Biometric Login (Face ID / Fingerprint)

Peer mentors and coordinators open the Meander app multiple times per day to register activities, check contacts, and track assignments. Requiring full password entry on every launch would create significant friction, particularly for users with motor or cognitive disabilities - a core demographic for all four partner organisations. Biometric unlock removes this friction while maintaining security: the refresh token is stored in the device secure enclave and biometric verification happens locally. This directly supports WCAG 2.2 AA goals by reducing cognitive and motor load for high-frequency interactions, and is the authentication pattern explicitly described in the source document for post-login use.

Implemented in Flutter using the local_auth plugin, which abstracts Face ID on iOS and fingerprint/face recognition on Android. On successful biometric verification, the app retrieves the stored refresh token from flutter_secure_storage and silently exchanges it for a new access token via the Authentication Module. No biometric data ever leaves the device; verification is delegated entirely to the OS. If the user has not enrolled biometrics, or cancels the prompt, the app falls back gracefully to password entry without showing an error. If the refresh token has expired or been revoked, the user is redirected to full sign-in regardless of biometric success.