BIOMETRY_OR_DEVICE_PASSCODE

Require biometric availability, then allow biometric or device credential (PIN, pattern, or password) authentication.

On devices running Android 10 (API 29) and below, key access is biometric-only because device-credential fallback for key operations requires Android 11 (API 30).