@capgo/capacitor-native-biometric 8.3.7 → 8.4.1

package/README.md

@@ -283,6 +283,7 @@ This is a plugin specific list of error codes that can be thrown on verifyIdenti
 * [`getCredentials(...)`](#getcredentials)
 * [`setCredentials(...)`](#setcredentials)
 * [`deleteCredentials(...)`](#deletecredentials)
+* [`getSecureCredentials(...)`](#getsecurecredentials)
 * [`isCredentialsSaved(...)`](#iscredentialssaved)
 * [`getPluginVersion()`](#getpluginversion)
 * [Interfaces](#interfaces)
@@ -405,6 +406,29 @@ Deletes the stored credentials for a given server.
 --------------------
 
 
+### getSecureCredentials(...)
+
+```typescript
+getSecureCredentials(options: GetSecureCredentialsOptions) => Promise<Credentials>
+```
+
+Gets the stored credentials for a given server, requiring biometric authentication.
+Credentials must have been stored with accessControl set to BIOMETRY_CURRENT_SET or BIOMETRY_ANY.
+
+On iOS, the system automatically shows the biometric prompt when accessing the protected Keychain item.
+On Android, BiometricPrompt is shown with a CryptoObject bound to the credential decryption key.
+
+| Param         | Type                                                                                |
+| ------------- | ----------------------------------------------------------------------------------- |
+| **`options`** | <code><a href="#getsecurecredentialsoptions">GetSecureCredentialsOptions</a></code> |
+
+**Returns:** <code>Promise&lt;<a href="#credentials">Credentials</a>&gt;</code>
+
+**Since:** 8.4.0
+
+--------------------
+
+
 ### isCredentialsSaved(...)
 
 ```typescript
@@ -502,11 +526,12 @@ Result from isAvailable() method indicating biometric authentication availabilit
 
 #### SetCredentialOptions
 
-| Prop           | Type                |
-| -------------- | ------------------- |
-| **`username`** | <code>string</code> |
-| **`password`** | <code>string</code> |
-| **`server`**   | <code>string</code> |
+| Prop                | Type                                                    | Description                                                                                                                                                                                                                                                                                                                                                                                             | Default                         | Since |
+| ------------------- | ------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------- | ----- |
+| **`username`**      | <code>string</code>                                     |                                                                                                                                                                                                                                                                                                                                                                                                         |                                 |       |
+| **`password`**      | <code>string</code>                                     |                                                                                                                                                                                                                                                                                                                                                                                                         |                                 |       |
+| **`server`**        | <code>string</code>                                     |                                                                                                                                                                                                                                                                                                                                                                                                         |                                 |       |
+| **`accessControl`** | <code><a href="#accesscontrol">AccessControl</a></code> | Access control level for the stored credentials. When set to BIOMETRY_CURRENT_SET or BIOMETRY_ANY, the credentials are hardware-protected and require biometric authentication to access. On iOS, this adds SecAccessControl to the Keychain item. On Android, this creates a biometric-protected Keystore key and requires BiometricPrompt authentication for both storing and retrieving credentials. | <code>AccessControl.NONE</code> | 8.4.0 |
 
 
 #### DeleteCredentialOptions
@@ -516,6 +541,18 @@ Result from isAvailable() method indicating biometric authentication availabilit
 | **`server`** | <code>string</code> |
 
 
+#### GetSecureCredentialsOptions
+
+| Prop                     | Type                | Description                                                                                                |
+| ------------------------ | ------------------- | ---------------------------------------------------------------------------------------------------------- |
+| **`server`**             | <code>string</code> |                                                                                                            |
+| **`reason`**             | <code>string</code> | Reason for requesting biometric authentication. Displayed in the biometric prompt on both iOS and Android. |
+| **`title`**              | <code>string</code> | Title for the biometric prompt. Only for Android.                                                          |
+| **`subtitle`**           | <code>string</code> | Subtitle for the biometric prompt. Only for Android.                                                       |
+| **`description`**        | <code>string</code> | Description for the biometric prompt. Only for Android.                                                    |
+| **`negativeButtonText`** | <code>string</code> | Text for the negative/cancel button. Only for Android.                                                     |
+
+
 #### IsCredentialsSavedResult
 
 | Prop          | Type                 |
@@ -584,6 +621,15 @@ Callback type for biometry change listener
 | **`USER_CANCEL`**             | <code>16</code> | User canceled the authentication Platform: Android, iOS                               |
 | **`USER_FALLBACK`**           | <code>17</code> | User chose to use fallback authentication method Platform: Android, iOS               |
 
+
+#### AccessControl
+
+| Members                    | Value          | Description                                                                                                                                                                                                                   |
+| -------------------------- | -------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| **`NONE`**                 | <code>0</code> | No biometric protection. <a href="#credentials">Credentials</a> are accessible without authentication. This is the default behavior for backward compatibility.                                                               |
+| **`BIOMETRY_CURRENT_SET`** | <code>1</code> | Biometric authentication required for credential access. Credentials are invalidated if biometrics change (e.g., new fingerprint enrolled). More secure but credentials are lost if user modifies their biometric enrollment. |
+| **`BIOMETRY_ANY`**         | <code>2</code> | Biometric authentication required for credential access. Credentials survive new biometric enrollment (e.g., adding a new fingerprint). More lenient — recommended for most apps.                                             |
+
 </docgen-api>
 ## Face ID (iOS)
 

package/android/build.gradle

@@ -30,7 +30,7 @@ android {
     buildTypes {
         release {
             minifyEnabled false
-            proguardFiles getDefaultProguardFile('proguard-android.txt'), 'proguard-rules.pro'
+            proguardFiles getDefaultProguardFile('proguard-android-optimize.txt'), 'proguard-rules.pro'
         }
     }
     lintOptions {

package/android/src/main/java/ee/forgr/biometric/AuthActivity.java

@@ -1,18 +1,21 @@
 package ee.forgr.biometric;
 
 import android.content.Intent;
+import android.content.SharedPreferences;
 import android.os.Build;
 import android.os.Bundle;
 import android.os.Handler;
 import android.security.keystore.KeyGenParameterSpec;
 import android.security.keystore.KeyPermanentlyInvalidatedException;
 import android.security.keystore.KeyProperties;
+import android.util.Base64;
 import androidx.annotation.NonNull;
 import androidx.appcompat.app.AppCompatActivity;
 import androidx.biometric.BiometricManager;
 import androidx.biometric.BiometricPrompt;
 import ee.forgr.biometric.capacitornativebiometric.R;
 import java.io.IOException;
+import java.nio.charset.StandardCharsets;
 import java.security.GeneralSecurityException;
 import java.security.KeyStore;
 import java.security.KeyStoreException;
@@ -24,14 +27,20 @@ import java.util.concurrent.Executor;
 import javax.crypto.Cipher;
 import javax.crypto.KeyGenerator;
 import javax.crypto.SecretKey;
+import javax.crypto.spec.GCMParameterSpec;
+import org.json.JSONObject;
 
 public class AuthActivity extends AppCompatActivity {
 
     private static final String AUTH_KEY_ALIAS = "NativeBiometricAuthKey";
     private static final String AUTH_TRANSFORMATION = "AES/GCM/NoPadding";
+    private static final String SECURE_KEY_PREFIX = "NativeBiometricSecure_";
+    private static final int CREDENTIAL_GCM_IV_LENGTH = 12;
+    private static final String SHARED_PREFS_NAME = "NativeBiometricSharedPreferences";
 
     private BiometricPrompt biometricPrompt;
     private Cipher authCipher;
+    private String mode;
     private int maxAttempts;
     private int counter = 0;
 
@@ -40,7 +49,9 @@ public class AuthActivity extends AppCompatActivity {
         super.onCreate(savedInstanceState);
         setContentView(R.layout.activity_auth_acitivy);
 
-        // Get maxAttempts with validation: must be between 1 and 5, default to 1
+        mode = getIntent().getStringExtra("mode");
+        if (mode == null) mode = "verify";
+
         int rawMaxAttempts = getIntent().getIntExtra("maxAttempts", 1);
         maxAttempts = Math.max(1, Math.min(5, rawMaxAttempts));
 
@@ -100,11 +111,17 @@ public class AuthActivity extends AppCompatActivity {
                 @Override
                 public void onAuthenticationSucceeded(@NonNull BiometricPrompt.AuthenticationResult result) {
                     super.onAuthenticationSucceeded(result);
-                    if (!validateCryptoObject(result)) {
-                        finishActivity("error", 10, "Biometric security check failed");
-                        return;
+                    if ("setSecureCredentials".equals(mode)) {
+                        handleSetSecureCredentials(result);
+                    } else if ("getSecureCredentials".equals(mode)) {
+                        handleGetSecureCredentials(result);
+                    } else {
+                        if (!validateCryptoObject(result)) {
+                            finishActivity("error", 10, "Biometric security check failed");
+                            return;
+                        }
+                        finishActivity();
                     }
-                    finishActivity();
                 }
 
                 @Override
@@ -120,7 +137,14 @@ public class AuthActivity extends AppCompatActivity {
             }
         );
 
-        BiometricPrompt.CryptoObject cryptoObject = createCryptoObject();
+        BiometricPrompt.CryptoObject cryptoObject;
+        if ("setSecureCredentials".equals(mode)) {
+            cryptoObject = createCredentialEncryptCryptoObject();
+        } else if ("getSecureCredentials".equals(mode)) {
+            cryptoObject = createCredentialDecryptCryptoObject();
+        } else {
+            cryptoObject = createCryptoObject();
+        }
         if (cryptoObject == null) {
             finishActivity("error", 0, "Biometric crypto object unavailable");
             return;
@@ -234,6 +258,140 @@ public class AuthActivity extends AppCompatActivity {
         }
     }
 
+    private SecretKey getOrCreateCredentialKey(String server, int accessControl) throws GeneralSecurityException, IOException {
+        String alias = SECURE_KEY_PREFIX + server;
+        KeyStore ks = KeyStore.getInstance("AndroidKeyStore");
+        ks.load(null);
+
+        if (ks.containsAlias(alias)) {
+            return (SecretKey) ks.getKey(alias, null);
+        }
+
+        KeyGenerator keyGenerator = KeyGenerator.getInstance(KeyProperties.KEY_ALGORITHM_AES, "AndroidKeyStore");
+        KeyGenParameterSpec.Builder builder = new KeyGenParameterSpec.Builder(
+            alias,
+            KeyProperties.PURPOSE_ENCRYPT | KeyProperties.PURPOSE_DECRYPT
+        )
+            .setBlockModes(KeyProperties.BLOCK_MODE_GCM)
+            .setEncryptionPaddings(KeyProperties.ENCRYPTION_PADDING_NONE)
+            .setUserAuthenticationRequired(true);
+
+        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.R) {
+            builder.setUserAuthenticationParameters(0, KeyProperties.AUTH_BIOMETRIC_STRONG);
+        } else {
+            builder.setUserAuthenticationValidityDurationSeconds(1);
+        }
+
+        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.N) {
+            builder.setInvalidatedByBiometricEnrollment(accessControl == 1);
+        }
+
+        keyGenerator.init(builder.build());
+        return keyGenerator.generateKey();
+    }
+
+    private BiometricPrompt.CryptoObject createCredentialEncryptCryptoObject() {
+        try {
+            String server = getIntent().getStringExtra("server");
+            int accessControl = getIntent().getIntExtra("accessControl", 2);
+            SecretKey key = getOrCreateCredentialKey(server, accessControl);
+            Cipher cipher = Cipher.getInstance(AUTH_TRANSFORMATION);
+            try {
+                cipher.init(Cipher.ENCRYPT_MODE, key);
+            } catch (KeyPermanentlyInvalidatedException e) {
+                KeyStore ks = KeyStore.getInstance("AndroidKeyStore");
+                ks.load(null);
+                ks.deleteEntry(SECURE_KEY_PREFIX + server);
+                key = getOrCreateCredentialKey(server, accessControl);
+                cipher.init(Cipher.ENCRYPT_MODE, key);
+            }
+            return new BiometricPrompt.CryptoObject(cipher);
+        } catch (GeneralSecurityException | IOException e) {
+            return null;
+        }
+    }
+
+    private BiometricPrompt.CryptoObject createCredentialDecryptCryptoObject() {
+        try {
+            String server = getIntent().getStringExtra("server");
+            SharedPreferences prefs = getSharedPreferences(SHARED_PREFS_NAME, MODE_PRIVATE);
+            String encryptedData = prefs.getString("secure_" + server, null);
+            if (encryptedData == null) return null;
+
+            byte[] combined = Base64.decode(encryptedData, Base64.DEFAULT);
+            byte[] iv = new byte[CREDENTIAL_GCM_IV_LENGTH];
+            System.arraycopy(combined, 0, iv, 0, CREDENTIAL_GCM_IV_LENGTH);
+
+            SecretKey key = getOrCreateCredentialKey(server, 0);
+            Cipher cipher = Cipher.getInstance(AUTH_TRANSFORMATION);
+            cipher.init(Cipher.DECRYPT_MODE, key, new GCMParameterSpec(128, iv));
+            return new BiometricPrompt.CryptoObject(cipher);
+        } catch (GeneralSecurityException | IOException e) {
+            return null;
+        }
+    }
+
+    private void handleSetSecureCredentials(BiometricPrompt.AuthenticationResult result) {
+        try {
+            Cipher cipher = result.getCryptoObject().getCipher();
+            String username = getIntent().getStringExtra("username");
+            String password = getIntent().getStringExtra("password");
+            String server = getIntent().getStringExtra("server");
+
+            JSONObject json = new JSONObject();
+            json.put("u", username);
+            json.put("p", password);
+
+            byte[] encrypted = cipher.doFinal(json.toString().getBytes(StandardCharsets.UTF_8));
+            byte[] iv = cipher.getIV();
+
+            byte[] combined = new byte[iv.length + encrypted.length];
+            System.arraycopy(iv, 0, combined, 0, iv.length);
+            System.arraycopy(encrypted, 0, combined, iv.length, encrypted.length);
+
+            String encoded = Base64.encodeToString(combined, Base64.DEFAULT);
+
+            SharedPreferences.Editor editor = getSharedPreferences(SHARED_PREFS_NAME, MODE_PRIVATE).edit();
+            editor.putString("secure_" + server, encoded);
+            editor.apply();
+
+            finishActivity();
+        } catch (Exception e) {
+            finishActivity("error", 0, "Failed to encrypt credentials: " + e.getMessage());
+        }
+    }
+
+    private void handleGetSecureCredentials(BiometricPrompt.AuthenticationResult result) {
+        try {
+            Cipher cipher = result.getCryptoObject().getCipher();
+            String server = getIntent().getStringExtra("server");
+
+            SharedPreferences prefs = getSharedPreferences(SHARED_PREFS_NAME, MODE_PRIVATE);
+            String encryptedData = prefs.getString("secure_" + server, null);
+            if (encryptedData == null) {
+                finishActivity("error", 21, "No protected credentials found");
+                return;
+            }
+
+            byte[] combined = Base64.decode(encryptedData, Base64.DEFAULT);
+            byte[] ciphertext = new byte[combined.length - CREDENTIAL_GCM_IV_LENGTH];
+            System.arraycopy(combined, CREDENTIAL_GCM_IV_LENGTH, ciphertext, 0, ciphertext.length);
+
+            byte[] decrypted = cipher.doFinal(ciphertext);
+            String jsonStr = new String(decrypted, StandardCharsets.UTF_8);
+            JSONObject json = new JSONObject(jsonStr);
+
+            Intent intent = new Intent();
+            intent.putExtra("result", "success");
+            intent.putExtra("username", json.getString("u"));
+            intent.putExtra("password", json.getString("p"));
+            setResult(RESULT_OK, intent);
+            finish();
+        } catch (Exception e) {
+            finishActivity("error", 0, "Failed to decrypt credentials: " + e.getMessage());
+        }
+    }
+
     /**
      * Convert Auth Error Codes to plugin expected Biometric Auth Errors (in README.md)
      * This way both iOS and Android return the same error codes for the same authentication failure reasons.

package/android/src/main/java/ee/forgr/biometric/NativeBiometric.java

@@ -248,8 +248,24 @@ public class NativeBiometric extends Plugin {
         String username = call.getString("username", null);
         String password = call.getString("password", null);
         String KEY_ALIAS = call.getString("server", null);
+        Integer accessControl = call.getInt("accessControl", 0);
 
-        if (username != null && password != null && KEY_ALIAS != null) {
+        if (username == null || password == null || KEY_ALIAS == null) {
+            call.reject("Missing properties");
+            return;
+        }
+
+        if (accessControl != null && accessControl > 0) {
+            Intent intent = new Intent(getContext(), AuthActivity.class);
+            intent.putExtra("mode", "setSecureCredentials");
+            intent.putExtra("server", KEY_ALIAS);
+            intent.putExtra("username", username);
+            intent.putExtra("password", password);
+            intent.putExtra("accessControl", accessControl);
+            intent.putExtra("title", "Protect Credentials");
+            intent.putExtra("negativeButtonText", "Cancel");
+            startActivityForResult(call, intent, "setSecureCredentialsResult");
+        } else {
             try {
                 SharedPreferences.Editor editor = getContext()
                     .getSharedPreferences(NATIVE_BIOMETRIC_SHARED_PREFERENCES, Context.MODE_PRIVATE)
@@ -260,13 +276,40 @@ public class NativeBiometric extends Plugin {
                 call.resolve();
             } catch (GeneralSecurityException | IOException e) {
                 call.reject("Failed to save credentials", e);
-                System.out.println("Error saving credentials: " + e.getMessage());
             }
-        } else {
-            call.reject("Missing properties");
         }
     }
 
+    @PluginMethod
+    public void getSecureCredentials(final PluginCall call) {
+        String server = call.getString("server", null);
+        if (server == null) {
+            call.reject("No server name was provided");
+            return;
+        }
+
+        SharedPreferences sharedPreferences = getContext().getSharedPreferences(NATIVE_BIOMETRIC_SHARED_PREFERENCES, Context.MODE_PRIVATE);
+        String encryptedData = sharedPreferences.getString("secure_" + server, null);
+        if (encryptedData == null) {
+            call.reject("No protected credentials found", "21");
+            return;
+        }
+
+        Intent intent = new Intent(getContext(), AuthActivity.class);
+        intent.putExtra("mode", "getSecureCredentials");
+        intent.putExtra("server", server);
+        intent.putExtra("title", call.getString("title", "Authenticate"));
+
+        String subtitle = call.getString("subtitle");
+        if (subtitle != null) intent.putExtra("subtitle", subtitle);
+        String description = call.getString("description");
+        if (description != null) intent.putExtra("description", description);
+        String negativeText = call.getString("negativeButtonText");
+        if (negativeText != null) intent.putExtra("negativeButtonText", negativeText);
+
+        startActivityForResult(call, intent, "getSecureCredentialsResult");
+    }
+
     @PluginMethod
     public void getCredentials(final PluginCall call) {
         String KEY_ALIAS = call.getString("server", null);
@@ -318,6 +361,41 @@ public class NativeBiometric extends Plugin {
         }
     }
 
+    @ActivityCallback
+    private void setSecureCredentialsResult(PluginCall call, ActivityResult result) {
+        if (result.getResultCode() == Activity.RESULT_OK) {
+            Intent data = result.getData();
+            if (data != null && "success".equals(data.getStringExtra("result"))) {
+                call.resolve();
+            } else {
+                String errorCode = data != null ? data.getStringExtra("errorCode") : "0";
+                String errorDetails = data != null ? data.getStringExtra("errorDetails") : "Failed to store credentials";
+                call.reject(errorDetails, errorCode);
+            }
+        } else {
+            call.reject("Failed to store credentials");
+        }
+    }
+
+    @ActivityCallback
+    private void getSecureCredentialsResult(PluginCall call, ActivityResult result) {
+        if (result.getResultCode() == Activity.RESULT_OK) {
+            Intent data = result.getData();
+            if (data != null && "success".equals(data.getStringExtra("result"))) {
+                JSObject jsObject = new JSObject();
+                jsObject.put("username", data.getStringExtra("username"));
+                jsObject.put("password", data.getStringExtra("password"));
+                call.resolve(jsObject);
+            } else {
+                String errorCode = data != null ? data.getStringExtra("errorCode") : "0";
+                String errorDetails = data != null ? data.getStringExtra("errorDetails") : "Authentication failed";
+                call.reject(errorDetails, errorCode);
+            }
+        } else {
+            call.reject("Authentication failed");
+        }
+    }
+
     @PluginMethod
     public void deleteCredentials(final PluginCall call) {
         String KEY_ALIAS = call.getString("server", null);
@@ -330,6 +408,13 @@ public class NativeBiometric extends Plugin {
                     .edit();
                 editor.clear();
                 editor.apply();
+
+                try {
+                    getKeyStore().deleteEntry("NativeBiometricSecure_" + KEY_ALIAS);
+                } catch (KeyStoreException e) {
+                    // Ignore — may not exist
+                }
+
                 call.resolve();
             } catch (KeyStoreException | CertificateException | NoSuchAlgorithmException | IOException e) {
                 call.reject("Failed to delete", e);
@@ -351,8 +436,11 @@ public class NativeBiometric extends Plugin {
             String username = sharedPreferences.getString(KEY_ALIAS + "-username", null);
             String password = sharedPreferences.getString(KEY_ALIAS + "-password", null);
 
+            boolean hasUnprotected = username != null && password != null;
+            boolean hasProtected = sharedPreferences.getString("secure_" + KEY_ALIAS, null) != null;
+
             JSObject ret = new JSObject();
-            ret.put("isSaved", username != null && password != null);
+            ret.put("isSaved", hasUnprotected || hasProtected);
             call.resolve(ret);
         } else {
             call.reject("No server name was provided");

package/dist/docs.json

@@ -222,6 +222,41 @@
         ],
         "slug": "deletecredentials"
       },
+      {
+        "name": "getSecureCredentials",
+        "signature": "(options: GetSecureCredentialsOptions) => Promise<Credentials>",
+        "parameters": [
+          {
+            "name": "options",
+            "docs": "",
+            "type": "GetSecureCredentialsOptions"
+          }
+        ],
+        "returns": "Promise<Credentials>",
+        "tags": [
+          {
+            "name": "param",
+            "text": "options"
+          },
+          {
+            "name": "returns"
+          },
+          {
+            "name": "memberof",
+            "text": "NativeBiometricPlugin"
+          },
+          {
+            "name": "since",
+            "text": "8.4.0"
+          }
+        ],
+        "docs": "Gets the stored credentials for a given server, requiring biometric authentication.\nCredentials must have been stored with accessControl set to BIOMETRY_CURRENT_SET or BIOMETRY_ANY.\n\nOn iOS, the system automatically shows the biometric prompt when accessing the protected Keychain item.\nOn Android, BiometricPrompt is shown with a CryptoObject bound to the credential decryption key.",
+        "complexTypes": [
+          "Credentials",
+          "GetSecureCredentialsOptions"
+        ],
+        "slug": "getsecurecredentials"
+      },
       {
         "name": "isCredentialsSaved",
         "signature": "(options: IsCredentialsSavedOptions) => Promise<IsCredentialsSavedResult>",
@@ -524,6 +559,24 @@
           "docs": "",
           "complexTypes": [],
           "type": "string"
+        },
+        {
+          "name": "accessControl",
+          "tags": [
+            {
+              "text": "AccessControl.NONE",
+              "name": "default"
+            },
+            {
+              "text": "8.4.0",
+              "name": "since"
+            }
+          ],
+          "docs": "Access control level for the stored credentials.\nWhen set to BIOMETRY_CURRENT_SET or BIOMETRY_ANY, the credentials are\nhardware-protected and require biometric authentication to access.\n\nOn iOS, this adds SecAccessControl to the Keychain item.\nOn Android, this creates a biometric-protected Keystore key and requires\nBiometricPrompt authentication for both storing and retrieving credentials.",
+          "complexTypes": [
+            "AccessControl"
+          ],
+          "type": "AccessControl"
         }
       ]
     },
@@ -543,6 +596,57 @@
         }
       ]
     },
+    {
+      "name": "GetSecureCredentialsOptions",
+      "slug": "getsecurecredentialsoptions",
+      "docs": "",
+      "tags": [],
+      "methods": [],
+      "properties": [
+        {
+          "name": "server",
+          "tags": [],
+          "docs": "",
+          "complexTypes": [],
+          "type": "string"
+        },
+        {
+          "name": "reason",
+          "tags": [],
+          "docs": "Reason for requesting biometric authentication.\nDisplayed in the biometric prompt on both iOS and Android.",
+          "complexTypes": [],
+          "type": "string | undefined"
+        },
+        {
+          "name": "title",
+          "tags": [],
+          "docs": "Title for the biometric prompt.\nOnly for Android.",
+          "complexTypes": [],
+          "type": "string | undefined"
+        },
+        {
+          "name": "subtitle",
+          "tags": [],
+          "docs": "Subtitle for the biometric prompt.\nOnly for Android.",
+          "complexTypes": [],
+          "type": "string | undefined"
+        },
+        {
+          "name": "description",
+          "tags": [],
+          "docs": "Description for the biometric prompt.\nOnly for Android.",
+          "complexTypes": [],
+          "type": "string | undefined"
+        },
+        {
+          "name": "negativeButtonText",
+          "tags": [],
+          "docs": "Text for the negative/cancel button.\nOnly for Android.",
+          "complexTypes": [],
+          "type": "string | undefined"
+        }
+      ]
+    },
     {
       "name": "IsCredentialsSavedResult",
       "slug": "iscredentialssavedresult",
@@ -738,6 +842,30 @@
           "docs": "User chose to use fallback authentication method\nPlatform: Android, iOS"
         }
       ]
+    },
+    {
+      "name": "AccessControl",
+      "slug": "accesscontrol",
+      "members": [
+        {
+          "name": "NONE",
+          "value": "0",
+          "tags": [],
+          "docs": "No biometric protection. Credentials are accessible without authentication.\nThis is the default behavior for backward compatibility."
+        },
+        {
+          "name": "BIOMETRY_CURRENT_SET",
+          "value": "1",
+          "tags": [],
+          "docs": "Biometric authentication required for credential access.\nCredentials are invalidated if biometrics change (e.g., new fingerprint enrolled).\nMore secure but credentials are lost if user modifies their biometric enrollment."
+        },
+        {
+          "name": "BIOMETRY_ANY",
+          "value": "2",
+          "tags": [],
+          "docs": "Biometric authentication required for credential access.\nCredentials survive new biometric enrollment (e.g., adding a new fingerprint).\nMore lenient — recommended for most apps."
+        }
+      ]
     }
   ],
   "typeAliases": [