Your partner in navigating the ins and outs of prescriptions — at no extra cost.

Alto Pharmacy Technician

Alto Pharmacist

It’s official: Alto Pharmacy is a great place to work! We’re honored to join the community of Great Place to Work-Certified™ companies based on team member feedback and a rigorous assessment of our company’s culture and benefits.

Join us in delivering our industry-leading pharmacy care to millions of people across the country. As a member of the team, you’ll play an integral role in improving our customers’ quality of life and redefining what’s possible in pharmacy. 

Be Part of a Great Place to Work — Join Our Team

Hear first-hand from members of the Alto technology teams.

Read the latest Alto blog posts covering healthcare, family health, managing diseases, and other Alto highlights.

Blog | Alto Pharmacy

Redux is great for managing client state: it allows data to be synchronized across the whole app, reduces prop drilling, and makes it easier to understand when state changes occur.

Server state is a different story. Sure, it’s nice to have data available everywhere in our app, which is why we tend to fetch data from the server and dump it into our Redux store. But because our client application doesn't own that server data, it’s hard to know when it has become stale. And what if multiple components trigger calls to fetch the same data? How do you dedupe requests? How do you decide when to refetch?

Why We Switched to React Query for Managing Server State

Redux is great for managing client state: it allows data to be synchronized across the whole app, reduces prop drilling, and makes it easier to understand when state changes occur.

Server state is a different story. Sure, it’s nice to have data available everywhere in our app, which is why we tend to fetch data from the server and dump it into our Redux store. But because our client application doesn't own that server data, it’s hard to know when it has become stale. And what if multiple components trigger calls to fetch the same data? How do you dedupe requests? How do you decide when to refetch?

Below, we’ll dive into how we’re using React Query at Alto to solve these problems and achieve separation of client and server state.

The Old Way: Fetch Server Data and Store It in State

Historically, we would fetch data and set the response in our React component state.

fetchUser(params) {
 this.setState({ isLoading: true });
 
 return getUser(params)
   .then(({ data }) => {
     this.setState({
       isLoading: false,
       user: data.user,
     });
   })
   .catch(() => {
     toaster.toast({ title: 'Something went wrong...' });
     this.setState({ isLoading: false });
   });
}

To make that data accessible from other components, we’d set that data in the global Redux store. This works fine, except that you have to manage your own loading state, the logic for when and when not to make the request, updating the store when mutating data on the server, and knowing when data is stale.

The React Query Way: Fetch and Cache Server Data

With React Query, fetching data and using that data is more declarative.

const { data, error, isLoading } = useQuery(
 // This is our Query Key, which is unique per query so that React
 // Query can manage the cache for us.
 ['user', { userId }],
 
 // This is our Query Function that actually does the data fetching.
 // We can use anything we want: built-in fetch, axios, etc.
 fetchUser({ userId }),
 
 // This query will not execute until the userId exists.
 { enabled: !!userId },
);

Here, we define our query for a user with a Query Key and a Query Function. The Query Key is unique per query, so React Query can manage our cache for us, and if any part of the Query Key changes, the query will automatically fetch new data. In this example, if the user ID changes, the query will fetch new data for that specific user and store that data in the cache.

Naming is hard, but caching is harder. React Query gives us caching of server data out of the box with cache invalidation and request deduping. If we use this same query with the same Query Key in another component, it'll check the cache: if the data is already there, React Query will simply return it, avoiding extra network requests!

Additionally, useQuery runs wherever you use it — no more fetching data when a component mounts. You just use the query and display the data when it’s ready. The cherry on top? The query returns status updates by default, so we don’t need to store isLoading in component state all the time.

Three Optimizations We Get With React Query

When we rebuilt Alto Connect, our web app for healthcare providers, we found impactful benefits in using React Query to help us manage server state instead of using Redux. Alto Connect provides instant access to patient and prescription information and enables messaging with the pharmacy. Because healthcare providers need to quickly switch between patients and clinics, caching data is important to provide a delightfully fast experience. Apart from the cache, what other optimizations do we get by using React Query? Below are a few that helped us.

Once we’ve queried for some data, it gets entered into our cache, so we can utilize that cached data when using the same query in a different component or when fetching new data for a stale query in the background.

React Query is configured with aggressive but sane defaults and considers cached data as stale. Stale queries will always query for new data when the following criteria are met:

The query is optionally configured with a refetch interval

The fetching for new data when the browser window or tab is refocused is especially useful because the healthcare providers using Alto Connect often switch between multiple browser tabs. If there’s an update to a task, status, or message while they’re checking a patient’s medical chart, it will be immediately reflected in the UI when they come back to Alto Connect.

We also set a refetch interval for our queries involving messages. In the old app, we used WebSockets to enable real-time messaging. Although it’s possible to integrate WebSockets with React Query, we opted for a polling solution instead. Because our app isn’t a real-time messaging application, and we don’t need messages to show up immediately, we set a refetch interval on our messages query to poll for new messages every 30 seconds.

const { data, error, isLoading } = useQuery(
 ['user', { userId }, 'messages'],
 fetchMessages({ userId }),
 {
   // This query is disabled from automatically running if we don’t have a userId
   enabled: !!userId,
 
   // Refetch every 30 seconds
   refetchInterval: 30000,
 
   // Continue to refetch while the tab/window is in the background
   refetchIntervalInBackground: true,
 },
);

This is where the enabled option, which disables a query when it evaluates to false, is particularly powerful. We can pause polling for messages if we route to another page and we know that we won’t make any unnecessary requests if there isn’t a valid userId. We don’t have to worry about closing any socket connections or manually clearing an interval.

Most web apps have some sort of navigation menu, and if you already measure or understand your user behavior, you can prefetch data before users even navigate to a different page. Custom hooks makes it easy to expose a function to prefetch data:

export const usePrefetchUsers = () => {
 const queryClient = useQueryClient();
 const prefetchUsers = async () => {
   await queryClient.prefetchQuery(
     ['users'],
     fetchUsers,
   );
 };
 
 return { prefetchUsers };
};

We prefetch queries when users mouseover or hover over a navigation item so that when they navigate to the next page, the data is either actively being fetched or is already in the cache waiting.

We’ve been talking a lot about queries, but what about mutating data? Mutations, in contrast to queries, are imperative. While queries run automatically when we use them, we need to fire a mutation method in order to run mutations. And in order for our user experience to feel snappy, we can optimistically update the cache and then invalidate it after successfully executing the mutation. useMutation gives us some nice side-effect handlers to deal with every stage of the mutation lifecycle. Now when the user sends a message, that new message is immediately reflected in the UI and we keep the data in sync by invalidating the cache and refetching the messages.

With Redux, we needed to build out solutions to each challenge of managing server state. React Query, on the other hand, gives us those tools right out of the box. We no longer need to worry about when to invalidate or fetch new data, making the user experience more predictable — and the developer experience more enjoyable.

Resources for Affording HIV Medication

The HIV treatment and prevention landscape continues to evolve, with many effective medications. Antiretroviral therapy (ART), the frontline treatment for HIV since 1997, is a combination of medications that lower the amount of HIV in your bloodstream. When taken as prescribed every day, ART can help individuals with HIV achieve and maintain an undetectable viral load. As a result, more than half of all those living with HIV in the U.S. are not at risk of transmitting the virus to others.

On the prevention front, PrEP, or pre-exposure prophylaxis, can lower risk of sexual transmission of HIV by 99% when taken daily and reduces the risk of getting HIV from intravenous drug use by about 74%.

For many individuals, cost is a barrier to both starting and continuing to take ART and PrEP as prescribed. Fortunately, HIV prevention medication and treatment continue to become more accessible, with generic PrEP options and expanded health insurance coverage of PrEP and ART. In addition, the following resources, including patient assistance programs and copay savings cards from medication manufacturers, can help reduce the cost of HIV treatment and prevention medication.

Read on to learn more about eligibility for these programs, and revisit our previous post on state-funded PrEP drug assistance programs.

Many pharmaceutical companies have patient assistance programs (PAPs) to offset the cost of prescription medications for individuals without insurance or with insufficient insurance coverage. If Alto is your pharmacy partner for HIV treatment or prevention, your medication protocol may include medications manufactured by Gilead, which offers the PAP outlined below.

If your medications are manufactured by a different company, contact them directly to learn about any available financial assistance including PAPs.

Gilead's Advancing Access® Patient Assistance Program

Gilead's Advancing Access Patient Assistance Program provides medication free of charge to individuals without insurance who meet program eligibility criteria. There are several ways to learn if you are eligible:

Call 1-800-226-2056 (Monday-Friday, 9 am to 8 pm EST)

Print the enrollment form and submit it via fax

Copay savings cards from pharmaceutical manufacturers can help offset the cost of prescription medications for individuals with insurance. If Alto is your pharmacy partner for HIV treatment or prevention, your medication protocol may include medications manufactured by Gilead or ViiV Healthcare, which offer the copay savings cards below.

If your medications are manufactured by a different company, contact them directly to learn about any available financial assistance including copay savings cards.

Gilead’s Advancing Access copay savings card

Gilead also offers a copay savings card for individuals with insurance to reduce the cost of copays. Those who are enrolled in any state or federally funded prescription medication program such as Medicare Part D and Medicaid, or who are in the Medicare Part D prescription coverage gap, are not eligible.

Learn more about program eligibility and terms and conditions.

The ViiVConnect Savings Card Program helps eligible individuals with commercial insurance save on copay costs for select ViiV Healthcare medications. Those who are enrolled in any state or federally funded prescription medication program such as Medicare Part D and Medicaid, or who are in the Medicare Part D prescription coverage gap, are not eligible.

If you do not have insurance coverage of prescription medications, contact 1-844-588-3288 to learn about additional financial assistance opportunities from ViiV.

Created to help individuals living with chronic health conditions access the treatment they need, the PAN Foundation offers financial assistance for medication costs, copays, and insurance premiums.

Learn what financial assistance you are eligible for.

The Ready, Set, PrEP program provides PrEP at no cost to eligible individuals without insurance coverage of prescription medications.

Learn more about program eligibility and the application process.

Your financial well-being is our priority

At Alto, we understand how stressful it can be to navigate insurance coverage benefits and savings opportunities. We prioritize your financial wellness, working with your doctor, your insurance (if applicable), and any third party savings programs that you may qualify for to make ART or PrEP as affordable as possible. In addition to automatically applying coupon savings, we’ll connect you with any outside programs that require you to apply directly.

We also offer free, same-day delivery to make it as easy as possible to stay on track with treatment, and our dedicated HIV support team is here to answer any questions you may have about ART or PrEP. Reach out any time via phone at 1-800-874-5881, or in-app messaging.

This content is not intended to be a substitute for professional medical advice, diagnosis, or treatment. Always seek the advice of your physician or another qualified health provider with any questions you may have regarding a medical condition.

All third party trademarks (including logos and icons) referenced by Alto Pharmacy remain the property of their respective owners. Unless specifically identified as such, Alto’s use of third party trademarks does not indicate any relationship, sponsorship or endorsement between Alto and the owners of these trademarks.

Alto’s launch in the Long Island market extends our industry-leading patient care model to even more of the New York metro area.

Hello, Long Island!

Alto’s launch in Long Island, New York, extends our industry-leading patient care model to even more New York-area residents.

With the addition of our latest pharmacy location in Plainview, Long Island, even more residents of the greater New York City metro area can now choose Alto’s same-day doorstep delivery for all of their pharmacy needs. Alto Long Island opens its doors today, Tuesday, April 5, 2022.

At Alto, we believe it’s our job to ensure you have your medications at the best price, on time and with the support you need. We bring the pharmacy to you - no more waiting in line, making an extra trip, or finding out your prescription isn’t ready to be picked up after you’ve already arrived. Our free doorstep delivery means your medications come directly to you on the day and time you select, and most medications are available the same-day. Stay up to date on your courier’s progress with text alerts and in our mobile app. 

Starting a new medication or doing an injection for the first time? Message a pharmacist with your questions, even in the evenings and on weekends. And we’re a full service pharmacy - we stock all major brand, generic, over-the-counter and specialty medications, meaning your entire family’s pharmacy needs can be managed in the Alto app and coordinated into one delivery.

Courier delivery windows
Monday - Friday: 

12:30 – 3:30 pm ET (1:30 – 4:30 pm ET for outlying areas)*

6:00 – 9:00 pm ET (7:00 – 10:00 pm ET for outlying areas)

2:00 –5:00 pm ET (3:00 – 6:00 pm ET for outlying areas)

Need to pick up? Our new Long Island pharmacy is located at 100 Manetto Hill Road, Suite 104, in Plainview.

Monday - Friday: 9:00 am – 7:00 pm ET
Saturday - Sunday: 8:00 am – 4:30 pm ET

New York residents interested in using Alto’s services for their medication needs can ask their doctor’s office to send all prescriptions to Alto Pharmacy (via ePrescribe or phone). Have existing prescriptions at another pharmacy? Start a transfer online or give us a call at 1 (800) 874-5881, and we’ll handle the switch. 

General customer support hours are Monday - Friday 9 am - 12 midnight ET and Saturday - Sunday 10 am - 9 pm ET. Patients can reach out to Alto via phone at 1 (800) 874-5881 or app.

*Weekday afternoon delivery is only available to residents of New York City's five boroughs at this time.

Founded in 2015, Alto is a patient-centric digital pharmacy based committed to the health and wellbeing of you and your family. We provide free same-day delivery to your door seven days a week for prescriptions, but, more importantly, offer cost transparency, personalized in-app and phone support, and real-time coordination with doctors and insurance companies to get you the care that you need. Alto is headquartered in San Francisco with offices in Denver and Dallas, and currently delivers across the greater Bay Area, Los Angeles, Orange County, San Diego, Seattle, Denver, Las Vegas, New York City, Houston, Dallas and Austin.

Last summer, Moringa Fellows Irma Figueroa and Adrian Mendez joined Alto as the company’s second batch of engineering interns. Here, they share their learnings, accomplishments, and advice for future Alto interns.

Two Engineering Interns Weigh In: What to Expect From Your Alto Internship

The Moringa tree flourishes almost anywhere it’s planted. It’s hardy, fast-growing, and resistant to drought — an apt metaphor for the two interns who joined us from the Moringa Fellowship program last summer.

“Before Alto, I had never actually contributed to a large codebase,” admits Irma Figueroa, an intern on the Supply Chain Team. By the end of their three-month internships, however, Irma and fellow intern Adrian Mendez had shipped impactful features for Alto’s internal pharmacy management system and customer-facing app that are still in production today.

Below, we chat with Irma and Adrian to learn what it was like interning at Alto, which projects they worked on, and what advice they’d give to future interns. 

Adrian, who interned on the Patients Team before returning to join as a full-time software engineer last fall, was surprised by the freedom he had to choose what he worked on during his internship: “Early on, my manager gave me a rundown of the projects the team was juggling and the option to choose which one interested me the most,” he says. “I was able to decide the kind of experience I was going to have.” 

Adrian adds that meetings with his mentor evolved over the course of his internship, as he became more familiar with the codebase: “From the start, we had weekly meetings to talk about whatever was on my mind. Those meetings started off as general advice and questions and turned into more time to pair or run things by each other.”

Because both Adrian and his mentor were working on the same, long-term project, some of those meetings were also dedicated to project work. This included “sitting with [my mentor] while creating the project outline, pairing on larger tasks, and syncing up on progress.” 

Which projects did you work on during your internship? 

On the Supply Chain Team, Irma was tasked with a unique inventory challenge: Technicians at our production pharmacy locations use handheld scanners to scan the barcodes on newly-received inventory. Our technicians often need to scan hundreds of inventory items at a time — making it all too easy to lose track of which items have been successfully scanned onto which shelves. 

“I created a reusable counter component, displayed in the header of the scanner app, that would represent the number of items scanned into a shelf.” Irma says. The best part? Getting to test the handheld scanner herself. “I really enjoyed using the scanner for testing purposes. It was rewarding to see my code in action and definitely super fun!” 

On the Patients Team, Adrian worked on a project to add a homescreen to the customer-facing native app. Previously, the app dropped users into a list of all their active medications, which made it difficult to know where to look or what to do next. The new homescreen allows users to schedule the prescriptions most relevant to them and to view or edit any upcoming deliveries. 

“The first step was to create new additions to the design system — essentially taking the designs and extracting system-wide components. After that, the fun part was taking all those components and putting them together like building blocks!” Adrian says.

It was especially rewarding, he adds, to have been part of the project from start to finish. “I joined right as the design phase started, and I was there mostly every step of the way. For how short my time here was, having helped create this landmark project is really cool to think about.” 

What advice would you give to future Alto interns?

Irma and Adrian agree: Don’t be afraid to ask for help. “You'll often feel challenged and possibly intimidated, but be patient with yourself and remember you have an entire team of experienced engineers ready to help,” Irma says. 

“Everyone at Alto is more than willing to help you out, so don't be afraid to ask questions! You're on the same ship as everyone else, so your success equals everyone’s success,” Adrian adds. “Just remember that your work got you here, and they wouldn't have invited you if they thought you couldn't handle it. They made an investment in your ability to grow, so stay curious.” 

Interested in interning at Alto? Check out our careers page here.

Millions of individuals with type 1 and type 2 diabetes need insulin every day to keep their blood sugar levels in a healthy range. In recent decades, it has grown increasingly difficult for many to access this life-saving medication, as insulin prices continue to rise.

Managing the Costs of Insulin

Millions of individuals with type 1 and type 2 diabetes need insulin every day to keep their blood sugar levels in a healthy range. In recent decades, it has grown increasingly difficult for many to access this life-saving medication, as insulin prices continue to rise. Take a look at these recent statistics:

The cost of insulin increased by an average of 14% every year from 2012 to 2018.

In 2017, insulin accounted for 20% of all diabetes-related healthcare spending before rebates and discounts and 6.3% after rebates and discounts.

In a 2018 survey on insulin affordability conducted by the American Diabetes Association, 39% of the respondents reported an increase in their insulin costs between 2017 and 2018.

Rising insulin costs can significantly impact an individual’s ability to manage their health. 27% of those surveyed by the ADA said that insulin prices affected how much of the medication they could buy or use. Missed insulin doses can lead to serious health complications including diabetic ketoacidosis.

While insulin access remains a critical issue for many Americans with diabetes, lawmakers have recognized the urgency of lowering insulin costs. In November 2021, the U.S. House of Representatives passed the Build Back Better Act, which caps out-of-pocket copays for insulin at $35 per month. The legislation has yet to pass in the U.S. Senate, but President Joe Biden recently reaffirmed his commitment to lowering insulin costs — and prescription medication costs more broadly — as part of his domestic agenda.

In the meantime, there are a variety of resources to help you manage the costs of insulin, including patient assistance programs and copay savings cards from insulin manufacturers. Here’s more on eligibility for these programs.

The Lilly Cares® Foundation Patient Assistance Program

The Lilly Cares Foundation Patient Assistance Program provides free insulin and glucagon products for individuals who have Medicare Part D or no health insurance coverage and meet certain income requirements.

Learn more about program terms and conditions and the application process.

The Novo Nordisk® Patient Assistance Program

The Novo Nordisk Patient Assistance Program provides insulin and other diabetes medications at no cost to individuals who have Medicare or no health insurance coverage and whose total household income is at or below 400% of the federal poverty level.

Sanofi Patient Connection provides Sanofi medications including insulin at no cost to individuals whose total household income is at or below 400% of the federal poverty level.

The Lilly Insulin Value Program offers all Lilly insulins at $35 per month to individuals with commercial health insurance or no health insurance coverage. Download the copay card here.

Sanofi offers a copay savings card for those with insurance as well as the Valyou Savings Program for those without insurance, which offers Sanofi insulin at $99 per month. Learn more about Sanofi savings opportunities.

Novo Nordisk offers savings cards that reduce copays for a variety of insulin products. Get more details here.

At Alto, we understand how stressful it can be to navigate insurance coverage benefits and savings opportunities. We prioritize your financial wellness, working with your doctor, your insurance (if applicable), and any third party savings programs that you may qualify for to make your insulin and other medications as affordable as possible. In addition to automatically applying any coupon savings, we’ll connect you with any outside programs that require you to apply directly.

We also offer free, same-day delivery to simplify your diabetes management, and our dedicated diabetes support team is here to answer any questions you may have. Get started or learn more about Alto, reach out any time through in-app secure messaging or by phone at 1-800-874-5881.

With one in ten Americans living with type 1 or type 2 diabetes and more than 88 million adults living with prediabetes, many more people have a connection to diabetes than it may seem. And whether you are living with diabetes yourself or care about someone who is, or if you simply want to know more about diabetes prevention, there’s no shortage of information to learn or actions to take. Thankfully, there are a variety of resources that can help, from online support groups and events to diabetes education programs and advocacy materials. Explore our diabetes resource round-up below to get started.

Diabetes Resource Round-up

With a mission of improving the lives of everyone affected by diabetes, the American Diabetes Association (ADA) is a comprehensive hub for diabetes research, education, advocacy, and support. The national organization also has local offices throughout the U.S. where you can learn about community resources and events.

Beyond Type 1 and Beyond Type 2 are global online communities for individuals living with diabetes, powered by a nonprofit organization (also named Beyond Type 1) that funds a variety of diabetes research and projects.

Focusing on type 1 diabetes, JDRF is a leader in research and advocacy and a destination for type 1 diabetes support and community. Like the ADA, JDRF has many chapters across the U.S. that offer opportunities to connect locally with those affected by type 1 diabetes.

Founded by an endocrinologist living with type 1 diabetes himself, Taking Control of Your Diabetes is a resource hub for individuals and families affected by diabetes as well as medical professionals seeking to stay informed of the latest developments in diabetes care.

ADA engagement platform, with opportunities to take action and raise awareness

Association of Diabetes Care & Education Specialists (ADCES) legislative action center

Beyond Type 1 community table, a monthly conversation series

ADCES diabetes education program directory

JDRF type 1 diabetes daily management page

Getinsulin.org, an insulin access resource

Johnson & Johnson Patient Assistance Program

Lilly Cares Foundation Patient Assistance Program

Novo Nordisk Diabetes Patient Assistance Program

ADA tips on nutrition, fitness, mental health, and more

ADA free type 1 diabetes self-care manual

JDRF type 1 diabetes health insurance guide 

Project Power, the ADA’s free virtual after-school diabetes prevention program for children

ADA summer camps and year-round programming for children with diabetes

ADA resources on school safety and diabetes

With a dedicated diabetes support team, Alto has deep expertise in diabetes management. Our extensive library of diabetes-focused content offers the information you need to manage the condition and live an active life. Here are a few of our top reads:

What’s the Difference between Type 1 and Type 2 Diabetes?

New Diabetes Diagnosis? Here’s What to Know

How to Manage Your Child’s Type 1 Diabetes Diagnosis

We make it simple to manage your diabetes, with free, same-day delivery right to your doorstep, temperature controlled packaging, and automatic savings investigations. And our dedicated diabetes team is here to offer individualized support and walk you through your first insulin doses.

Reach out any time through in-app secure messaging or by phone at 1-800-874-5881 to learn how Alto can be a partner in your diabetes care.

In our previous post, we discussed how we designed our biometric authentication system with both privacy and a better user experience in mind. In this post, we'll show you exactly how we did it.

Considerations and Approaches for Implementing Biometric Login: Part 2

In Part 1, we discussed how we designed our biometric authentication system with both privacy and a better user experience in mind. In this post, we'll show you exactly how we did it.

To build a new authentication mechanism, we opted to use the react-native-biometrics library. This library interfaces with the device's biometrics, generates a keypair, and stores the private key within the device's keystore. When logging in with biometrics, the library creates a signature using the stored private key, and the signature is then sent to the server for validation. (Note: this library is now unmaintained. At the time of writing, this implementation can instead be accomplished with the following maintained libraries: expo-local-authentication to access device biometrics, keypair to generate a keypair, react-native-keychain to access the device keystore.)

Check if biometrics are supported and configured by the user for this device.

const { available } = await ReactNativeBiometrics.isSensorAvailable();

If yes, prompt the user for a biometric scan.

const { success } = await ReactNativeBiometrics.simplePrompt({ promptMessage: 'Confirm ID' });

If the scan succeeds, generate a keypair. The react-native-biometrics library's createKeys method will automatically save the private key to the device's keystore, and return the public key counterpart. Send the public key to your server.

const { publicKey } = ReactNativeBiometrics.createKeys('Confirm biometrics');

// Save the public key to your database
post('/save_biometric_key', { key: publicKey, device_id: 'xyz' })

When the user tries to login with biometrics, scan their biometrics. This time, if the scan succeeds, create a signature using the stored private key. The react-native-biometrics library's createSignature method handles all of this.

// Prompts for scan
// On scan success, accesses private key and uses it to generate a signature, which is then returned
const signatureResponse = ReactNativeBiometrics.createSignature({
  promptMessage: 'Face or fingerprint ID for Alto Pharmacy',
  payload: BIOMETRIC_SIGNATURE_PAYLOAD,
});

Send the signature to the server to validate against the public key. If validation succeeds, the user has successfully authenticated with biometrics and can proceed into the app.

// Call your server API to validate the signature against the public key that you've stored in the database
const validationSuccess = await post(
  `/validate_biometric_signature`,
  {
    signature: signatureResponse.signature,
    payload: BIOMETRIC_SIGNATURE_PAYLOAD,
		device_id: 'xyz',
  },
);

if (validationSuccess) {
  // Login Success
} else {
  // Login failure
}

import ReactNativeBiometrics from 'react-native-biometrics';

const setUpBiometricLogin = async () => {
  // Check if biometrics are supported and configured on this device
  const { available } = await ReactNativeBiometrics.isSensorAvailable();

  if (available) {
    // Prompt user to scan biometrics
    const { success } = await ReactNativeBiometrics.simplePrompt({ promptMessage: 'Confirm ID' });
      
    if (success) {
      // If scan is successful, generate a keypair, then save the public key to the server
      const { publicKey } = await ReactNativeBiometrics.createKeys('Confirm biometrics');

      post('/save_biometric_key', { key: publicKey, device_id: 'xyz' })
    }
  }
}

const loginWithBiometrics = async () => {
  // Scan user's biometrics. On scan success, generate a signature
  const signatureResponse = await ReactNativeBiometrics.createSignature({
    promptMessage: 'Face or fingerprint ID for Alto Pharmacy',
    payload: BIOMETRIC_SIGNATURE_PAYLOAD,
  });

  // Validate the signature against the public key saved on the server
  const validationSuccess = await post(
    `/validate_biometric_signature`, 
    {
      signature: signatureResponse.signature,
      payload: BIOMETRIC_SIGNATURE_PAYLOAD,
      device_id: 'xyz',
    },
  );

  if (validationSuccess) {
    // Login Success
  } else {
    // Login failure
  }
}

1. build a way to store a public key associated with a device

2. write a method to validate a signature against a public key

3. expose endpoints to save a public key, and validate a signature

Once biometric authentication is built, there are additional decisions to make. The right decisions for your app will depend on your goals; the approach we took here at Alto may not align with what is best for your app.

How should biometric sessions interact with our existing email and password sessions?

We opted to treat email and password sessions as longer-lived primary sessions, with biometrics as a shorter-lived secondary session on top of that primary session. This means that a user must first login with email and password in order to use biometrics on subsequent app opens. If the user logs out for any reason, they will need to log in again with email and password before they can use biometrics again.

How often should we prompt the user for biometrics vs. email and password?

We opted to prompt the user for biometrics far more frequently than email and password, but made this configurable in case we want to adjust.

We use tokens and cookies for session management.

There are plenty of edge cases to consider as you're developing biometric capabilities for your app, including: what should happen when the biometric scan fails, or when the signature validation fails? What should happen if a user disables biometric permissions from their device? What should happen when two users share a device? What should happen if 'risky' activity is flagged for this account? How can we disable biometric login if needed?

Face and fingerprint ID login has clear benefits for both the end-user and the application itself, but it comes with a host of implementation decisions. If you're considering building biometric login for your app, I hope this article gives you clarity on what biometrics is, the different ways you can integrate it into your app, and the tradeoffs and edge cases to consider.

At Alto, the Patients Engineering team worked closely with our Security Engineering and Product teams to align on our goals and build the best solution for our needs. Our Security team offered deep expertise on the authentication strategies to adopt and avoid, and our Product team kept us tethered to building the best experience for our users.

Working as a team is one of the best parts about developing at Alto. If you want to meet the awesome team I'm talking about, come join us - we're hiring!

Face and fingerprint ID login is a convenient, seamless way to gain app access on a mobile device. Instead of typing in a lengthy, hard-to-remember username and password, many apps allow you login with just a quick scan of your face or fingerprint (also known as biometrics).

Considerations and Approaches for Implementing Biometric Login: Part 1

It's a desirable feature for both our end user and the Patients Team here at Alto — we want to make it as easy as possible for users to log in while also performing more frequent authentication checks. Improve the user experience and the security of our app? Sounds like a win-win.

As an engineer, implementing biometric login might seem easy, as mobile devices already capture, manage, and encrypt biometric data and expose APIs for app developers like myself to initiate a biometric scan. All I need to do is call that API and wait to hear if the scan is successful or not. What isn't as simple, though, is figuring out what to actually do with a successful biometric scan response. What does a successful scan mean, and how does that relate to the username and password credentials that users currently use to access our app?

This post walks through the decision points we encountered while implementing biometric login and how our healthcare privacy concerns influenced the final implementation approach.

Prior to implementing biometric login, the only way for users to access the Alto app was with email (username) and password. A valid email and password generates a session, which expires at some frequency. Once the session expires, the user must re-enter their email and password to regain access to the app.

From the beginning, we knew that biometrics would need to be built with our existing email and password session management in mind. This is made clear in the Apple developer docs: "Use biometrics as a supplement to something you’re already doing. Don’t depend on biometrics as your only authentication option."

Make it easier for users to login. Nobody likes typing in an email and password — especially on a mobile app. Our goal was to reduce the number of times a user must enter their email and password.

Enhance the security of our app using more frequent authentication checks. As a healthcare app that displays Personal Health Information (PHI), conducting more frequent authorization checks decreases the likelihood of PHI becoming exposed to an unauthorized third party.

Have the ability to revoke biometric access from a particular user. Similarly, we want to be extra careful to ensure that if a device is lost or stolen, we have a fallback plan to invalidate a user's session and protect the user’s PHI. For email and password initiated sessions, this happens when a user changes their password, as any change in login credentials will invalidate all active sessions for that user. We needed a similar contingency plan for biometric login.

There are several ways to use a mobile device's biometrics to authenticate a user, with varying degrees of security.

No server-side authentication. Simply integrate with the device's biometrics as an extra layer of authentication. If the biometric scan is successful, let the user proceed into the app.

Provides an extra check and gives your app a sense of modern polish

No server-side validation means that nothing is being validated against your system, so this is not a good substitute for account authentication. Therefore, even if you add this check, the user should still be prompted to re-enter their email and password at the same frequency as before.

Given this, this approach wouldn't help us reach our goal of reducing the number of times a user must enter their email and password.

This approach is a good fit if your application already has an existing login and session management system, and you want extra authentication checks throughout the user's session without modifying any other part of the system.

Tie biometrics to our existing email and password authentication. Use the user's biometrics to unlock an encrypted version of their email and password credentials. When a user sets up biometric login, store the user's login credentials within the device's keystore — the keystore will automatically encrypt the credentials. After a successful biometric scan, retrieve those credentials from the keystore and send them to your existing login API.

Still easy to implement, no backend changes needed

Biometric scan can be used in place of entering an email and password

Changing email and password credentials will revoke biometric access: if a user changes their credentials, their biometrics will access stale credentials and fail to login. (This is somewhat of a con as well — it provides a poor user experience, but it's an edge case that should happen infrequently.)

There is still only one way for a user to authenticate server-side, but now two ways to pass server-side authentication — essentially weakening your app's existing account security.

This approach effectively hands out internal login credentials to third party storage. While not a huge risk considering a device's secure storage is encrypted and trusted by most users, it’s not necessarily a best practice either.

This approach is a good fit if your application doesn't contain sensitive data, and your goal is to make it more convenient for a user to login by replacing email and password with a biometric scan.

Create a separate authentication mechanism for biometrics. Introduce a new authentication mechanism specifically for biometrics, resulting in two independent forms of server-side session authentication: email with password and biometrics. The implementation could look like generating a keypair or a shared secret to save and validate against the server whenever a user attempts to login with biometrics.

Biometrics is now tied to its own secure server-side authentication mechanism, which means it can be used independently of email/password (or even replace it, if you choose to).

Two layers of authentication adds security to the app. Not only does a user need a valid email/password session, they also need a valid biometric session.

Blog

Why We Switched to React Query for Managing Server State

Resources for Affording HIV Medication

Hello, Long Island!

Two Engineering Interns Weigh In: What to Expect From Your Alto Internship

Managing the Costs of Insulin

Diabetes Resource Round-Up

Considerations and Approaches for Implementing Biometric Login: Part 2

Considerations and Approaches for Implementing Biometric Login: Part 1

Hello Austin, We're Alto Pharmacy!

Introducing Alto Connect

Celebrating American Pharmacist Month At Alto

What Does a Diabetes Educator Do and How Can They Help You?

Switch to a better pharmacy.