LocalAuthentication

Biometric and device-passcode authentication on Apple platforms (Face ID, Touch ID, Optic ID) via LAContext. The deep API reference — setup, every policy, the full evaluate flow, error mapping, biometric-change detection, Keychain access control, SwiftUI app-lock, and testing — lives in references/guide.md. This file is the decision and discipline layer: read it first, open the guide for specifics.

Dials

Set these explicitly at the start; they change what "correct" means.

1. POLICY — biometrics-only (.deviceOwnerAuthenticationWithBiometrics; fails outright if biometry is unavailable/not enrolled — use when only Face ID/Touch ID is acceptable) · with-passcode (default; .deviceOwnerAuthentication; falls back to the device passcode when biometry fails or is unavailable).
2. SECRET_BINDING — gate-only (the evaluatePolicy Bool just unlocks app UI; no secret is protected — acceptable only for convenience locks) · keychain-bound (the thing being protected is a Keychain item with SecAccessControl flags like .biometryCurrentSet + kSecAttrAccessibleWhenPasscodeSetThisDeviceOnly; required when a real secret/token must be unreachable without auth).
3. REPROMPT — every-access (new LAContext per evaluation, default) · reuse-window (context.touchIDAuthenticationAllowableReuseDuration to skip the prompt for N seconds after a recent success — only for low-sensitivity re-entry).

When to use

Adding or reviewing any biometric/passcode prompt: app lock, transaction confirmation, unlocking stored credentials, or Keychain items guarded by biometry. If the task is account-level identity — Sign in with Apple, passkeys/WebAuthn, the credential picker — that is authenticationservices, not this. LocalAuthentication proves "the device owner is present right now"; it does not establish who the account holder is.

Core rules