Step 01
Step 1
Set a 6-digit PIN during first sign-in; it lives on the device alongside the session token.
Auth & IDRetail
6-digit app PIN.
A 6-digit PIN that gates the app — works when biometrics are off or unavailable.
The problem
Why this exists.
Not every Android phone in India has a working fingerprint reader; many users opt out of biometrics on principle.
We still want a fast lock between a stolen-but-unlocked phone and your finance data.
How it works · 3 steps
From input to outcome.
- Step 02
Step 2
The PIN is the fallback when biometrics fail and the primary gate when biometrics are off.
- Step 03
Step 3
Five wrong entries wipe the local session — sign in again from scratch with phone-OTP.
Under the hood
The models and routes behind it.
Models called
No models cite this feature directly — backing logic is deterministic Python.
API routes
- POST /api/v1/auth
Compliance posture
- PIN is stored on-device only; never transmitted to Mukodi servers.
- Server-side rate-limit on phone-OTP retry catches the case where PIN failure forces a fresh sign-in.
- DPDP-aligned control — PIN can be reset from /settings/security at any time.
What it's not
The PIN is a local gate, not multi-factor authentication. For destructive admin or partner-portal actions, see totp-mfa.
Related · features & stories