I'm having a webservice which I'm using for my app. The webservice is using cookies when authenticated. I want to give my users the option to login via TouchID for faster login. Therefore I'm storing the users username and password in the iOS keychain and release it when the finger is accepted and it is also necessary to have a PIN configured to have this working. Is this okay since the keychain is encrypted or is there a better approach, like a remember me cookie? The cookie can be revoked, which I would say is a plus. What if the device gets stolen and the PIN was easily guessed and the attacker is able to Jailbreak the device? In this case he would be able to see the password, which might be used on other services as well by the user. Same applies when some vulnerability in the keychain is exploited like "XARA".
What is considered best practices for easy login without entering the credentials each time?