ST is running well on my Android 9.0 smartphone. I can open the web interface within the Synthing app without any problem.
If I try to open 127.0.0.1:8384 locally via the Chrome browser, a login dialog appears, that asks for credentials to access the page.
I have not set up any username / password. I even can´t find any settings for that in the Android client.
I believe this is a security measure, to prevent other apps on the phone from interacting with syncthing without authorization. The inbuild webview in the app is configured to authenticate automatically.
The username/password used is fixed (username is syncthing, password is the API key).