For example login API ... Currently, it supports only email and password, any support for mobile number down the line?

I can't confirm or deny roadmap items but my guess is that this is not something we would pursue. You could probably set up an SSO IdM to support it though

But SSO is again external right ?

That's right