title: Using Touch ID or Face ID without storing user biometrics
body: <p>I apologize in advance if this topic does not fit Stackoverflow (I ask moderators to move it where appropriate). Thanks.</p>
  
  <p>I was wondering how apps use Touch ID or Face ID to verify identity without storing the biometric data into their servers.</p>
  
  <p><strong>Authentication without Touch/Face ID (oversimplifying here)</strong></p>
  
  <ol>
  <li>User logs into their banking app.</li>
  <li>Username and password sent to server to be verified.</li>
  <li>Username and password is checked against information stored in bank server.</li>
  <li>On valid username and password combination, a token is issued to be used for the current session.</li>
  </ol>
  
  <p><em>After user allows the app to use their Touch/Face ID...</em></p>
  
  <p><strong>Authentication with Touch/Face ID</strong></p>
  
  <ol>
  <li>User logs into their banking app.</li>
  <li>They verify with their Touch/Face ID</li>
  </ol>
  
  <p>... what happens here? What is sent to the server to be verified? </p>
  
  <p>I read that Biometric data is stored in a secure chip on the phone and this is not stored on any server. </p>
  
  <p>For iOS, apart from the package for Touch/Face ID, we also need to work with keychain access. Why? What's stored here?</p>
  
  <p>Thank you.</p>