Biometric Authentication: Consistency of Prompt Timeouts Across Android OEMs

Question

Implementing least-privilege authentication in Flutter often requires integrating biometric verification via platform-specific plugins. While the framework provides a unified API for triggering these prompts, the underlying behavior depends on the Android OEM's implementation of the BiometricPrompt API.

There is a lack of documented uniformity regarding how different device manufacturers handle biometric prompt timeouts and automatic cancellation. This creates uncertainty when designing the credential refresh flow, as a timeout on one device may trigger a different callback or state than on another, potentially leading to inconsistent user experiences during token expiration events.

Does Flutter provide a mechanism to standardize the biometric timeout duration across different Android OEM implementations?
  Which specific callback states are triggered when a biometric prompt expires due to system-level timeouts versus user cancellation?

Tasadduq Burney · Answer

Answer
No. Flutter does not provide a mechanism to standardize the biometric prompt timeout duration across Android OEM implementations. The timeout is controlled by the device manufacturer's BiometricPrompt implementation, not by Flutter or its platform-channel plugins.
When a prompt ends without authentication success, the callback state depends on the cause:

System-level timeout: onAuthenticationError(BiometricPrompt.ERROR_TIME_OUT, ...)
User cancellation: onAuthenticationError(BiometricPrompt.ERROR_CANCELED, ...)

Confirmed facts

Flutter plugins forward the biometric request to the native Android BiometricPrompt API.
Android defines ERROR_TIME_OUT (code 4) for system timeouts and ERROR_CANCELED (code 6) for user dismissal.
No public Flutter API or common plugin parameter enforces a uniform timeout across OEMs.

Likely explanation
OEMs can set different default timeout intervals and may map automatic dismissal to different error codes or omit cancellation detection on older BiometricPrompt versions. This means a token-refresh flow that assumes one callback for all expirations can behave inconsistently across devices.
Steps for this case

Identify the Flutter biometric plugin in your pubspec.yaml and check whether its native Android code exposes a timeout argument.
If a timeout parameter exists, set it to your target interval and rebuild.
If no parameter exists, implement a native timer through MethodChannel that cancels the BiometricPrompt after your chosen interval and routes the result to Dart.
Test the timeout and cancellation paths on at least two Android OEM devices to confirm which callback fires.

One missing diagnostic detail changes this recommendation: the exact plugin identifier and version you are using. Without it, I cannot confirm whether a built-in timeout option is already available.

Biometric Authentication: Consistency of Prompt Timeouts Across Android OEMs

1 answer

Answer

Confirmed facts

Likely explanation

Steps for this case

Your perspective belongs here.

0 question comments