My next project requires me to develop both a mobile and a website application. To avoid duplicating code, I'm thinking about creating an API that both of these applications would use. 
My questions regarding this are:

Is this approach sensible? 
Are there any frameworks to help me with this? 
How would I handle authentication?
Does this have an affect on scalability?
Actually I doesn't make great sense. From my experience I know that mobile apps and web pages even if use the same backend very often require completely different set of data, and - (I know premature optimization is the root of all evil) - number of calls should be minimized for mobile applications to make them running smoothly. I'd separate mobile API from classic REST API, even with prefixes, e.g. /api/m/ and /api/.
There're really many frameworks in a number of technologies. E.g. spring, django-rest-framework, express.js. Whatever you like.
Token authentication will be the best choice. For both web and mobile. For REST in general.
It shouldn't be a matter for you now.
Creating a centric REST API for a mobile and website application