This article was accepted into the corpus but its outbound wikilinks were never NER-processed — typical at the deepest BFS hop or when the run's entity cap was reached. No expansion funnel to show.
| Android Fingerprint API | |
|---|---|
| Name | Android Fingerprint API |
| Developer | |
| Released | 2015 |
| Latest release | Android 13 |
| Programming language | Java, Kotlin, C++ |
| Platform | Android |
| License | Apache License 2.0 |
Android Fingerprint API
The Android Fingerprint API is a mobile biometric interface introduced by Google to enable fingerprint authentication for apps and system services on the Android platform. It provides an abstraction layer between application code and on-device secure hardware, enabling developers to authenticate users for actions such as unlocking, payments, and credential management across devices from vendors like Samsung Electronics, Huawei, Xiaomi, and OnePlus. The API interacts with platform services, Trusted Execution Environments from vendors such as Qualcomm and MediaTek, and standards bodies like the FIDO Alliance.
The API exposes fingerprint enrollment and authentication flows through high-level classes designed for use in Android apps written in Java and Kotlin. It integrates with system components such as Android Keystore System, Keymaster, and Trusted Execution Environment implementations from chipset vendors including ARM Holdings designs. Early adoption tied fingerprint use to device unlock and payment scenarios involving partners like Google Pay and Samsung Pay, while later standards from the FIDO Alliance and World Wide Web Consortium influenced cross-platform authentication via WebAuthn.
Fingerprint support arrived on consumer smartphones from manufacturers such as Motorola and HTC before standardization efforts led by Google culminated in the API introduced in Android 6.0 (Marshmallow). Subsequent changes across Android 7.0 (Nougat), Android 8.0 (Oreo), Android 9 (Pie), Android 10, Android 11, Android 12, and Android 13 adjusted the API surface to emphasize security and privacy. Industry events, standards negotiations at the FIDO Alliance and updates to the Payment Card Industry Data Security Standard influenced integration with wallet services like Google Wallet and Visa. Litigation and regulatory scrutiny surrounding biometric data in jurisdictions such as the European Union shaped vendor and platform policies.
The architecture comprises application frameworks in Android Open Source Project, system services such as FingerprintService, and hardware abstraction implemented via Hardware Abstraction Layer modules. Core components include the fingerprint sensor hardware from manufacturers like Synaptics, Goodix, and ELAN Microelectronics; cryptographic modules such as Keymaster; secure storage provided by the Android Keystore; and user-facing UI provided by OEMs like LG Electronics and Sony. The API interoperates with biometric modalities under the BiometricPrompt umbrella and references secure execution environments like TrustZone and processor vendors Qualcomm and MediaTek implementations.
Access to fingerprint functionality requires runtime permissions granted by users as defined in Android's permission model and is mediated by system dialogs and OEM UX policies from vendors such as Samsung Electronics and Google. The security model binds biometric authentication to keys stored in Android Keystore System protected by Keymaster which can require User Authentication for operations with protection levels influenced by hardware-backed attestation from Google Play Services and attestation keys from Android Verified Boot. Threat models considered during design reference standards promoted by the National Institute of Standards and Technology and compliance regimes such as General Data Protection Regulation in the European Union.
Developers invoke the API through framework classes, migrating newer apps toward unified interfaces like BiometricPrompt that subsume earlier classes. Typical implementation steps include checking hardware support declared by OEMs in device manifests, requesting user enrollment status, creating asymmetric keys via Android Keystore, and prompting authentication through system-controlled dialogs. Sample integrations exist in SDKs from payment partners like PayPal, authentication vendors such as Okta and Auth0, and app frameworks including Flutter (software), React Native, and Xamarin (software) which provide cross-platform bindings.
Best practices recommend using hardware-backed keys with user authentication binding, relying on system-controlled flows rather than raw sensor data, and employing attestation for high-value transactions as advocated by FIDO Alliance and guidance from NIST. Developers should avoid storing biometric templates, prefer strong key protection policies in Android Keystore, and plan for fallback authentication such as Password or PIN enforced by platform policies. Security researchers from institutions such as University of Cambridge and companies like Google and Apple have published findings urging multi-layered defenses, threat modeling for sensor spoofing from entities like Chaos Computer Club, and adherence to regional laws like the California Consumer Privacy Act.
Implementation and capabilities vary across OEMs and chipset vendors: devices from Samsung Electronics and Google Pixel devices may offer different sensor types and attestation behaviors than devices from Xiaomi, Huawei, or OnePlus. Older releases of Android relied on legacy APIs with vendor-specific HAL implementations, while modern apps should target the unified BiometricPrompt from newer Android releases. Compatibility matrices are influenced by hardware vendors such as Synaptics, Goodix, FPC and carriers or retailers like Verizon Communications and AT&T which certify device features for services.
Category:Android APIs