Developer Documentation

Phase 1: Registration

Run this code when the user first enables biometrics in your app. Our engine generates a unique credential.id which you must store in your database.

async function registerBiometric(username) {
    const credential = await navigator.credentials.create({
        publicKey: {
            challenge: crypto.getRandomValues(new Uint8Array(32)),
            rp: { name: "Your App Name", id: window.location.hostname },
            user: {
                id: Uint8Array.from(username, c => c.charCodeAt(0)),
                name: username,
                displayName: username
            },
            pubKeyCredParams: [{ alg: -7, type: "public-key" }],
            authenticatorSelection: { authenticatorAttachment: "platform" },
            timeout: 60000
        }
    });

    // Save this ID to your DB mapped to the user
    console.log("Save this to your DB:", credential.id);
}

Phase 2: Secure Handshake

When the user logs in, trigger the prompt. CRITICAL: You must call our API to receive a verify_token. This token proves to your backend that the biometric event was authentic.

async function loginWithBiometric(storedId) {
    const credential = await navigator.credentials.get({
        publicKey: {
            challenge: crypto.getRandomValues(new Uint8Array(32)),
            allowCredentials: [{
                id: Uint8Array.from(atob(storedId), c => c.charCodeAt(0)),
                type: 'public-key'
            }],
            userVerification: "required"
        }
    });

    if (credential) {
        // 1. Device Match Passed!
        // 2. Perform Security Handshake with InnovaTech
        const response = await fetch('https://innovatechservicesph.com/management/microservices.php?service=biometric-verify&key=YOUR_API_KEY');
        const data = await response.json();
        
        if (data.success && data.verify_token) {
            // 3. ONLY NOW allow login
            console.log("Verified. Credits Used:", data.credits_used);
            // Grant access
        }
    }
}

HTML INTEGRATION (LOGIN FORM)

<!-- 1. Include the Captcha Engine -->
<script src="https://innovatechservicesph.com/management/microservices.php?service=captcha&key=YOUR_API_KEY"></script>

<!-- 2. Add a Container and Login Button -->
<div id="captcha-box"></div>
<button id="login-btn" class="btn btn-primary" disabled>Login</button>

<script>
  // 3. Move the injected box to your container
  const boxCheck = setInterval(() => {
    const box = document.querySelector('.js-captcha-box');
    if (box) {
      clearInterval(boxCheck);
      document.getElementById('captcha-box').appendChild(box);
    }
  }, 100);

  // 4. Enable button only when verified
  setInterval(() => {
    const isVerified = window.__captchaVerified && window.__captchaVerified();
    document.getElementById('login-btn').disabled = !isVerified;
  }, 500);
</script>