Just one, but that's the point. Don't present the person holding my phone with a chance to enter a password or passcode unless you know it's me, by scanning my face.