Cordova Plugin: https://github.com/tamour/cordova-plugin-secure-biometric-key-auth

The plugin exposes the cordova.plugins.SecureBiometricKeyAuth interface. All methods use standard success and error callbacks:

Generates a hardware-backed EC key pair locked behind biometric access control. Returns the Base64-encoded public key upon success. Overwrites any existing key with the same alias.

• Input: alias (String): Unique identifier for the key stored in the native device Keychain/KeyStore.
• Output: PublicKey (String): The Base64-encoded public key generated or retrieved from the device (iOS outputs raw ANSI X9.63 uncompressed point format, while Android outputs DER SubjectPublicKeyInfo format).
• Output: IsSuccess (Boolean): Set to true if the key operation completed successfully, or false if an error occurred.
• Output: ErrorMessage (String): Contains a detailed description of the error if IsSuccess is false (e.g., key generation failed, access denied); remains an empty string ("") on success.

Retrieves an existing public key previously generated and stored in the hardware keystore.

• Input: alias (String): Unique identifier of the target key pair.
• Output: PublicKey (String): The Base64-encoded public key generated or retrieved from the device (iOS outputs raw ANSI X9.63 uncompressed point format, while Android outputs DER SubjectPublicKeyInfo format).
• Output: IsSuccess (Boolean): Set to true if the key operation completed successfully, or false if an error occurred.
• Output: ErrorMessage (String): Contains a detailed description of the error if IsSuccess is false (e.g., key generation failed, access denied); remains an empty string ("") on success.

Prompts the system biometric dialog (Face ID / Fingerprint). Upon successful biometric verification, signs the provided server challenge string using the device's private key.

• Input: alias (String): Unique identifier for the key stored in the native device Keychain/KeyStore.
• Input: challengeText (String): The nonce or raw text payload sent by the server to be signed.
• Input: promptTitle (String): The title displayed on the native system biometric dialog (e.g., "Authenticate to Login").
• Output: Signature (String): The Base64-encoded digital signature generated by the private key using SHA256withECDSA (ASN.1 DER format).
• Output: IsSuccess (Boolean): Set to true if biometric authentication succeeded and the payload was signed, or false if the process failed or was canceled.
• Output: ErrorMessage (String): Contains a detailed description of the error if IsSuccess is false (e.g., biometric prompt canceled by user, biometrics failed, key not found); remains an empty string ("") on success.