Android Biometric Authentication: The BiometricPrompt API
Android's BiometricPrompt is a unified API for fingerprint, face, or iris scans, replacing older, fragmented methods. Use it to authorize payments or unlock features. The footgun: never assume a specific biometric type is available; always have a fallback.
Why it exists
Before BiometricPrompt, Android developers had to juggle separate, deprecated APIs like FingerprintManager. This led to inconsistent user interfaces, complex code to support different hardware, and no clear path for future biometric types like face or iris scans. BiometricPrompt was created to solve this fragmentation by offering a single, forward-compatible API with a system-provided UI.
The mental model
Think of BiometricPrompt as a trusted intermediary for user verification. Your app doesn't touch the sensitive biometric data or manage the UI. You simply make a request to the Android system: "Please confirm the user's identity." The system then takes over, presents its secure and familiar dialog, and returns a simple success, failure, or error callback to your app.
How it works
First, you check if the device can support biometric authentication. If it can, you create an instance of BiometricPrompt, passing in an AuthenticationCallback to handle the results. Next, you build a PromptInfo object, which customizes the text shown in the system dialog (title, description, negative button). Finally, you call the authenticate() method, passing in your PromptInfo. The OS handles the rest, activating the appropriate sensor and showing the prompt.
When to use it
Use BiometricPrompt to confirm the user's presence and identity for sensitive actions. This is ideal for logging into an app, authorizing a payment, or unlocking access to encrypted data. It provides a secure and convenient alternative to passwords for user authentication.
When not to use it
Do not use BiometricPrompt if you cannot provide a fallback authentication method, such as a device PIN, pattern, or app-specific password. Users may not have biometrics enrolled, or the sensor could fail. It's for authenticating the device owner, not for identifying an unknown person from a database. It is not a replacement for proper server-side security.
One canonical example
A banking app wants to allow users to log in with their face or fingerprint. The app first checks for biometric capability. If available, it calls BiometricPrompt with a title like "Sign in to BankApp" and a description "Use your biometric to continue." The OS displays the appropriate prompt for the user's enrolled hardware. On success, the app grants access. If the user cancels or an error occurs, the app falls back to its traditional password login screen.
Interview question
Which statement accurately describes the role of an Android application when using the BiometricPrompt API for user authentication?
- a.The application directly manages the biometric sensor and processes the user's biometric data.
- b.The application provides a custom user interface for biometric authentication to ensure a consistent app experience.
- c.The application is responsible for securely storing and retrieving the user's biometric templates for future authentications.
- d.The application requests user identity verification, relying on the Android system to handle the biometric process and UI.Correct
Why? this is the answer
The card states that the app doesn't touch sensitive biometric data or manage the UI; it simply requests identity confirmation from the Android system, which then handles the process. Option B is incorrect because the system provides the UI.
Just read this? Test yourself on what you have been reading.
Read the original → developer.android.com
Put your scrolling time to good use
Learn one idea, try a quiz and save useful cards for revision. Tezvyn makes it easy to learn and stay current in your tech field, a few minutes at a time.
The iPhone app is on the way
We are building it. Until it lands, nothing here is held back from you: every interview card, your saved cards, streaks and the job board all work in Safari, plus hundreds of free practice quizzes of thirty questions each. Sign in and it all carries over to the app the day it arrives.
Want it as an icon? Tap Share at the bottom of Safari, then Add to Home Screen. It opens full screen and the cards you have read stay available offline.
We are hiring for this. Open roles that interview on android — each one lists the topics its interview covers.
See open roles