How to: Prompt for the Device Password

Updated on 21. March 2026 by Jan Bunk


If you're looking for a finished solution that requests a custom password (not the device password) when a user opens the app check out the password protection feature.

Do you want to improve your app's security while still maintaining great usability? Local authentication might be the way to go. This documentation will show you how you can prompt the users of your app to enter their device PIN/Fingerprint/Face ID before accessing parts of your app.

Enabling the feature

Enable the biometrics permission in your permission settings. Otherwise this feature may only work partially (no Face ID) or break in unexpected ways.

Using the JavaScript Function

You might want to check out the executeWhenAppReady() function of our app helper script. It ensures that your website doesn't try to interact with the app before it's ready or when your website is loaded using a regular browser (ReferenceError, function is not defined).

requestLocalAuthentication

Use this function to prompt the user for authentication.

The function returns an object with a boolean result on success. If the authentication prompt is canceled or the device cannot continue, it throws a string error code instead.


<script>
    try {
        // This message will be displayed to the user along with the prompt.
        let reason = "Please authenticate to access this part of the app";

        // Returns a boolean. True if the authentication was successful, false if the authentication challenge failed.
        // If the prompt is canceled or the device cannot continue, an error string is thrown instead.
        let authenticationResult = (await requestLocalAuthentication(reason))["result"];
    }
    catch (e) {
        switch(e) {
            case "userCanceled":
                // The user canceled the prompt and didn't authenticate.
                break;
            case "authInProgress":
                // Another authentication request is already running.
                break;
            case "noCredentialsSet":
                // No biometrics, PIN, password, or pattern is configured.
                break;
            case "systemCanceled":
                // The system interrupted the authentication attempt, for example when the app gets closed.
                break;

            // All the errors below should be very rare in practice:

            case "timeout":
                // The authentication prompt timed out.
                break;
            case "uiUnavailable":
                // The system cannot show the authentication prompt right now.
                break;
            case "deviceError":
                // A device-level error prevented authentication.
                break;
            case "unknownError":
                // An unknown error occurred.
                break;
            default:
                // Any other error
                break;
        }
    }
</script>
    
Migration for apps last updated before 21st of March 2026

Older app versions may still be handling error strings such as NotAvailable, PasscodeNotSet, LockedOut, and PermanentlyLockedOut.

  • NotAvailable is no longer one specific case. It will usually become noCredentialsSet, uiUnavailable, or unknownError.
  • PasscodeNotSet is now noCredentialsSet.
  • LockedOut and PermanentlyLockedOut don't seem to happen anymore.
  • UserCancelled is now userCanceled.
  • auth_in_progress is now authInProgress.
  • no_activity and no_fragment_activity are now uiUnavailable.