Biometrics authentication for your mobile app

Three approaches to implementing biometric authentication (Face ID, fingerprint) in React Native apps are compared: a simple UI-level prompt, a cryptographic key pair with server-side challenge-response, and OS/hardware-enforced keychain storage. Approach 1 (simplePrompt) is easy but vulnerable to runtime hooking tools like Frida and unsuitable for sensitive apps. Approach 2 uses asymmetric key pairs where the private key never leaves the hardware chip, providing FIDO2-like security with server-side verification but requiring backend work. Approach 3 uses biometric-gated keychain/keystore storage enforced at the OS level, offering hardware security without backend changes and working in Expo managed workflow. A comparison table summarizes tradeoffs across Frida resistance, backend requirements, FIDO2 alignment, replay protection, and multi-device support.