App lock (one setting)
Set enableBioMetricAuth to true in Config.swift / Config.java and the app asks for Face ID, Touch ID or the fingerprint every time it opens. Nothing to change in Replit.
Two ways to use biometrics
JavaScript API (bioauth://)
Call bioauth:// from your web app before showing a sensitive screen; WebViewGold calls onBioAuthSuccess(), onBioAuthFailure(code, message) or onBioAuthUnavailable() in your page. Combine with your Replit Auth, Supabase Auth or your own session logic session for a "unlock with your face" login.
A visible native feature
Biometric login is one of the clearest answers to Apple's Guideline 4.2: it is something a Safari tab cannot do, and reviewers notice it on the first screen.
Prompt for Replit
Paste this into Replit to implement the web-app side. Review the result, publish, then test inside the WebViewGold app.
Prompt to paste into Replit Agent
Add biometric protection for the WebViewGold app wrapper. Create a React hook useBiometricGate(pageName) that, when navigator.userAgent contains my custom WebViewGold token and the user enabled Require biometrics in Settings (stored in the users table via PATCH /api/me), shows a blocking overlay and sets window.location.href to bioauth://. Register window.onBioAuthSuccess (remove the overlay, remember success for 5 minutes in sessionStorage), window.onBioAuthFailure(errorCode, errorMessage) (show the message with a Retry button) and window.onBioAuthUnavailable (hide the overlay and show a password prompt instead). Apply the hook to the Orders and Settings pages. Keep the Express session untouched.
With a good optimized version of your web app you can have a stunning mobile app within a couple of minutes. Additionally to that the customer service is very nice and very helpful! I can just recommend WebViewGold :-)
Add biometric unlock to a Replit app
About 15 minutes.
Decide what to protect
Whole app (app lock) or specific screens such as account settings, payment details, health data or a private journal (JavaScript API). Many apps combine both: lock on launch, re-check before sensitive actions.
Add the Face ID usage description (iOS)
In the WebViewGold Xcode project add the "Privacy – Face ID Usage Description" key to Info.plist with a sentence that explains why the app uses Face ID. Without it Face ID is not available. The Cloud Builder has a field for this text.
Implement the callbacks in Replit
Define
onBioAuthSuccess,onBioAuthFailureandonBioAuthUnavailableas global JavaScript functions and navigate tobioauth://when the protected screen loads. Show the screen on success, a fallback (password) otherwise.Keep the session alive
Biometrics replace typing the password, not the session: keep the user logged in with Replit Auth, Supabase Auth or your own session logic and use the biometric check as a local gate. Never grant access on the web side without the native callback.
Test on real devices
Simulators can enroll a fake Face ID (Features → Face ID), but test on an iPhone and an Android phone with a fingerprint, including the "no biometrics enrolled" case.
The JavaScript side
Paste into your Replit app (or let it generate the equivalent in your framework):
javascript
function onBioAuthSuccess() {
document.body.classList.remove("locked");
}
function onBioAuthFailure(errorCode, errorMessage) {
showPasswordFallback(errorMessage);
}
function onBioAuthUnavailable() {
showPasswordFallback("Biometrics not available on this device");
}
// ask for Face ID / fingerprint when the protected screen opens
if (navigator.userAgent.includes("WebViewGold")) {
window.location.href = "bioauth://";
}Security notes
- The callback runs in your page, so treat it as a UI gate, not as proof of identity: anything that must be secure stays behind your backend session in Express/Flask/FastAPI backends with Replit Postgres or external databases.
- Offer a fallback (password or PIN) for devices without biometrics and for users who declined Face ID permission; WebViewGold reports that case through
onBioAuthUnavailable(). - Only call
bioauth://inside the app: detect WebViewGold's custom user agent, otherwise the browser shows an error for the unknown scheme.
Frequently asked questions
Do I need Face ID for App Store review?
No, but it helps. Guideline 4.2 asks for functionality beyond a website; biometric login, push notifications and offline handling are the native features reviewers see first.
Does it work with my Replit login?
Yes. The biometric check is independent of the auth provider: Replit Auth, Supabase Auth or your own session logic keeps the session, WebViewGold adds the local unlock in front of it.
What if the user has no Face ID set up?
iOS falls back to the device passcode in the app-lock mode; with the JavaScript API you get onBioAuthUnavailable() and show your own fallback.
Does Android support it the same way?
Yes. The same bioauth:// call and callbacks work on Android with fingerprint or face unlock, and the app-lock setting exists in Config.java as well.
Three ways to get your app into the stores
Same result, different amount of work on your side. All three come with the approval guarantee and 24/7 human support.
Do it yourself
$109 per platform, one-time
The WebViewGold license: a finished Xcode or Android Studio project. Paste your URL, set name and icon, switch on features, build and submit. Free updates forever.
See plans on the main pageCloud Builder
$349 per license, one-time add-on
No Mac, no Xcode, no Android Studio: configure in the browser, we build both apps in the cloud and hand them to App Store Connect and the Play Console.
How the Cloud Builder works Try the free demoFull Service
$698 per platform $798
Send us your URL and icon. Our team configures, builds and delivers your app within 72 hours, white-label, with source projects. Both platforms for $1,158.
Full Service details Powered by
Winter Sale prices valid until December 31, 2026.