# Biometric unlock plugin

Source: https://saastostore.com/plugins/biometric

This plugin asks the person holding the phone to prove it's them, with a fingerprint, their face, or the phone's PIN as a fallback. Use it to unlock an account your site already has open, or to confirm a sensitive action. It doesn't sign anyone in.

## When to use it

- Lock a banking, health or notes app when it opens
- Confirm a payment, a transfer or a deletion
- Let people come back without typing a password

## Set it up

1. **Add the plugin** In your project, open the plugin library and add Biometric unlock. It's on by default in native builds.
2. **Launch a new build** The plugin reaches your app with its next build. On iOS, it also works in a full-screen app, as long as one other library plugin is added.
3. **Add the calls to your site** Use the code below, or paste the prompt into your AI builder.

## JavaScript API

```js
const bio = await whenSaasToStore("biometric");
const check = await bio?.isAvailable();
// → { available: true, type: "fingerprint" }
// → { available: false, type: "none" }

if (check?.available) {
  const result = await bio.authenticate("Unlock your account");
  // → { success: true, error: null }
  // → { success: false, error: "Authentication canceled" }
  if (result?.success) showAccount();
}
```

| Value | Android | iOS |
| --- | --- | --- |
| `type` | `fingerprint`, `face`, `iris`, `biometric` | `faceid`, `touchid` |
| Extra errors | `not_available`, `busy` | The system's message |

`whenSaasToStore` waits until the bridge has loaded. Its code is in the [JavaScript bridge](https://saastostore.com/docs/javascript-bridge) reference.

## Prompt for AI builders

**Prompt for Lovable, Bolt or Base44**

```text
My website also runs inside a mobile app. Inside the app, window.saastostore?.biometric gives access to Face ID and fingerprint unlock. In a normal browser it doesn't exist, and nothing must change.

In the settings page, show an "Unlock with fingerprint / Face ID" switch only when navigator.userAgent includes "SaasToStoreApp" and biometric.isAvailable() returns available: true. Save the choice in localStorage.

When the switch is on, hide the signed-in content when the app opens and call biometric.authenticate("Unlock your account"). Show the content when it returns success: true, and offer a retry and a sign-out button otherwise.
```

Paste it as is, then launch a new build if you haven't added the plugin yet.

## Frequently asked questions

### Does biometric unlock replace my sign-in?

No. It confirms that the person holding the phone is its owner. Your site still handles accounts and sessions.

### Can I read the fingerprint or face data?

No. Your site only gets a yes or a no. Biometric data never leaves the phone's secure hardware.

### What if the phone has no biometrics?

isAvailable returns available: false. Skip the lock, or use your site's password check instead.

### Does it need a permission prompt?

Not on Android. On iOS, the system asks once before the first Face ID use, with a message the build provides.