Authentication
Biometric Authentication
Require native biometric or device authentication before protected URLs or sensitive website actions.
Before you start
- A device with secure lock and enrolled biometrics
- Protected URL rules or a bridge-triggered action
Configure and verify
Choose allowed authentication
Force Biometric Only limits Android to available biometric modalities. Otherwise a secure PIN, pattern, or password may also be offered.
Write prompt copy
Enter a clear authentication message and an iOS Face ID usage description.
Protect URLs
Add partial, wildcard, or exact URL rules for pages that require authentication before display.
Trigger sensitive actions
For actions that do not navigate to a protected page, call webtoapp.authenticate() or biometric_auth_init.
Handle outcomes
Listen for success, failed, cancelled, missing, or unsupported responses and keep server authorization as the final control.
Test lifecycle
Test cold launch to a protected page, back/forward navigation, background and resume, failed attempts, and a device without biometrics.
Bridge example
webtoapp.authenticate({
url: "https://example.com/account",
description: "Confirm your identity",
force_biometric_only: true
});Security boundary
Test before release
- Protected URLs prompt
- Cancelled auth blocks access
- Fallback behavior matches policy
- Server authorization remains enforced