This invention concerns apparatus and a method for authenticating a subject using their eye as an identifying biometric, in particular the shape of their cornea. The apparatus comprises an image projection device to generate and project an image of a pattern, made up of plural discrete points, onto at least a part of the cornea of an eye of the person. An image capture device to capture an image of the pattern of plural discrete points, after reflection in at least a part of the cornea of an eye of the person. And, a computer processor to extract a data set defining the locations of the discrete points in the captured image. The method comprises capturing an image of an illuminated pattern, made up of plural discrete points, after reflection in at least a part of the cornea of an eye of the subject. Comparing the locations of the discrete points in the pattern of the captured image against the locations of the discrete points in the pattern of a reference image. And, authenticating the identity of the subject depending on the similarity of comparison. In a further aspect the invention is software for performing the method.