Mobile app authentication
You're basically looking for authentication/authorization for the Element API plugin, which it currently doesn't support.


  Should this require us to write our own plugin with a custom authentication system or is it possible to get this working with the user logic provided by Craft?


I'd probably approach this by forking the Element API plugin and adding authentication/authorization to it instead of adding it to a separate plugin and getting them to interact.

You'd need some way to authenticate the user and once they are authenticated you could authorize future requests either based on a custom token or using authorization headers and each could have their own expiration logic.