diff --git a/mobile/mobile.go b/mobile/mobile.go
index bbf52aa..13e8c64 100644
--- a/mobile/mobile.go
+++ b/mobile/mobile.go
@@ -84,6 +84,7 @@ type mobileConfig struct {
 	transport        string
 	dnsServer        string
 	socksListenHost  string
+	authToken        string
 	vp8FPS           int
 	vp8BatchSize     int
 	livenessInterval time.Duration
@@ -132,6 +133,17 @@ func SetDNS(dnsServer string) {
 	defaults.dnsServer = dnsServer
 }
 
+// SetWBToken sets the pre-issued wbstream account token (auth.token).
+// When set, the session joins as that account instead of an anonymous guest;
+// empty keeps the guest flow. Required for datachannel over wbstream, which
+// needs an account/moderator token with canPublishData=true.
+func SetWBToken(token string) {
+	mu.Lock()
+	defer mu.Unlock()
+	ensureDefaultConfigLocked()
+	defaults.authToken = strings.TrimSpace(token)
+}
+
 // SetSocksListenHost selects the local bind host for the SOCKS5 listener.
 // Use 0.0.0.0 to accept connections from other Android network interfaces.
 func SetSocksListenHost(host string) {
@@ -251,6 +263,7 @@ func Check(
 				DeviceID:  clientID,
 				LocalAddr: socksListenAddr(cfg.socksListenHost, socksPort),
 				DNSServer: defaultDNSServer,
+				AuthToken: cfg.authToken,
 				TransportOptions: vp8channel.Options{
 					FPS:       clampAtLeastOne(vp8FPS, 120),
 					BatchSize: clampAtLeastOne(vp8BatchSize, 64),
@@ -341,6 +354,7 @@ func Ping(
 				DeviceID:  clientID,
 				LocalAddr: socksListenAddr(cfg.socksListenHost, socksPort),
 				DNSServer: defaultDNSServer,
+				AuthToken: cfg.authToken,
 				TransportOptions: vp8channel.Options{
 					FPS:       clampAtLeastOne(vp8FPS, 120),
 					BatchSize: clampAtLeastOne(vp8BatchSize, 64),
@@ -588,6 +602,7 @@ func startWithConfig(
 				DeviceID:  clientID,
 				LocalAddr: socksListenAddr(cfg.socksListenHost, socksPort),
 				DNSServer: cfg.dnsServer,
+				AuthToken: cfg.authToken,
 				SOCKSUser: socksUser,
 				SOCKSPass: socksPass,
 				TransportOptions: vp8channel.Options{
diff --git a/mobile/mobile_test.go b/mobile/mobile_test.go
index 0d3a753..f40fe52 100644
--- a/mobile/mobile_test.go
+++ b/mobile/mobile_test.go
@@ -208,6 +208,40 @@ func TestStartWithInjectedRunnerLifecycle(t *testing.T) {
 	}
 }
 
+func TestSetWBTokenReachesClientConfig(t *testing.T) {
+	resetMobileGlobals(t)
+	t.Cleanup(func() {
+		resetMobileGlobals(t)
+	})
+
+	SetWBToken("  tok-123  ")
+
+	seen := make(chan string, 1)
+	runClientWithReady = func(ctx context.Context, cfg client.Config, onReady func()) error {
+		seen <- cfg.AuthToken
+		onReady()
+		<-ctx.Done()
+		return ctx.Err()
+	}
+
+	if err := Start(carrierWBStream, testRoomID, "client", "key", 1086, "", ""); err != nil {
+		t.Fatalf("Start() error = %v", err)
+	}
+	if err := WaitReady(100); err != nil {
+		t.Fatalf("WaitReady() error = %v", err)
+	}
+	Stop()
+
+	select {
+	case got := <-seen:
+		if got != "tok-123" {
+			t.Fatalf("AuthToken = %q, want %q", got, "tok-123")
+		}
+	default:
+		t.Fatal("Start did not pass AuthToken to client")
+	}
+}
+
 //nolint:cyclop // table-driven test naturally has many branches
 func TestStartUsesDefaultsAndCheckWithInjectedRunner(t *testing.T) {
 	resetMobileGlobals(t)