WebToAppMaker

Authentication

Biometric Authentication

Require native biometric or device authentication before protected URLs or sensitive website actions.

Before you start

  • A device with secure lock and enrolled biometrics
  • Protected URL rules or a bridge-triggered action

Configure and verify

  1. Choose allowed authentication

    Force Biometric Only limits Android to available biometric modalities. Otherwise a secure PIN, pattern, or password may also be offered.

  2. Write prompt copy

    Enter a clear authentication message and an iOS Face ID usage description.

  3. Protect URLs

    Add partial, wildcard, or exact URL rules for pages that require authentication before display.

  4. Trigger sensitive actions

    For actions that do not navigate to a protected page, call webtoapp.authenticate() or biometric_auth_init.

  5. Handle outcomes

    Listen for success, failed, cancelled, missing, or unsupported responses and keep server authorization as the final control.

  6. Test lifecycle

    Test cold launch to a protected page, back/forward navigation, background and resume, failed attempts, and a device without biometrics.

Bridge example

webtoapp.authenticate({
  url: "https://example.com/account",
  description: "Confirm your identity",
  force_biometric_only: true
});

Security boundary

Test before release

  • Protected URLs prompt
  • Cancelled auth blocks access
  • Fallback behavior matches policy
  • Server authorization remains enforced