginError] = useState<string>('');
     let loginUrl = '';
@@ -89,7 +90,7 @@ const SSO = ({
     };
 
     const doSSOLogin = async (bearerToken: string, csrfToken: string) => {
-        const result: LoginActionResponse = await ssoLogin(serverUrl!, serverDisplayName, config.DiagnosticId!, bearerToken, csrfToken);
+        const result: LoginActionResponse = await ssoLogin(serverUrl!, serverDisplayName, config.DiagnosticId!, bearerToken, csrfToken, serverPreauthSecret);
         if (result?.error && result.failed) {
             onLoadEndError(result.error);
             return;
diff --git a/app/utils/url/index.ts b/app/utils/url/index.ts
index 38e5f0fac..018ee6b8d 100644
--- a/app/utils/url/index.ts
+++ b/app/utils/url/index.ts
@@ -5,6 +5,7 @@ import GenericClient from '@mattermost/react-native-network-client';
 import {Linking} from 'react-native';
 import urlParse from 'url-parse';
 
+import * as ClientConstants from '@client/rest/constants';
 import {Files} from '@constants';
 import {emptyFunction} from '@utils/general';
 import {logDebug} from '@utils/log';
@@ -58,11 +59,17 @@ export async function getUrlAfterRedirect(url: string, useHttp = false) {
     }
 }
 
-export async function getServerUrlAfterRedirect(serverUrl: string, useHttp = false) {
+export async function getServerUrlAfterRedirect(serverUrl: string, useHttp = false, preauthSecret?: string) {
     let url = sanitizeUrl(serverUrl, useHttp);
 
+    const headers = {
+        ...(preauthSecret) ? {[ClientConstants.HEADER_X_MATTERMOST_PREAUTH_SECRET]: preauthSecret} : {},
+    };
+
     try {
-        const resp = await GenericClient.head(url);
+        const resp = await GenericClient.head(url, {
+            headers,
+        });
         if (resp.redirectUrls?.length) {
             url = resp.redirectUrls[resp.redirectUrls.length - 1];
         }
diff --git a/assets/base/i18n/en.json b/assets/base/i18n/en.json
index 5f962ce92..df1c23476 100644
--- a/assets/base/i18n/en.json
+++ b/assets/base/i18n/en.json
@@ -622,6 +622,7 @@
   "mobile.channel_list.recent": "Recent",
   "mobile.channel_list.unreads": "Unreads",
   "mobile.commands.error_title": "Error Executing Command",
+  "mobile.components.select_server_view.advancedOptions": "Advanced Options",
   "mobile.components.select_server_view.connect": "Connect",
   "mobile.components.select_server_view.connecting": "Connecting",
   "mobile.components.select_server_view.displayHelp": "Choose a display name for your server",
@@ -631,6 +632,8 @@
   "mobile.components.select_server_view.msg_description": "A server is your team's communication hub accessed using a unique URL",
   "mobile.components.select_server_view.msg_welcome": "Welcome",
   "mobile.components.select_server_view.proceed": "Proceed",
+  "mobile.components.select_server_view.sharedSecret": "Pre-authentication secret",
+  "mobile.components.select_server_view.sharedSecretHelp": "The pre-authentication secret shared by the administrator",
   "mobile.create_channel": "Create",
   "mobile.create_channel.title": "New channel",
   "mobile.create_direct_message.max_limit_reached": "Group messages are limited to {maxCount} members",
diff --git a/detox/e2e/support/ui/screen/server.ts b/detox/e2e/support/ui/screen/server.ts
index 8ad390f7d..3ce8a7108 100644
--- a/detox/e2e/support/ui/screen/server.ts
+++ b/detox/e2e/support/ui/screen/server.ts
@@ -20,6 +20,9 @@ class ServerScreen {
         displayHelp: 'server_form.display_help',
         connectButton: 'server_form.connect.button',
         connectButtonDisabled: 'server_form.connect.button.disabled',
+        advancedOptionsToggle: 'server_form.advanced_options.toggle',
+        preauthSecretInput: 'server_form.preauth_secret.input',
+        preauthSecretHelp: 'server_form.preauth_secret_help',
         usernameInput: 'login_form.username.input',
         usernameInputError: 'login_form.username.input.error',
     };
@@ -37,6 +40,9 @@ class ServerScreen {
     displayHelp = element(by.id(this.testID.displayHelp));
     connectButton = element(by.id(this.testID.connectButton));
     connectButtonDisabled = element(by.id(this.testID.connectButtonDisabled));
+    advancedOptionsToggle = element(by.id(this.testID.advancedOptionsToggle));
+    preauthSecretInput = element(by.id(this.testID.preauthSecretInput));
+    preauthSecretHelp = element(by.id(this.testID.preauthSecretHelp));
     usernameInput = element(by.id(this.testID.usernameInput));
 
     toBeVisible = async () => {
@@ -78,6 +84,47 @@ class ServerScreen {
         await this.connectButton.tap();
         await wait(timeouts.ONE_SEC);
     };
+
+    toggleAdvancedOptions = async () => {
+        await this.advancedOptionsToggle.tap();
+        await wait(timeouts.ONE_SEC);
+    };
+
+    enterPreauthSecret = async (secret: string) => {
+        await waitFor(this.preauthSecretInput).toBeVisible().withTimeout(timeouts.TEN_SEC);
+        await this.preauthSecretInput.replaceText(secret);
+    };
+
+    connectToServerWithPreauthSecret = async (serverUrl: string, serverDisplayName: string, preauthSecret: string) => {
+        await this.toBeVisible();
+        await this.serverUrlInput.replaceText(serverUrl);
+        await this.serverDisplayNameInput.replaceText(serverDisplayName);
+
+        // Toggle advanced options to show preauth secret field
+        await this.toggleAdvancedOptions();
+
+        // Enter preauth secret
+        await this.enterPreauthSecret(preauthSecret);
+
+        // Connect
+        if (isAndroid()) {
+            await this.tapConnectButton();
+        }
+        if (isIos()) {
+            await this.tapConnectButton();
+            if (serverUrl.includes('127.0.0.1') || !process.env.CI) {
+                try {
+                    // # Tap alert okay button
+                    await waitFor(Alert.okayButton).toExist().withTimeout(timeouts.TEN_SEC);
+                    await Alert.okayButton.tap();
+                } catch (error) {
+                    /* eslint-disable no-console */
+                    console.log('Alert button did not appear!');
+                }
+            }
+        }
+        await waitFor(this.usernameInput).toExist().withTimeout(isAndroid()? timeouts.ONE_MIN : timeouts.HALF_MIN);
+    };
 }
 
 const serverScreen = new ServerScreen();
diff --git a/detox/e2e/test/server_login/preauth_secret_connection.e2e.ts b/detox/e2e/test/server_login/preauth_secret_connection.e2e.ts
new file mode 100644
index 000000000..6beb8e7fb
--- /dev/null
+++ b/detox/e2e/test/server_login/preauth_secret_connection.e2e.ts
@@ -0,0 +1,105 @@
+// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
+// See LICENSE.txt for license information.
+
+// *******************************************************************
+// - [#] indicates a test step (e.g. # Go to a screen)
+// - [*] indicates an assertion (e.g. * Check the title)
+// - Use element testID when selecting an element. Create one if none.
+// *******************************************************************
+
+import {serverOneUrl} from '@support/test_config';
+import {
+    LoginScreen,
+    ServerScreen,
+} from '@support/ui/screen';
+import {expect} from 'detox';
+
+describe('Server Login - Preauth Secret Connection', () => {
+    const {
+        serverUrlInput,
+        serverDisplayNameInput,
+        advancedOptionsToggle,
+        preauthSecretInput,
+        preauthSecretHelp,
+    } = ServerScreen;
+
+    beforeEach(async () => {
+        // * Verify on server screen
+        await ServerScreen.toBeVisible();
+
+        // # FORCE advanced options to be CLOSED (clean state)
+        try {
+            await waitFor(preauthSecretInput).toBeVisible().withTimeout(500);
+            await ServerScreen.toggleAdvancedOptions(); // Close them
+        } catch (error) {
+            // Preauth field not visible, advanced options already closed - good!
+        }
+
+        // # Clear all fields
+        await expect(serverUrlInput).toBeVisible();
+        await expect(serverDisplayNameInput).toBeVisible();
+        await serverUrlInput.clearText();
+        await serverDisplayNameInput.clearText();
+    });
+
+    afterEach(async () => {
+        // # Navigate back to server screen if we ended up on login screen
+        try {
+            await LoginScreen.toBeVisible();
+            await LoginScreen.back();
+            await ServerScreen.toBeVisible();
+        } catch (error) {
+            // Not on login screen, no need to navigate back
+        }
+    });
+
+    it('MM-T5000_1 - should toggle advanced options and verify preauth secret field styling', async () => {
+        // * Verify advanced options toggle is visible with correct text
+        await expect(advancedOptionsToggle).toBeVisible();
+        await expect(element(by.text('Advanced Options'))).toBeVisible();
+
+        // * Verify preauth secret field is initially hidden
+        await expect(preauthSecretInput).not.toBeVisible();
+        await expect(preauthSecretHelp).not.toBeVisible();
+
+        // # Toggle advanced options to show fields
+        await ServerScreen.toggleAdvancedOptions();
+
+        // * Verify preauth secret field is now visible with correct text and styling
+        await expect(preauthSecretInput).toBeVisible();
+        await expect(preauthSecretHelp).toBeVisible();
+        await expect(element(by.text('Pre-authentication secret'))).toBeVisible();
+        await expect(preauthSecretHelp).toHaveText('The pre-authentication secret shared by the administrator');
+
+        // # Toggle advanced options again to hide
+        await ServerScreen.toggleAdvancedOptions();
+
+        // * Verify preauth secret field is hidden again
+        await expect(preauthSecretInput).not.toBeVisible();
+        await expect(preauthSecretHelp).not.toBeVisible();
+    });
+
+    it('MM-T5000_2 - should connect to server with preauth secret and verify storage', async () => {
+        const testPreauthSecret = 'test-secret-123';
+        const serverDisplayName = 'Test Server with Preauth';
+
+        // # Connect to server using the dedicated method with preauth secret
+        await ServerScreen.connectToServerWithPreauthSecret(serverOneUrl, serverDisplayName, testPreauthSecret);
+
+        // * Verify successful connection to login screen
+        await LoginScreen.toBeVisible();
+
+        // TODO: Add verification that preauth secret is stored in keychain
+        // This would require keychain testing utilities or verification through subsequent network requests
+    });
+
+    it('MM-T5000_3 - should connect to server without preauth secret', async () => {
+        const serverDisplayName = 'Server without Preauth';
+
+        // # Connect to server using the standard method (no preauth secret)
+        await ServerScreen.connectToServer(serverOneUrl, serverDisplayName);
+
+        // * Verify successful connection to login screen
+        await LoginScreen.toBeVisible();
+    });
+});
diff --git a/ios/Gekidou/Sources/Gekidou/Constants.swift b/ios/Gekidou/Sources/Gekidou/Constants.swift
new file mode 100644
index 000000000..80bf2741d
--- /dev/null
+++ b/ios/Gekidou/Sources/Gekidou/Constants.swift
@@ -0,0 +1,12 @@
+//
+//  Constants.swift
+//  Gekidou
+//
+//  Created by Claude on 21/08/25.
+//
+
+import Foundation
+
+public struct GekidouConstants {
+    public static let HEADER_X_MATTERMOST_PREAUTH_SECRET = "X-Mattermost-Preauth-Secret"
+}
\ No newline at end of file
diff --git a/ios/Gekidou/Sources/Gekidou/Keychain.swift b/ios/Gekidou/Sources/Gekidou/Keychain.swift
index fb02612aa..8642d246a 100644
--- a/ios/Gekidou/Sources/Gekidou/Keychain.swift
+++ b/ios/Gekidou/Sources/Gekidou/Keychain.swift
@@ -7,6 +7,11 @@
 
 import Foundation
 
+public struct ServerCredentials {
+    public let token: String?
+    public let preauthSecret: String?
+}
+
 enum KeychainError: Error {
     case CertificateForIdentityNotFound
     case IdentityNotFound
@@ -27,7 +32,7 @@ extension KeychainError: LocalizedError {
         case .FailedSecItemCopyMatching(status: let status): return status
         }
     }
-    
+
     var errorDescription: String? {
         switch self {
         case .CertificateForIdentityNotFound:
@@ -48,7 +53,7 @@ extension KeychainError: LocalizedError {
 
 public class Keychain: NSObject {
     @objc public static let `default` = Keychain()
-    
+
     public func getClientIdentityAndCertificate(for host: String) throws -> (SecIdentity, SecCertificate)? {
         let query = try buildIdentityQuery(for: host)
 
@@ -61,7 +66,7 @@ public class Keychain: NSObject {
 
             throw KeychainError.FailedSecItemCopyMatching(identityStatus)
         }
-        
+
         let identity = result as! SecIdentity
         var certificate: SecCertificate?
         let certificateStatus = SecIdentityCopyCertificate(identity, &certificate)
@@ -71,19 +76,31 @@ public class Keychain: NSObject {
         guard certificate != nil else {
             throw KeychainError.CertificateForIdentityNotFound
         }
-        
+
         return (identity, certificate!)
     }
-    
-    @objc public func getTokenObjc(for serverUrl: String) -> String? {
-        return try? getToken(for: serverUrl)
+
+    @objc public func getCredentialsObjc(for serverUrl: String) -> NSDictionary? {
+        guard let credentials = try? getCredentials(for: serverUrl) else { return nil }
+        return [
+            "token": credentials.token as Any,
+            "preauthSecret": credentials.preauthSecret as Any
+        ]
     }
-    
-    public func getToken(for serverUrl: String) throws -> String? {
+
+    public func getCredentials(for serverUrl: String) throws -> ServerCredentials? {
+        // Get main token from serverUrl key
+        let token = try getMainToken(for: serverUrl)
+        let preauthSecret = try? getPreauthSecret(for: serverUrl)
+
+        return ServerCredentials(token: token, preauthSecret: preauthSecret)
+    }
+
+    private func getMainToken(for serverUrl: String) throws -> String? {
         var attributes = try buildTokenAttributes(for: serverUrl)
         attributes[kSecMatchLimit] = kSecMatchLimitOne
         attributes[kSecReturnData] = kCFBooleanTrue
-        
+
         var result: AnyObject?
         let status = SecItemCopyMatching(attributes as CFDictionary, &result)
         let data = result as? Data
@@ -91,15 +108,31 @@ public class Keychain: NSObject {
             let token = String(data: data!, encoding: .utf8)
             return token
         }
-        
+
         return nil
     }
-    
+
+    private func getPreauthSecret(for serverUrl: String) throws -> String? {
+        var attributes = try buildGenericPasswordAttributes(for: serverUrl, account: "preshared_secret")
+        attributes[kSecMatchLimit] = kSecMatchLimitOne
+        attributes[kSecReturnData] = kCFBooleanTrue
+
+        var result: AnyObject?
+        let status = SecItemCopyMatching(attributes as CFDictionary, &result)
+        let data = result as? Data
+        if status == errSecSuccess && data != nil {
+            let preauthSecret = String(data: data!, encoding: .utf8)
+            return preauthSecret
+        }
+
+        return nil
+    }
+
     private func buildIdentityQuery(for host: String) throws -> [CFString: Any] {
         guard let hostData = host.data(using: .utf8) else {
             throw KeychainError.InvalidHost(host)
         }
-        
+
         let query: [CFString:Any] = [
             kSecClass: kSecClassIdentity,
             kSecAttrLabel: hostData,
@@ -108,12 +141,12 @@ public class Keychain: NSObject {
 
         return query
     }
-    
+
     private func buildTokenAttributes(for serverUrl: String) throws -> [CFString: Any] {
         guard let serverUrlData = serverUrl.data(using: .utf8) else {
             throw KeychainError.InvalidServerUrl(serverUrl)
         }
-        
+
         var attributes: [CFString: Any] = [
             kSecClass: kSecClassInternetPassword,
             kSecAttrServer: serverUrlData
@@ -122,7 +155,29 @@ public class Keychain: NSObject {
         if let accessGroup = Bundle.main.object(forInfoDictionaryKey: "AppGroupIdentifier") as! String? {
             attributes[kSecAttrAccessGroup] = accessGroup
         }
-        
+
+        return attributes
+    }
+
+    private func buildGenericPasswordAttributes(for service: String, account: String) throws -> [CFString: Any] {
+        guard let serviceData = service.data(using: .utf8) else {
+            throw KeychainError.InvalidServerUrl(service)
+        }
+
+        guard let accountData = account.data(using: .utf8) else {
+            throw KeychainError.InvalidServerUrl(account)
+        }
+
+        var attributes: [CFString: Any] = [
+            kSecClass: kSecClassGenericPassword,
+            kSecAttrService: serviceData,
+            kSecAttrAccount: accountData
+        ]
+
+        if let accessGroup = Bundle.main.object(forInfoDictionaryKey: "AppGroupIdentifier") as! String? {
+            attributes[kSecAttrAccessGroup] = accessGroup
+        }
+
         return attributes
     }
 }
diff --git a/ios/Gekidou/Sources/Gekidou/Networking/Network.swift b/ios/Gekidou/Sources/Gekidou/Networking/Network.swift
index 327607625..a59aaedd6 100644
--- a/ios/Gekidou/Sources/Gekidou/Networking/Network.swift
+++ b/ios/Gekidou/Sources/Gekidou/Networking/Network.swift
@@ -94,8 +94,13 @@ public class Network: NSObject {
             }
         }
         
-        if let token = try? Keychain.default.getToken(for: serverUrl) {
-            request.addValue("Bearer \(token)", forHTTPHeaderField: "Authorization")
+        if let credentials = try? Keychain.default.getCredentials(for: serverUrl) {
+            if let token = credentials.token {
+                request.addValue("Bearer \(token)", forHTTPHeaderField: "Authorization")
+            }
+            if let preauthSecret = credentials.preauthSecret {
+                request.addValue(preauthSecret, forHTTPHeaderField: GekidouConstants.HEADER_X_MATTERMOST_PREAUTH_SECRET)
+            }
         }
         
         return request as URLRequest
diff --git a/ios/Gekidou/Sources/Gekidou/Networking/ShareExtension+Post.swift b/ios/Gekidou/Sources/Gekidou/Networking/ShareExtension+Post.swift
index 8e548b410..f2f5f11b7 100644
--- a/ios/Gekidou/Sources/Gekidou/Networking/ShareExtension+Post.swift
+++ b/ios/Gekidou/Sources/Gekidou/Networking/ShareExtension+Post.swift
@@ -1,6 +1,6 @@
 //
 //  File.swift
-//  
+//
 //
 //  Created by Elias Nahum on 26-06-22.
 //
@@ -12,14 +12,15 @@ extension ShareExtension {
     public func uploadFiles(serverUrl: String, channelId: String, message: String,
                             files: [String], completionHandler: @escaping () -> Void) -> String? {
         let id = "mattermost-share-upload-\(UUID().uuidString)"
-        
+
         createUploadSessionData(
             id: id, serverUrl: serverUrl,
             channelId: channelId, message: message,
             files: files
         )
-        
-        guard let token = try? Keychain.default.getToken(for: serverUrl) else {return "Could not retrieve the session token from the KeyChain"}
+
+        guard let credentials = try? Keychain.default.getCredentials(for: serverUrl),
+              let token = credentials.token else {return "Could not retrieve the session token from the KeyChain"}
 
         if !files.isEmpty {
             createBackroundSession(id: id)
@@ -31,15 +32,19 @@ extension ShareExtension {
             )
             for file in files {
                 if let fileUrl = URL(string: file),
-                   fileUrl.isFileURL {
+                    fileUrl.isFileURL {
                     let filename = fileUrl.lastPathComponent
                     let safeFilename = filename.addingPercentEncoding(withAllowedCharacters: .urlQueryAllowed)
                     if let safeFilename = safeFilename,
-                       let url = URL(string: "\(serverUrl)/api/v4/files?channel_id=\(channelId)&filename=\(safeFilename)") {
+                        let url = URL(string: "\(serverUrl)/api/v4/files?channel_id=\(channelId)&filename=\(safeFilename)") {
                         var uploadRequest = URLRequest(url: url)
                         uploadRequest.httpMethod = "POST"
                         uploadRequest.addValue("Bearer \(token)", forHTTPHeaderField: "Authorization")
 
+                        if let preauthSecret = credentials.preauthSecret {
+                            uploadRequest.addValue(preauthSecret, forHTTPHeaderField: GekidouConstants.HEADER_X_MATTERMOST_PREAUTH_SECRET)
+                        }
+
                         if let task = backgroundSession?.uploadTask(with: uploadRequest, fromFile: fileUrl) {
                             os_log(
                                 OSLogType.default,
@@ -85,10 +90,10 @@ extension ShareExtension {
             )
             self.postMessageForSession(withId: id, completionHandler: completionHandler)
         }
-        
+
         return nil
     }
-    
+
     func postMessageForSession(withId id: String, completionHandler: (() -> Void)? = nil) {
         guard let data = getUploadSessionData(id: id)
         else {
@@ -99,12 +104,12 @@ extension ShareExtension {
             )
             return
         }
-        
+
         self.removeUploadSessionData(id: id)
         self.deleteUploadedFiles(files: data.files)
-        
+
         if let serverUrl = data.serverUrl,
-           let channelId = data.channelId {
+            let channelId = data.channelId {
             Network.default.createPost(
                 serverUrl: serverUrl,
                 channelId: channelId,
@@ -120,7 +125,7 @@ extension ShareExtension {
                             err.localizedDescription
                         )
                     }
-                    
+
                     if let handler = completionHandler {
                         os_log(
                             OSLogType.default,
diff --git a/ios/GekidouWrapper.swift b/ios/GekidouWrapper.swift
index e7882a011..91292a422 100644
--- a/ios/GekidouWrapper.swift
+++ b/ios/GekidouWrapper.swift
@@ -12,7 +12,7 @@ import react_native_emm
 
 @objc class GekidouWrapper: NSObject {
   @objc public static let `default` = GekidouWrapper()
-  
+
   override init() {
     ScreenCaptureManager.startTrackingScreens()
   }
@@ -20,18 +20,18 @@ import react_native_emm
   @objc func postNotificationReceipt(_ userInfo: [AnyHashable:Any]) {
     PushNotification.default.postNotificationReceipt(userInfo)
   }
-  
+
   @objc func fetchDataForPushNotification(_ notification: [AnyHashable:Any], withContentHandler contentHander: @escaping ((_ data: Data?) -> Void)) {
     PushNotification.default.fetchDataForPushNotification(notification, withContentHandler: { data in
       let jsonData = try? JSONEncoder().encode(data)
       contentHander(jsonData)
     })
   }
-  
+
   @objc func verifySignature(_ notification: [AnyHashable:Any]) -> Bool {
     return PushNotification.default.verifySignature(notification)
   }
-  
+
   @objc func attachSession(_ id: String, completionHandler: @escaping () -> Void) {
     let shareExtension = ShareExtension()
     shareExtension.attachSession(
@@ -39,16 +39,16 @@ import react_native_emm
       completionHandler: completionHandler
     )
   }
-  
+
   @objc func setPreference(_ value: Any?, forKey name: String) {
     Preferences.default.set(value, forKey: name)
   }
-  
+
   @objc func getToken(for url: String) -> String? {
-    if let token = try? Keychain.default.getToken(for: url) {
-      return token
+    if let credentials = try? Keychain.default.getCredentials(for: url) {
+      return credentials?.token
     }
-    
+
     return nil
   }
 }
diff --git a/ios/Mattermost/Extensions/RNNotificationEventHandler+HandleReplyAction.m b/ios/Mattermost/Extensions/RNNotificationEventHandler+HandleReplyAction.m
index 4efb08b9c..83a927ea0 100644
--- a/ios/Mattermost/Extensions/RNNotificationEventHandler+HandleReplyAction.m
+++ b/ios/Mattermost/Extensions/RNNotificationEventHandler+HandleReplyAction.m
@@ -62,7 +62,9 @@ static SendReplyCompletionHandlerIMP originalSendReplyCompletionHandlerImplement
       return;
   }
   
-  NSString *sessionToken = [[Keychain default] getTokenObjcFor:serverUrl];
+  NSDictionary *credentials = [[Keychain default] getCredentialsObjcFor:serverUrl];
+  NSString *sessionToken = [credentials objectForKey:@"token"];
+  NSString *preauthSecret = [credentials objectForKey:@"preauthSecret"];
   if (sessionToken == nil) {
     [self handleReplyFailure:@"" completionHandler:notificationCompletionHandler];
     return;
@@ -95,6 +97,12 @@ static SendReplyCompletionHandlerIMP originalSendReplyCompletionHandlerImplement
   [request setHTTPMethod:@"POST"];
   [request setValue:[NSString stringWithFormat:@"Bearer %@", sessionToken] forHTTPHeaderField:@"Authorization"];
   [request setValue:@"application/json; charset=utf-8" forHTTPHeaderField:@"Content-Type"];
+  
+  // Add preauth secret header if available
+  if (preauthSecret != nil && ![preauthSecret isEqualToString:@""]) {
+    [request setValue:preauthSecret forHTTPHeaderField:@"X-Mattermost-Preauth-Secret"];
+  }
+  
   [request setHTTPBody:postData];
 
   NSURLSessionConfiguration *configuration = [NSURLSessionConfiguration ephemeralSessionConfiguration];
diff --git a/libraries/@mattermost/rnshare/android/src/main/java/com/mattermost/rnshare/ShareWorker.kt b/libraries/@mattermost/rnshare/android/src/main/java/com/mattermost/rnshare/ShareWorker.kt
index 9ac75160a..fb8312173 100644
--- a/libraries/@mattermost/rnshare/android/src/main/java/com/mattermost/rnshare/ShareWorker.kt
+++ b/libraries/@mattermost/rnshare/android/src/main/java/com/mattermost/rnshare/ShareWorker.kt
@@ -33,6 +33,9 @@ import java.security.cert.X509Certificate
 import java.util.Objects
 
 class ShareWorker(private val context: Context, workerParameters: WorkerParameters) : Worker(context, workerParameters) {
+    companion object {
+        private const val HEADER_X_MATTERMOST_PREAUTH_SECRET = "X-Mattermost-Preauth-Secret"
+    }
     private val jsonType: MediaType? = "application/json; charset=utf-8".toMediaTypeOrNull()
     private val okHttpClient: OkHttpClient
         get() {
@@ -90,13 +93,18 @@ class ShareWorker(private val context: Context, workerParameters: WorkerParamete
             val files = if (jsonObject.has("files")) jsonObject.getJSONArray("files") else null
             val serverUrl = jsonObject.getString("serverUrl")
             val token = jsonObject.getString("token")
+            val preauthSecret = if (jsonObject.has("preauthSecret") && !jsonObject.isNull("preauthSecret")) {
+                val secret = jsonObject.getString("preauthSecret")
+                if (secret.isNotEmpty()) secret else null
+            } else null
             val postData = buildPostObject(jsonObject)
+
             if (files != null && files.length() > 0) {
                 setForegroundAsync(createForegroundInfo())
-                return uploadFiles(serverUrl, token, files, postData)
+                return uploadFiles(serverUrl, token, preauthSecret, files, postData)
             } else {
                 try {
-                    return post(serverUrl, token, postData)
+                    return post(serverUrl, token, preauthSecret, postData)
                 } catch (e: IOException) {
                     Log.e(MattermostShareImpl.NAME, "Error sending the post", e)
                     return Result.failure()
@@ -123,13 +131,18 @@ class ShareWorker(private val context: Context, workerParameters: WorkerParamete
     }
 
     @Throws(IOException::class)
-    private fun post(serverUrl: String, token: String, postData: JSONObject): Result {
+    private fun post(serverUrl: String, token: String, preauthSecret: String?, postData: JSONObject): Result {
         val body = postData.toString().toRequestBody(jsonType)
-        val request = Request.Builder()
+        val requestBuilder = Request.Builder()
                 .header("Authorization", "BEARER $token")
                 .url("$serverUrl/api/v4/posts")
                 .post(body)
-                .build()
+
+        if (preauthSecret != null) {
+            requestBuilder.header(HEADER_X_MATTERMOST_PREAUTH_SECRET, preauthSecret)
+        }
+
+        val request = requestBuilder.build()
 
         val response = okHttpClient.newCall(request).execute()
         response.body?.close()
@@ -137,7 +150,7 @@ class ShareWorker(private val context: Context, workerParameters: WorkerParamete
         return Result.success()
     }
 
-    private fun uploadFiles(serverUrl: String, token: String, files: JSONArray, postData: JSONObject): Result {
+    private fun uploadFiles(serverUrl: String, token: String, preauthSecret: String?, files: JSONArray, postData: JSONObject): Result {
         try {
             val builder = MultipartBody.Builder()
                     .setType(MultipartBody.FORM)
@@ -156,11 +169,16 @@ class ShareWorker(private val context: Context, workerParameters: WorkerParamete
 
             builder.addFormDataPart("channel_id", postData.getString("channel_id"))
             val body: RequestBody = builder.build()
-            val request = Request.Builder()
+            val requestBuilder = Request.Builder()
                     .header("Authorization", "BEARER $token")
                     .url("$serverUrl/api/v4/files")
                     .post(body)
-                    .build()
+
+            if (preauthSecret != null) {
+                requestBuilder.header(HEADER_X_MATTERMOST_PREAUTH_SECRET, preauthSecret)
+            }
+
+            val request = requestBuilder.build()
 
             try {
                 okHttpClient.newCall(request).execute().use { response ->
@@ -178,7 +196,7 @@ class ShareWorker(private val context: Context, workerParameters: WorkerParamete
                             fileIds.put(fileInfo.getString("id"))
                         }
                         postData.put("file_ids", fileIds)
-                        return post(serverUrl, token, postData)
+                        return post(serverUrl, token, preauthSecret, postData)
                     }
                     return Result.failure()
                 }
diff --git a/libraries/@mattermost/rnshare/src/NativeMattermostShare.ts b/libraries/@mattermost/rnshare/src/NativeMattermostShare.ts
index 9c939ec9d..60af28c23 100644
--- a/libraries/@mattermost/rnshare/src/NativeMattermostShare.ts
+++ b/libraries/@mattermost/rnshare/src/NativeMattermostShare.ts
@@ -24,6 +24,7 @@ export type ShareExtensionDataToSend = {
   serverUrl: string;
   token: string;
   userId: string;
+  preauthSecret?: string;
 }
 
 export interface Spec extends TurboModule {
diff --git a/share_extension/components/header/post_button.tsx b/share_extension/components/header/post_button.tsx
index d6b20019c..6fac7aa08 100644
--- a/share_extension/components/header/post_button.tsx
+++ b/share_extension/components/header/post_button.tsx
@@ -53,6 +53,7 @@ const PostButton = ({theme}: Props) => {
                 files,
                 message: text,
                 userId,
+                preauthSecret: credentials.preauthSecret,
             });
         }
     }, [serverUrl, channelId, message, files, linkPreviewUrl, userId]);
diff --git a/types/credentials/index.d.ts b/types/credentials/index.d.ts
index e81dd6d3f..c541c2b37 100644
--- a/types/credentials/index.d.ts
+++ b/types/credentials/index.d.ts
@@ -5,4 +5,5 @@ type ServerCredential = {
     serverUrl: string;
     userId: string;
     token: string;
+    preauthSecret?: string;
 };