App lock (one setting)
Set enableBioMetricAuth to true in Config.swift / Config.java and the app asks for Face ID, Touch ID or the fingerprint every time it opens. Nothing to change in ChatGPT & Codex.
Two ways to use biometrics
JavaScript API (bioauth://)
Call bioauth:// from your web app before showing a sensitive screen; WebViewGold calls onBioAuthSuccess(), onBioAuthFailure(code, message) or onBioAuthUnavailable() in your page. Combine with your Whatever you built: Supabase, Clerk, Auth.js, Firebase session for a "unlock with your face" login.
A visible native feature
Biometric login is one of the clearest answers to Apple's Guideline 4.2: it is something a Safari tab cannot do, and reviewers notice it on the first screen.
Prompt for ChatGPT & Codex
Paste this into ChatGPT & Codex to implement the web-app side. Review the result, publish, then test inside the WebViewGold app.
Prompt for ChatGPT or Codex
Prompt for Codex: Add a biometric gate for the WebViewGold app wrapper and open a pull request. When the user enabled Protect my chats in settings and navigator.userAgent contains my custom WebViewGold token, cover the chat and history screens with a lock overlay and set window.location.href to bioauth://. Register window.onBioAuthSuccess (remove the overlay for this session), window.onBioAuthFailure(errorCode, errorMessage) (show the message and a Retry button) and window.onBioAuthUnavailable (hide the overlay and ask for the account password instead). Skip the gate entirely in normal browsers. Add a test that triggers the window callbacks. Document the callback contract in AGENTS.md.
Great way of converting your web app to a native app! Fast turn-around, and a great way to get your apps into the app stores without the need to develop a full native app!
Add biometric unlock to a ChatGPT & Codex app
About 15 minutes.
Decide what to protect
Whole app (app lock) or specific screens such as account settings, payment details, health data or a private journal (JavaScript API). Many apps combine both: lock on launch, re-check before sensitive actions.
Add the Face ID usage description (iOS)
In the WebViewGold Xcode project add the "Privacy – Face ID Usage Description" key to Info.plist with a sentence that explains why the app uses Face ID. Without it Face ID is not available. The Cloud Builder has a field for this text.
Implement the callbacks in ChatGPT & Codex
Define
onBioAuthSuccess,onBioAuthFailureandonBioAuthUnavailableas global JavaScript functions and navigate tobioauth://when the protected screen loads. Show the screen on success, a fallback (password) otherwise.Keep the session alive
Biometrics replace typing the password, not the session: keep the user logged in with Whatever you built: Supabase, Clerk, Auth.js, Firebase and use the biometric check as a local gate. Never grant access on the web side without the native callback.
Test on real devices
Simulators can enroll a fake Face ID (Features → Face ID), but test on an iPhone and an Android phone with a fingerprint, including the "no biometrics enrolled" case.
The JavaScript side
Paste into your ChatGPT & Codex app (or let it generate the equivalent in your framework):
javascript
function onBioAuthSuccess() {
document.body.classList.remove("locked");
}
function onBioAuthFailure(errorCode, errorMessage) {
showPasswordFallback(errorMessage);
}
function onBioAuthUnavailable() {
showPasswordFallback("Biometrics not available on this device");
}
// ask for Face ID / fingerprint when the protected screen opens
if (navigator.userAgent.includes("WebViewGold")) {
window.location.href = "bioauth://";
}Security notes
- The callback runs in your page, so treat it as a UI gate, not as proof of identity: anything that must be secure stays behind your backend session in Your own API or serverless functions.
- Offer a fallback (password or PIN) for devices without biometrics and for users who declined Face ID permission; WebViewGold reports that case through
onBioAuthUnavailable(). - Only call
bioauth://inside the app: detect WebViewGold's custom user agent, otherwise the browser shows an error for the unknown scheme.
Frequently asked questions
Do I need Face ID for App Store review?
No, but it helps. Guideline 4.2 asks for functionality beyond a website; biometric login, push notifications and offline handling are the native features reviewers see first.
Does it work with my ChatGPT & Codex login?
Yes. The biometric check is independent of the auth provider: Whatever you built: Supabase, Clerk, Auth.js, Firebase keeps the session, WebViewGold adds the local unlock in front of it.
What if the user has no Face ID set up?
iOS falls back to the device passcode in the app-lock mode; with the JavaScript API you get onBioAuthUnavailable() and show your own fallback.
Does Android support it the same way?
Yes. The same bioauth:// call and callbacks work on Android with fingerprint or face unlock, and the app-lock setting exists in Config.java as well.
Three ways to get your app into the stores
Same result, different amount of work on your side. All three come with the approval guarantee and 24/7 human support.
Do it yourself
$109 per platform, one-time
The WebViewGold license: a finished Xcode or Android Studio project. Paste your URL, set name and icon, switch on features, build and submit. Free updates forever.
See plans on the main pageCloud Builder
$349 per license, one-time add-on
No Mac, no Xcode, no Android Studio: configure in the browser, we build both apps in the cloud and hand them to App Store Connect and the Play Console.
How the Cloud Builder works Try the free demoFull Service
$698 per platform $798
Send us your URL and icon. Our team configures, builds and delivers your app within 72 hours, white-label, with source projects. Both platforms for $1,158.
Full Service details Powered by
Winter Sale prices valid until December 31, 2026.