JavaScript Bridge

Triggering Biometric Authentication

Start native biometric or device authentication before a sensitive website action.

Before you start

Configure module defaults
Set prompt text and whether only biometrics or also device credentials are allowed.
Start from a user action
Call webtoapp.authenticate(options) from the button that begins the sensitive operation.
Listen for the response
Handle webtoapp:biometric-auth or webtoapp.onmessage and require a success status before continuing the local flow.
Reconfirm on the server
The server must still authorize the request; do not treat a client result as proof of identity.

webtoapp.authenticate({
  url: location.href,
  description: "Confirm this transfer",
  force_biometric_only: true
});

window.addEventListener("webtoapp:biometric-auth", function (event) {
  if (event.detail.response === "success") continueSensitiveFlow();
});