Skip to content
BaxPayDevelopers

Biometrics

Fingerprint payments

Enrolled shoppers pay with just a finger — on certified BaxPay terminals. Your integration never touches a fingerprint.

Fingerprint is BaxPay's signature tender: no card, no phone — the shopper touches the terminal, confirms with a PIN, and the payment settles. It runs exclusively on certified BaxPay terminals, whose payment-grade sensors and secure hardware are what make it safe.

What the terminal does

  1. Capture — the certified sensor reads the finger and extracts an ISO/IEC 19794-2 minutiae template on the terminal. Raw fingerprint images never leave the device, are never on the wire, and are never stored.
  2. Identification (1:N) — BaxPay matches the template against the enrolled population to answer who is this? That match is one authentication factor (inherence) — never an authorization by itself.
  3. Second factor: the shopper confirms with a PIN, completing the two independent factors PSD2 requires, dynamically linked to the exact amount and payee.
  4. Outcome — your session reports CAPTURED (or DECLINED), indistinguishable from any other tender. Same webhooks, same settlement, same reconciliation.

Enrollment

Customers enrol at a BaxPay terminal, where the certified sensor and the secure element live — not in a consumer app, and not through your integration. The mobile apps only show enrolment status and direct the customer to a terminal: a phone camera or consumer sensor cannot give the assurance a payment-grade enrolment requires.

What this means for your integration

  • A fuel pump, till or kiosk integrates once with the Terminal & Session API — fingerprint then works automatically wherever a BaxPay terminal fronts the interaction, with zero biometric code on your side.
  • Privacy posture is BaxPay's problem, by design. Since no fingerprint data ever transits your systems, biometric data protection (GDPR art. 9) stays inside BaxPay's certified perimeter — nothing biometric to secure, store, or declare on your side.
  • Match quality is calibrated, not configurable. Thresholds are tuned for payments, where a false accept means charging the wrong person, and a match is never enough on its own: the PIN is always required.