App lock (one setting)
Set enableBioMetricAuth to true in Config.swift / Config.java and the app asks for Face ID, Touch ID or the fingerprint every time it opens. Nothing to change in Cursor.
Two ways to use biometrics
JavaScript API (bioauth://)
Call bioauth:// from your web app before showing a sensitive screen; WebViewGold calls onBioAuthSuccess(), onBioAuthFailure(code, message) or onBioAuthUnavailable() in your page. Combine with your Whatever you built: Auth.js, Clerk, Supabase, Firebase or sessions session for a "unlock with your face" login.
A visible native feature
Biometric login is one of the clearest answers to Apple's Guideline 4.2: it is something a Safari tab cannot do, and reviewers notice it on the first screen.
Prompt for Cursor
Paste this into Cursor to implement the web-app side. Review the result, publish, then test inside the WebViewGold app.
Prompt for the Cursor agent
Prompt for the Cursor agent: Add a biometric gate for the WebViewGold app wrapper. Create src/hooks/useBiometricGate.ts returning { locked, unlock, error }. When enabled (user preference stored with our backend) and navigator.userAgent contains my custom WebViewGold token, it shows a lock overlay and sets window.location.href to bioauth://. It must assign window.onBioAuthSuccess, window.onBioAuthFailure(errorCode, errorMessage) and window.onBioAuthUnavailable as globals, cleaned up on unmount. Apply the hook to the account and billing routes. Add a settings toggle. Write a unit test that invokes the window callbacks and checks the state. Add a .cursor/rules note that WebViewGold callbacks must be window globals.
WebViewGold has allowed us the shortest and most efficient time-to-market ever possible from among all the other app platforms we have ever tried during the past 5 years. I don’t know why I hadn’t discovered you sooner, but I am really, really glad I did. Currently nearing 6000 app downloads on both iOS App Store & Google Play Store without any problem!
Add biometric unlock to a Cursor app
About 15 minutes.
Decide what to protect
Whole app (app lock) or specific screens such as account settings, payment details, health data or a private journal (JavaScript API). Many apps combine both: lock on launch, re-check before sensitive actions.
Add the Face ID usage description (iOS)
In the WebViewGold Xcode project add the "Privacy – Face ID Usage Description" key to Info.plist with a sentence that explains why the app uses Face ID. Without it Face ID is not available. The Cloud Builder has a field for this text.
Implement the callbacks in Cursor
Define
onBioAuthSuccess,onBioAuthFailureandonBioAuthUnavailableas global JavaScript functions and navigate tobioauth://when the protected screen loads. Show the screen on success, a fallback (password) otherwise.Keep the session alive
Biometrics replace typing the password, not the session: keep the user logged in with Whatever you built: Auth.js, Clerk, Supabase, Firebase or sessions and use the biometric check as a local gate. Never grant access on the web side without the native callback.
Test on real devices
Simulators can enroll a fake Face ID (Features → Face ID), but test on an iPhone and an Android phone with a fingerprint, including the "no biometrics enrolled" case.
The JavaScript side
Paste into your Cursor app (or let it generate the equivalent in your framework):
javascript
function onBioAuthSuccess() {
document.body.classList.remove("locked");
}
function onBioAuthFailure(errorCode, errorMessage) {
showPasswordFallback(errorMessage);
}
function onBioAuthUnavailable() {
showPasswordFallback("Biometrics not available on this device");
}
// ask for Face ID / fingerprint when the protected screen opens
if (navigator.userAgent.includes("WebViewGold")) {
window.location.href = "bioauth://";
}Security notes
- The callback runs in your page, so treat it as a UI gate, not as proof of identity: anything that must be secure stays behind your backend session in Your own API routes or services.
- Offer a fallback (password or PIN) for devices without biometrics and for users who declined Face ID permission; WebViewGold reports that case through
onBioAuthUnavailable(). - Only call
bioauth://inside the app: detect WebViewGold's custom user agent, otherwise the browser shows an error for the unknown scheme.
Frequently asked questions
Do I need Face ID for App Store review?
No, but it helps. Guideline 4.2 asks for functionality beyond a website; biometric login, push notifications and offline handling are the native features reviewers see first.
Does it work with my Cursor login?
Yes. The biometric check is independent of the auth provider: Whatever you built: Auth.js, Clerk, Supabase, Firebase or sessions keeps the session, WebViewGold adds the local unlock in front of it.
What if the user has no Face ID set up?
iOS falls back to the device passcode in the app-lock mode; with the JavaScript API you get onBioAuthUnavailable() and show your own fallback.
Does Android support it the same way?
Yes. The same bioauth:// call and callbacks work on Android with fingerprint or face unlock, and the app-lock setting exists in Config.java as well.
Three ways to get your app into the stores
Same result, different amount of work on your side. All three come with the approval guarantee and 24/7 human support.
Do it yourself
$109 per platform, one-time
The WebViewGold license: a finished Xcode or Android Studio project. Paste your URL, set name and icon, switch on features, build and submit. Free updates forever.
See plans on the main pageCloud Builder
$349 per license, one-time add-on
No Mac, no Xcode, no Android Studio: configure in the browser, we build both apps in the cloud and hand them to App Store Connect and the Play Console.
How the Cloud Builder works Try the free demoFull Service
$698 per platform $798
Send us your URL and icon. Our team configures, builds and delivers your app within 72 hours, white-label, with source projects. Both platforms for $1,158.
Full Service details Powered by
Winter Sale prices valid until December 31, 2026.