Clerk Android API/com.clerk.api.trusteddevice/TrustedDevices

TrustedDevices

The main entry point for trusted-device (biometric sign-in) credential operations.

Enrolling generates a biometric-gated private key in the Android Keystore and registers its public key with Clerk. Signing in signs a server challenge with that key after the user passes the system biometric prompt. The private key never leaves the device.

Example usage:

// Enroll the current device while signed in
Clerk.trustedDevices.enroll()

// Later, sign in with biometrics
Clerk.trustedDevices.signIn().onSuccess { signIn ->
  // Session created
}

Properties

deviceSupportsBiometricAuthentication

val deviceSupportsBiometricAuthentication: Boolean

Whether biometric-gated trusted-device keys can be created and used on this device.

Functions

availability

suspend fun availability(id: String? = null, identifierHint: String? = null): TrustedDeviceAvailability

Returns local trusted-device sign-in availability.

currentUserAvailability

suspend fun currentUserAvailability(): TrustedDeviceAvailability

Returns trusted-device sign-in availability for the current signed-in user, reconciling the local credential with the server.

currentUserLocalAvailability

fun currentUserLocalAvailability(): TrustedDeviceAvailability

Returns local trusted-device sign-in availability for the current signed-in user without reconciling with the server.

enroll

suspend fun enroll(deviceName: String? = null, identifierHint: String? = null, policy: TrustedDevicePolicy = TrustedDevicePolicy.BIOMETRY_OR_DEVICE_PASSCODE, promptTitle: String? = null, promptSubtitle: String? = null): ClerkResult<TrustedDevice, ClerkErrorResponse>

Enrolls the current app installation as a biometric trusted device.

forgetLocalCredentials

fun forgetLocalCredentials(deletedUserId: String): Int

Deletes local trusted-device credentials and keys belonging to deletedUserId.

forgetLocalCredentialsAfterAccountDeletion

@RestrictTo(value = [RestrictTo.Scope.LIBRARY_GROUP])

fun forgetLocalCredentialsAfterAccountDeletion(deletedUserId: String): Int

Deletes account-scoped local credentials, retaining failed cleanup work for the next SDK initialization.

list

suspend fun list(): ClerkResult<List<TrustedDevice>, ClerkErrorResponse>

Lists active trusted-device credentials for the signed-in user.

localAvailability

fun localAvailability(id: String? = null, identifierHint: String? = null): TrustedDeviceAvailability

Returns local trusted-device sign-in availability without reconciling with the server.

revoke

suspend fun revoke(id: String): ClerkResult<TrustedDevice, ClerkErrorResponse>

Revokes a trusted-device credential for the signed-in user.

revokeCurrentDeviceCredential

suspend fun revokeCurrentDeviceCredential(): ClerkResult<Unit, ClerkErrorResponse>

Revokes the available local trusted-device credential for the current signed-in user, if one exists.

signIn

suspend fun signIn(id: String? = null, identifierHint: String? = null, promptTitle: String? = null, promptSubtitle: String? = null): ClerkResult<SignIn, ClerkErrorResponse>

Signs in with a locally enrolled biometric trusted-device credential.

validateLocalCredentialIfPossible

suspend fun validateLocalCredentialIfPossible(id: String? = null, identifierHint: String? = null): TrustedDeviceValidationResult

Validates the local trusted-device credential against the server when possible.