Step 01
Step 1
Enrol once after first sign-in; the device prompts for fingerprint or face on every cold start.
Auth & IDRetail
Biometric unlock.
Open the app with your device fingerprint or face — biometrics stay on your phone.
The problem
Why this exists.
Typing a PIN every time the app opens is friction users skip by leaving the app permanently signed in.
We want re-authentication that is fast enough to be honest about (every cold-start) without being slow enough to be turned off.
How it works · 3 steps
From input to outcome.
- Step 02
Step 2
Biometric data stays in your phone's secure enclave — Mukodi never sees the template.
- Step 03
Step 3
Fail-open to your 6-digit app PIN after three biometric refusals so a wet finger never locks you out.
Under the hood
The models and routes behind it.
Models called
No models cite this feature directly — backing logic is deterministic Python.
API routes
- POST /api/v1/auth
Compliance posture
- Biometric template never leaves the device; Mukodi receives only a yes/no from the OS.
- DPDP-aligned control — opt-in toggle, can be disabled from /settings/security.
- PIN fallback ensures access is not lost on biometric hardware failure.
What it's not
Biometric unlock confirms a device session; it is not a substitute for documents-kyc when a regulated product needs proof of identity.
Related · features & stories