Can I create mobile app using Thingworx?

You can embed a Mashup onto a WebView but it won't be super mobile friendly, also on User Profile and Organization Profile you have a "Mobile Mashup" property which you can set with a special mashup adapted for mobile routing the user to a different interface when he/she logs in from a mobile device.

This is our Login full code, hope it helps:

this.login = function(name, pw) 
{
    return $q(function(resolve, reject) 
{
var data = JSON.stringify({ "context": "appHandMeter" });
var xhr = new XMLHttpRequest();
if (WITH_CREDENTIALS!=undefined) {
xhr.withCredentials = WITH_CREDENTIALS;
}
xhr.addEventListener("readystatechange", function () 
{
  if (this.readyState === 4) 
{
if (this.status==200) {
   //saving result key
   var Data = JSON.parse(xhr.responseText);
   //saving token info
   var returnToken = (Data.rows[0].result); 
       
var xhrlogout = new XMLHttpRequest();
if (WITH_CREDENTIALS!=undefined) {
xhrlogout.withCredentials = WITH_CREDENTIALS;
}
var logOut = REST_API.LOCATION + REST_API.LOGOUT;
xhrlogout.addEventListener("readystatechange", function () 
{
if (this.readyState === 4) 
{
if (this.status==200) 
{
   //calling again the logout to clean up the session cookie
var xhrlogout2 = new XMLHttpRequest();
if (WITH_CREDENTIALS!=undefined) {
xhrlogout2.withCredentials = WITH_CREDENTIALS;
}
var logOut = REST_API.LOCATION + REST_API.LOGOUT;
xhrlogout2.addEventListener("readystatechange", function () {
if (this.readyState === 4) {
resolve(returnToken);
}
});
xhrlogout2.open("POST", logOut ,true);
xhrlogout2.setRequestHeader("Content-Type", "application/json");
xhrlogout2.setRequestHeader("Accept", "application/json");
xhrlogout2.timeout = REST_API.TIMEOUT;
xhrlogout2.ontimeout= function(){
resolve(returnToken);
}
xhrlogout2.send();    
   
}
else
{
resolve(returnToken);
}
}
});
xhrlogout.open("POST", logOut ,true);
//setting up headers
xhrlogout.setRequestHeader("Content-Type", "application/json");
xhrlogout.setRequestHeader("Accept", "application/json");
xhrlogout.timeout = REST_API.TIMEOUT;
xhrlogout.ontimeout= function(){
resolve(returnToken);
}
//sending the post request
xhrlogout.send();
/************************/
   
} else 
{
reject(this.status);
}
}
});
//Converting the user and password to base 64
var encodedData = window.btoa(name + ":" + pw);
//Construction of the login url 
var loginUrl = REST_API.LOCATION + REST_API.LOGIN;
xhr.open("POST", loginUrl ,true);
//setting up headers
xhr.setRequestHeader("Content-Type", "application/json");
xhr.setRequestHeader("Accept", "application/json");
xhr.setRequestHeader("Authorization", "Basic " + encodedData);
xhr.setRequestHeader("Cache-Control", "no-cache");
//sending the post request
xhr.timeout = REST_API.TIMEOUT;
xhr.ontimeout= function(){
reject();
}
xhr.send(data);
});
}