> For the complete documentation index, see [llms.txt](https://docs.securepass.me/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.securepass.me/documentation/getting-started/deployment-guide/facial-biometric-prerequisites.md).

# Facial biometric prerequisites

Facial biometric authentication is optional. It is enabled per tenant under Authentication Modes, and these prerequisites apply only if you turn it on.

## On the end-user device

* An integrated webcam, or the native camera on the user's laptop, desktop or mobile device.
* Browser permission to allow camera access for the SECUREpass portal. The browser prompts the user on first enrolment. If the permission was previously denied, the user has to clear it in their browser settings before enrolment will work — the prompt does not appear a second time on its own.

## The portal must be served over HTTPS

{% hint style="warning" %}
Browsers only grant camera access on a secure origin. If users reach the SECUREpass portal over plain HTTP, the camera prompt never appears and facial enrolment fails with no visible error.
{% endhint %}

Confirm TLS is terminated correctly for every hostname users reach the portal on, not only the primary one. A secondary hostname left on HTTP will work for every other authentication method and fail for this one, which makes the cause hard to spot.