# Fingerprint payments

Enrolled shoppers pay with just a finger — on certified BaxPay terminals. Your integration never
touches a fingerprint.

Fingerprint is BaxPay's signature tender: no card, no phone — the shopper touches the terminal,
confirms with a PIN, and the payment settles. It runs **exclusively on certified BaxPay
terminals**, whose payment-grade sensors and secure hardware are what make it safe.

> **There is nothing for you to implement**
> Biometric capture, template handling and matching are not part of your integration. The calls
> that carry a fingerprint template or a PIN only accept the BaxPay terminal's own device
> credential; a till's `bxc_` credential is refused. Your till, pump or ERP opens a
> [payment session](https://developers.baxpay.com/terminal-api); if the shopper chooses to pay by finger, the BaxPay terminal
> handles the entire biometric interaction and your system just receives the session outcome,
> exactly as it would for a card or QR payment.

## What the terminal does

1. **Capture** — the certified sensor reads the finger and extracts an ISO/IEC 19794-2 minutiae
   template *on the terminal*. Raw fingerprint images never leave the device, are never on the
   wire, and are never stored.
2. **Identification (1:N)** — BaxPay matches the template against the enrolled population to
   answer *who is this?* That match is one authentication factor (inherence) — never an
   authorization by itself.
3. **Second factor**: the shopper confirms with a PIN, completing the two independent factors
   PSD2 requires, dynamically linked to the exact amount and payee.
4. **Outcome** — your session reports `CAPTURED` (or `DECLINED`), indistinguishable from any
   other tender. Same webhooks, same settlement, same reconciliation.

> **Identify, never authorize**
> A fingerprint match answers *who is this?* — it is not consent to charge. BaxPay keeps
> identification and authorization strictly separate on the terminal: every payment still needs a
> second, independent factor before money moves. You benefit from this rule without implementing
> any of it.

## Enrollment

Customers enrol **at a BaxPay terminal**, where the certified sensor and the secure element live —
not in a consumer app, and not through your integration. The mobile apps only show enrolment
status and direct the customer to a terminal: a phone camera or consumer sensor cannot give the
assurance a payment-grade enrolment requires.

## What this means for your integration

- **A fuel pump, till or kiosk** integrates once with the [Terminal & Session API](https://developers.baxpay.com/terminal-api)
  — fingerprint then works automatically wherever a BaxPay terminal fronts the interaction, with
  zero biometric code on your side.
- **Privacy posture is BaxPay's problem, by design.** Since no fingerprint data ever transits
  your systems, biometric data protection (GDPR art. 9) stays inside BaxPay's certified
  perimeter — nothing biometric to secure, store, or declare on your side.
- **Match quality is calibrated, not configurable.** Thresholds are tuned for payments, where a
  false accept means charging the wrong person, and a match is never enough on its own: the PIN is
  always required.