App lock (one setting)
Set enableBioMetricAuth to true in Config.swift / Config.java and the app asks for Face ID, Touch ID or the fingerprint every time it opens. Nothing to change in Bolt.
Two ways to use biometrics
JavaScript API (bioauth://)
Call bioauth:// from your web app before showing a sensitive screen; WebViewGold calls onBioAuthSuccess(), onBioAuthFailure(code, message) or onBioAuthUnavailable() in your page. Combine with your Supabase Auth (email, magic links, Google, GitHub) via the built-in Supabase integration session for a "unlock with your face" login.
A visible native feature
Biometric login is one of the clearest answers to Apple's Guideline 4.2: it is something a Safari tab cannot do, and reviewers notice it on the first screen.
Prompt for Bolt
Paste this into Bolt to implement the web-app side. Review the result, publish, then test inside the WebViewGold app.
Prompt to paste into Bolt
Add a biometric lock screen for the WebViewGold app wrapper. Create a component BiometricGate rendered in the root layout above all routes. When the user enabled the lock (setting stored in Supabase user metadata) and navigator.userAgent contains my custom WebViewGold token, show a full-screen overlay on mount and when the tab becomes visible again, then set window.location.href to bioauth://. In a useEffect assign window.onBioAuthSuccess (hide the overlay), window.onBioAuthFailure(errorCode, errorMessage) (show the message with a Retry button) and window.onBioAuthUnavailable (disable the setting and hide the overlay). Add the toggle to the Settings page. Do nothing in normal browsers.
I am very happy I bought this app! Extremely easy and great documentation. Was in contact with the customer service, they replied very quickly and very friendly. They solved my question within a day. 10/10 would recommend.
Add biometric unlock to a Bolt app
About 15 minutes.
Decide what to protect
Whole app (app lock) or specific screens such as account settings, payment details, health data or a private journal (JavaScript API). Many apps combine both: lock on launch, re-check before sensitive actions.
Add the Face ID usage description (iOS)
In the WebViewGold Xcode project add the "Privacy – Face ID Usage Description" key to Info.plist with a sentence that explains why the app uses Face ID. Without it Face ID is not available. The Cloud Builder has a field for this text.
Implement the callbacks in Bolt
Define
onBioAuthSuccess,onBioAuthFailureandonBioAuthUnavailableas global JavaScript functions and navigate tobioauth://when the protected screen loads. Show the screen on success, a fallback (password) otherwise.Keep the session alive
Biometrics replace typing the password, not the session: keep the user logged in with Supabase Auth (email, magic links, Google, GitHub) via the built-in Supabase integration and use the biometric check as a local gate. Never grant access on the web side without the native callback.
Test on real devices
Simulators can enroll a fake Face ID (Features → Face ID), but test on an iPhone and an Android phone with a fingerprint, including the "no biometrics enrolled" case.
The JavaScript side
Paste into your Bolt app (or let it generate the equivalent in your framework):
javascript
function onBioAuthSuccess() {
document.body.classList.remove("locked");
}
function onBioAuthFailure(errorCode, errorMessage) {
showPasswordFallback(errorMessage);
}
function onBioAuthUnavailable() {
showPasswordFallback("Biometrics not available on this device");
}
// ask for Face ID / fingerprint when the protected screen opens
if (navigator.userAgent.includes("WebViewGold")) {
window.location.href = "bioauth://";
}Security notes
- The callback runs in your page, so treat it as a UI gate, not as proof of identity: anything that must be secure stays behind your backend session in Supabase, Firebase or your own API.
- Offer a fallback (password or PIN) for devices without biometrics and for users who declined Face ID permission; WebViewGold reports that case through
onBioAuthUnavailable(). - Only call
bioauth://inside the app: detect WebViewGold's custom user agent, otherwise the browser shows an error for the unknown scheme.
Frequently asked questions
Do I need Face ID for App Store review?
No, but it helps. Guideline 4.2 asks for functionality beyond a website; biometric login, push notifications and offline handling are the native features reviewers see first.
Does it work with my Bolt login?
Yes. The biometric check is independent of the auth provider: Supabase Auth (email, magic links, Google, GitHub) via the built-in Supabase integration keeps the session, WebViewGold adds the local unlock in front of it.
What if the user has no Face ID set up?
iOS falls back to the device passcode in the app-lock mode; with the JavaScript API you get onBioAuthUnavailable() and show your own fallback.
Does Android support it the same way?
Yes. The same bioauth:// call and callbacks work on Android with fingerprint or face unlock, and the app-lock setting exists in Config.java as well.
Three ways to get your app into the stores
Same result, different amount of work on your side. All three come with the approval guarantee and 24/7 human support.
Do it yourself
$109 per platform, one-time
The WebViewGold license: a finished Xcode or Android Studio project. Paste your URL, set name and icon, switch on features, build and submit. Free updates forever.
See plans on the main pageCloud Builder
$349 per license, one-time add-on
No Mac, no Xcode, no Android Studio: configure in the browser, we build both apps in the cloud and hand them to App Store Connect and the Play Console.
How the Cloud Builder works Try the free demoFull Service
$698 per platform $798
Send us your URL and icon. Our team configures, builds and delivers your app within 72 hours, white-label, with source projects. Both platforms for $1,158.
Full Service details Powered by
Winter Sale prices valid until December 31, 2026.