How do you store tokens safely and use Face ID / Touch ID?
Essence
Access tokens grant the same rights as a password, so they live in the Keychain, not in UserDefaults or files. Biometrics are a convenient way to confirm the owner is using the phone, but they protect something only when the secret itself is bound to them by the system — not when the app does an if on a result.
The rest of this answer, with code and interview follow-ups, is in the DevPrep app.
Read the full answer in DevPrep