244
biometric
also Face ID, BiometricPrompt
The face or fingerprint unlocks a key already on the device. It is not a password you send.
What is biometric?
A biometric prompt gates a keychain item or a local key via Face ID, Touch ID, or BiometricPrompt. The server never receives the biometric. A device passcode is the fallback. Changing biometrics can invalidate the item, and the app has to handle that instead of looping the prompt.
Why does biometric matter when vibe coding?
The draft sends “biometric: true” to the login API, or stores the user’s face as if it were a secret. There is no passcode fallback, so a failed scan locks the user out.
How do you do biometric?
Unlock a local credential with the biometric. Fall back to the device passcode. If enrollment changes, ask the user to sign in again. Do not upload a biometric result as a password.
How do you ask a model for biometric?
Gate (token) with Face ID or BiometricPrompt. Fall back to the device passcode. Do not send the biometric to the server. If biometrics change, require a fresh sign-in.
What goes wrong with biometric?
Treating a successful prompt as authentication for the account. It only proved someone could unlock this device.