How to Build a Mobile App With Biometric Login
What biometric login in a mobile app actually is
Biometric login lets a user open an app, or approve an action inside it, with a fingerprint or face instead of typing a password or PIN. On Android and iOS, the operating system performs the match against biometrics enrolled in the phone's settings and returns a pass or fail to the app. The app uses that result to release a credential it stored securely at enrolment. There are two things people mean by "biometric" in a Nigerian app, and they must not be confused.
| Device biometric login | Server-side biometric verification | |
|---|---|---|
| What happens | Phone checks the fingerprint or face already enrolled on the device | Your server or a provider compares a selfie with a reference image (for example NIN or BVN records) |
| Who is verified | Whoever has a biometric enrolled on that phone | The specific person whose identity is being checked |
| Biometric data leaves the phone? | No | Yes, the selfie is transmitted and processed |
| Legal weight under the NDPA 2023 | Low; the app holds no biometric data | High; sensitive personal data processing |
| Typical use | Convenient daily login, approving transfers | KYC onboarding, account recovery, high-value identity checks |
| Cost driver | Development only | Development plus per-verification fees |
This guide covers device biometric login. Server-side verification for KYC is discussed in the guide to building a fintech app in Nigeria.
How biometric login works, step by step
The first step is a normal login. Biometrics never create an account; they open one that already exists on a device the user has proved they control.
- First login on the device. The user signs in with phone number and OTP, or email and password, and completes any verification your business requires.
- Offer enrolment. The app asks whether to enable fingerprint or face login on this device. The user can decline and keep using a PIN.
- Create a protected key. The app generates a cryptographic key in the phone's hardware-backed store (Android Keystore, or the iOS Keychain backed by the Secure Enclave) and sets it to require biometric authentication for every use.
- Store a device credential. A long-lived refresh token, or a device-specific key registered with your server, is stored so that it can only be read after a successful biometric check.
- Daily login. The user opens the app, the operating system shows the biometric prompt, the match succeeds, the app reads the credential and requests a fresh session from the server.
- Step-up for risky actions. For a transfer above a threshold or a change of bank details, the app asks for the biometric (or PIN) again, and the server checks that the approval was recent.
- Revocation. From another device or a support channel, the user or your team can revoke the lost phone's credential so the biometric on that phone releases nothing.
The server always issues the session. The biometric only decides whether the phone is allowed to ask.
Which Nigerian apps should use biometric login?
Biometric login earns its place in any app that users open often and that holds money, personal records or business controls. It is a convenience feature with a security benefit: users who would otherwise choose a four-digit PIN they reuse everywhere get a stronger factor with less friction.
- Fintech, savings, cooperative and lending apps. Daily balance checks and transfers are where fingerprint login is expected in Nigeria now, and where step-up approval for transactions matters most.
- Staff and field apps. Sales reps, riders and technicians on shared or company devices benefit from fast re-login between jobs, provided each user has their own account and the device policy is clear.
- Admin and approval apps. Managers approving payments, discounts or stock adjustments should confirm each approval biometrically, which also strengthens the audit trail.
- Healthcare and HR apps. Access to patient records or payroll data justifies a biometric gate.
- Customer apps with stored cards or wallets. Any app where a stranger holding the phone could spend money.
Where it adds little: content apps, catalogues without accounts, and anything a user opens once a month. In those cases OTP login and a session that persists is enough.
Platform building blocks: Android, iOS, Flutter and React Native
On Android, the BiometricPrompt API presents the system dialogue and, combined with a Keystore key that requires user authentication, provides hardware-backed protection. Android classifies biometrics as strong (Class 3) or weak (Class 2); only strong biometrics should unlock cryptographic keys. On iOS, the LocalAuthentication framework handles Face ID and Touch ID, and Keychain items can be tied to the Secure Enclave with an access control policy that requires biometrics.
- Flutter: the local_auth package wraps both platforms, and secure storage packages handle Keychain and Keystore. Ask the developer to confirm the key is tied to biometric authentication, not merely that a prompt is shown.
- React Native: react-native-biometrics and similar libraries expose signature-based flows where the phone signs a server challenge with a key that only a biometric can use. This is the stronger pattern.
- Native: BiometricPrompt with CryptoObject on Android; LocalAuthentication with Keychain access control on iOS.
- Weak face unlock. Many entry-level and mid-range Android phones sold in Nigeria use camera-based face unlock that Android rates as weak. Configure the prompt to accept only strong biometrics for financial actions, and fall back to PIN on devices without them.
- Rooted and jailbroken devices. Detect and either block or downgrade to PIN-only, because hardware guarantees are weaker on compromised phones.
- Key invalidation. Set the key to be invalidated when new biometrics are enrolled on the phone. If someone adds their fingerprint to a stolen phone, the app should force a full login rather than accept the new print.
Security design decisions your developer must make
The difference between a secure biometric login and a cosmetic one is a handful of design decisions. Put these in the scope document so they are not left to chance.
| Decision | Recommended default | Why it matters |
|---|---|---|
| What the biometric releases | A device-bound credential, not a stored password | Passwords in local storage are the weakest link |
| Fallback | App PIN, then full login with OTP | Users with cuts, gloves or failed sensors still get in |
| Step-up authentication | Re-verify for transfers, limit changes, bank detail edits | Convenience login should not equal transaction approval |
| Session length | Short server sessions refreshed via the protected credential | Limits damage if a session token leaks |
| Device management | List of enrolled devices in the app; revoke from another device or support | Handles theft and phone changes |
| Enrolment change policy | Invalidate key when device biometrics change | Stops a new fingerprint on a stolen phone inheriting access |
| Attempt limits | Lock biometric after repeated failures; require PIN | Aligns with OS behaviour and limits brute-force |
| Logging | Log enrolment, revocation and step-up events server-side | Supports dispute handling and audits |
Two further points. First, biometric login must be optional and the app must work fully without it. Second, biometric approval should never be the only control on money movement; server-side limits, velocity checks and anomaly detection do the heavy lifting.
What changes in Nigeria: shared phones, theft and regulation
For a Nigerian business, the main differences when adding biometric login are the prevalence of shared and second-hand phones, phone theft and SIM-swap fraud, weak face unlock on affordable Android devices, unreliable OTP delivery, and the compliance environment set by the NDPA 2023 and, for regulated firms, the Central Bank of Nigeria.
- Shared and family phones. A phone with a mother's and a teenage son's fingerprints both enrolled will open the app for either. Device biometric login verifies "someone enrolled on this phone", not "the account holder". Explain this in onboarding, require step-up plus server-side limits for money movement, and let users disable biometric login for the account.
- Second-hand phones. Phones bought in Computer Village or Wuse market may carry a previous owner's enrolled biometrics. Enrolment should happen only after a fresh full login, and key invalidation on biometric change protects against stale enrolments.
- Theft and SIM swap. A stolen phone with the app still enrolled is the main threat. Device revocation from another device or via support, short sessions and transaction limits reduce the damage. Do not treat SMS OTP to the same phone as a recovery factor for that phone.
- OTP unreliability. SMS delivery delays on some networks make biometric login attractive for everyday access, but keep OTP or an authenticator option for first login and recovery.
- Weak biometrics on affordable phones. Restrict financial approvals to strong biometrics or PIN, and test on the Tecno, Infinix and Samsung models your customers actually own.
- NDPA 2023. Device biometric login involves no biometric data reaching your systems, which keeps your exposure low; say so plainly in your privacy notice. Server-side selfie matching is sensitive data processing and needs a lawful basis, safeguards and possibly registration; verify with the Nigeria Data Protection Commission or a qualified adviser.
- CBN and regulated businesses. Banks, microfinance institutions and licensed fintechs have authentication and fraud-control expectations under CBN and NIBSS frameworks. If your app moves customer money, confirm current requirements with your compliance officer before designing the login flow. This is not legal advice.
How to build it: step by step
- Decide what biometrics protect: everyday login, transaction approval, or both, with thresholds for step-up.
- Design the enrolment flow after first login, with clear consent, an explanation of shared-phone behaviour and an obvious way to disable it.
- Implement hardware-backed key storage tied to strong biometrics on both platforms, with key invalidation on biometric change.
- Implement the server side: device registration, challenge-response or refresh-token exchange, short sessions, step-up verification and device revocation endpoints.
- Build the fallback chain: biometric, then PIN, then full OTP login, with attempt limits.
- Add device management screens so users can see and remove enrolled devices.
- Add rooted-device detection and decide the policy (block or PIN-only).
- Test on real Nigerian devices, including weak face unlock phones, phones with multiple enrolled fingerprints, and phones after a biometric change.
- Write the privacy notice text and, for regulated businesses, review the flow with compliance.
- Launch as optional, monitor enrolment rates and failed-prompt rates, and tune the fallback messaging.
Example (hypothetical): a cooperative savings and loans app in Lagos
Example (hypothetical): a cooperative society with several thousand members in Lagos runs contributions, loans and withdrawals through an app. Members check balances daily, and the society has had disputes where a family member used a shared phone to request a withdrawal. The build: first login with phone number and OTP plus a member PIN; optional fingerprint or face enrolment using hardware-backed keys that accept only strong biometrics; everyday login by biometric; step-up biometric or PIN for any withdrawal or change of payout account; server-side daily limits and a cooling-off period for new payout accounts; a "my devices" screen with remote revocation; and event logging for enrolment, revocation and step-up approvals so the society can investigate disputes with evidence. What the cooperative would measure: the share of members who enrol biometrics, the drop in support requests about forgotten PINs, and the number of withdrawal disputes after launch. This scope sits in the upper part of the cost table below because of the device management and step-up logic, not the biometric prompt itself.
How much does biometric login cost in Nigeria?
Adding biometric login is a modest line item compared with the authentication and device-management design around it. For a Nigerian business in 2026, adding a basic fingerprint or face unlock to an existing app is indicatively ₦300,000–₦1,200,000; a full authentication module with OTP, PIN, biometrics, step-up approval and device management is ₦1,000,000–₦3,000,000; and server-side identity verification against NIN or BVN records through a licensed provider is ₦1,500,000–₦5,000,000 plus per-verification fees. Figures are indicative and vary with scope, vendor and exchange rate.
| Scope | Indicative 2026 range | What is typically included |
|---|---|---|
| Basic biometric unlock added to an existing app | ₦300,000–₦1,200,000 | Prompt, secure key storage, PIN fallback |
| Full authentication module | ₦1,000,000–₦3,000,000 | OTP, PIN, biometrics, step-up, device management, logging |
| Server-side identity verification (add-on) | ₦1,500,000–₦5,000,000 | Provider integration, liveness, compliance reporting |
Indicative 2026 ranges; actual quotes vary with scope, vendor and exchange rate. Recurring costs: SMS OTP charges for first login and recovery; per-check fees from identity verification providers if used, often quoted in naira but sometimes tied to USD; and the app's general maintenance at typically 15–25% of build cost per year. Device biometric login itself has no per-use cost. What drives cost: step-up rules and thresholds, device management, rooted-device policy, regulatory review for financial apps, and the breadth of device testing. When comparing quotations, ask each vendor to describe what the biometric releases and how key invalidation and revocation work; a vendor who cannot answer is offering a cosmetic prompt.
Mistakes to avoid
- Storing the password locally and "unlocking" it with a biometric. Anyone who extracts local storage gets the password. Use hardware-backed keys.
- Treating biometric login as transaction approval. On a shared phone, a family member can move money. Step-up plus server-side limits are essential.
- Accepting weak face unlock for financial actions. Camera-based face unlock on affordable Android phones can be fooled; restrict to strong biometrics or PIN.
- No revocation path. A stolen phone must be removable from another device or through support, with identity checks.
- Making biometric login mandatory. Sensor failures, injuries and shared devices make a PIN fallback non-negotiable.
- Not invalidating keys on biometric change. A thief who adds a fingerprint should be forced into a full login.
- Confusing device biometrics with KYC. Fingerprint login proves control of a phone, not identity. Onboarding still needs proper verification.
- Skipping device testing. Behaviour differs by manufacturer, especially on face unlock.
Conclusion
Biometric login is a convenience feature that, built correctly, also strengthens security. The rules are simple: the phone verifies the person, hardware-backed storage protects a device credential, the server issues every session, a PIN fallback always exists, risky actions get a second confirmation, and a lost phone can be revoked. Design for the shared and second-hand phones that are common in Nigeria, accept only strong biometrics for money movement, and keep device biometric login separate from identity verification in both your architecture and your privacy notice. If you are building a fintech, cooperative, staff or admin app and want the authentication module, including biometric login, step-up approval and device management, designed properly from the start, Linestech builds mobile apps and secure backends for Nigerian businesses and can review your requirements before development begins.
Frequently asked questions
Does the app store my fingerprint or face?
No. With device biometric login, the phone's operating system compares the fingerprint or face against data held in the phone's secure hardware and tells the app only whether the match succeeded. The app stores a protected login credential, not biometric data. Server-side selfie verification is different: there the image is transmitted and processed, which carries NDPA obligations.
Can someone else open my account on a shared phone?
If their fingerprint or face is enrolled in the phone's settings, yes, they can pass the biometric prompt. That is why a well-built app requires a second confirmation for money movement, enforces server-side limits, lets you disable biometric login for your account, and lets you remove a device remotely.
What happens when I change phones?
Biometric enrolment is tied to the device, so on the new phone you log in fully with OTP and PIN, then enrol biometrics again. The old phone should be removed from your device list, either automatically when you log in elsewhere or manually from the app's device management screen.
Should we allow face unlock on Android?
Allow it only where the phone reports a strong biometric. Many affordable Android phones use camera-based face unlock that Android rates as weak, which should not unlock cryptographic keys or approve transactions. Configure the prompt to require strong biometrics for sensitive actions and fall back to PIN on devices that lack them.
Can biometric login replace OTP completely?
For everyday login on an enrolled device, yes. For the first login on a new device, account recovery and changes to payout details, you still need an independent factor such as OTP, an authenticator app or a support-verified process. Removing OTP entirely would make a stolen phone the only key to the account.
Is biometric login compliant with the NDPA and CBN rules?
Device biometric login processes no biometric data on your systems, which keeps NDPA exposure low, though your privacy notice should explain the feature. Regulated financial businesses have additional authentication and fraud-control expectations under CBN and NIBSS frameworks. Confirm current requirements with your compliance officer or a qualified adviser; this is not legal advice.
Sources and further reading
Figures, platform rules and regulations change. These are the primary references behind this article and the places to check before you act on it.
