Can a website, mobile web, admin system, mini-program, and app share one product plan?
They can be planned together by sharing the business foundation while assigning each client its own task; they do not all need to be built at once. A public website, mobile web, administration system, mini-program, and app serve different users, risks, and release routes. Wavesteam first establishes why each entry exists, then aligns identity, core objects, data definitions, interface contracts, and operations. The first release includes only the clients required to produce value.
A website commonly supports public content, search discovery, and trust. Mobile web suits direct links and lightweight tasks. A mini-program lowers entry friction inside its ecosystem. An app suits frequent use, push, offline, or hardware. Administration supports operations, support, moderation, and configuration. Roles can overlap, but each task needs a primary entry or state, copy, and operating rules multiply indefinitely.
When comparing platform capabilities, constraints, and switching costs, also compare Should we build a website, WeChat mini program, or app first? and What should be validated before building a mini-app for an overseas market?; the linked guidance adds context that should be considered in the same decision.
| Entry | Primary task | Independent concern | First-release evidence |
|---|---|---|---|
| Public web | Search, learn, inquire, public lookup | SEO, accessibility, public security, publishing | Search or external acquisition/public information need |
| Mobile web | Follow a message or ad into a light task | Browser compatibility, auth return, sharing, weak network | Low frequency without install or deep platform capability |
| Mini-program | Transaction or service in one ecosystem | Entity, category, login/payment, limits, review | Users and context concentrate in that ecosystem |
| App | Frequent use, notification, offline, hardware | iOS/Android permission, performance, store, upgrade | Retention or device value covers build and promotion |
| Administration | Review, support, setup, reporting, exceptions | Fine-grained permission, bulk, audit, risky action | Any continuing operation normally needs a minimum loop |
Share semantics and controls, not every endpoint. Users, organizations, orders, and content need stable IDs and common state and metric definitions. A versioned OpenAPI contract can support generated clients and contract tests. It must not expose high-risk administrator actions to public clients merely because the backend is shared; separate access by role, risk, or backend-for-frontend.
Unified identity does not make a phone number a permanent key. One person may use WeChat, Apple, enterprise SSO, or email. Maintain an internal user ID, external identity binding, merge, and unlink rules. Authorize by client, role, and data scope; strengthen administrator authentication and audit. RFC 9700 provides current OAuth security practice while each platform controls its login implementation.
Record one business event, then choose in-app, subscription, push, SMS, or email according to user permission and context. Every channel has consent, frequency, failure, and cost, so one configuration cannot guarantee delivery everywhere. Use WCAG 2.2 as shared accessibility guidance while implementing native conventions per platform.
Phase by business loop, not client count. A first release might be mini-program plus minimum administration, or app plus device administration. Use a mature CMS for public content and responsive web for a rare mobile flow when appropriate. Preserve stable identity, data ownership, API versions, and export without pre-building hypothetical native capability.
Wavesteam delivers a channel-role-task matrix, core data model, interface and permission boundaries, and staged route. Pricing separates shared product/backend, each client, platform adaptation, testing, release, and maintenance. Acceptance follows cross-client tasks—such as public discovery to mini-program order to administrator exception—and tests identity merge, access, duplicate callbacks, compatibility, data consistency, and analytics. Per-client conversion, errors, and versions then decide continued investment.