Android Biometric Authentication: The BiometricPrompt API

WHY IT EXISTS Before BiometricPrompt, Android developers had to juggle separate, deprecated APIs like FingerprintManager. This led to inconsistent user interfaces, complex code to support different hardware, and no clear path for future biometric types like face or iris scans. BiometricPrompt was created to solve this fragmentation by offering a single, forward-compatible API with a system-provided UI.

THE MENTAL MODEL Think of BiometricPrompt as a trusted intermediary for user verification. Your app doesn't touch the sensitive biometric data or manage the UI. You simply make a request to the Android system: "Please confirm the user's identity." The system then takes over, presents its secure and familiar dialog, and returns a simple success, failure, or error callback to your app.

HOW IT WORKS First, you check if the device can support biometric authentication. If it can, you create an instance of BiometricPrompt, passing in an AuthenticationCallback to handle the results. Next, you build a PromptInfo object, which customizes the text shown in the system dialog (title, description, negative button). Finally, you call the authenticate() method, passing in your PromptInfo. The OS handles the rest, activating the appropriate sensor and showing the prompt.

WHEN TO USE IT Use BiometricPrompt to confirm the user's presence and identity for sensitive actions. This is ideal for logging into an app, authorizing a payment, or unlocking access to encrypted data. It provides a secure and convenient alternative to passwords for user authentication.

WHEN NOT TO USE IT Do not use BiometricPrompt if you cannot provide a fallback authentication method, such as a device PIN, pattern, or app-specific password. Users may not have biometrics enrolled, or the sensor could fail. It's for authenticating the device owner, not for identifying an unknown person from a database. It is not a replacement for proper server-side security.

ONE CANONICAL EXAMPLE A banking app wants to allow users to log in with their face or fingerprint. The app first checks for biometric capability. If available, it calls BiometricPrompt with a title like "Sign in to BankApp" and a description "Use your biometric to continue." The OS displays the appropriate prompt for the user's enrolled hardware. On success, the app grants access. If the user cancels or an error occurs, the app falls back to its traditional password login screen.