Android developer verification: keep your APK installable

Originally published on AppRanker.

Android developer verification has been enforced since September 30, 2026, and the failure mode is quiet: your build is fine, your CI is green, but a user on a certified phone in Brazil, Indonesia, Singapore or Thailand taps your APK and the normal install path simply refuses it. Google plans to roll the same rule out to every certified device in 2027. Below is what the rule actually checks, which commands get you the certificate data it asks for, and a checklist you can finish in one sitting.

What the check looks at

There are two things Android wants to see before it installs your app the normal way:

1. A verified developer identity. The account behind the app has passed ID verification (government ID for individuals; organizations also need a D-U-N-S number).
2. A registered package. Each package name is tied to that account, along with the signing key or keys that sign it.

If both are true, the app counts as "registered" and installs as usual. If either is missing, new installs through the standard flow are blocked in the enforcement regions. Google's stated motivation is malware: its March 2026 announcement says sideloaded sources carry over 90 times more malware than Google Play.

Key dates:

The first phase covers Google Play plus HONOR App Market, OPPO App Market, Samsung Galaxy Store, Palm Store, V-Appstore and GetApps.

How much work you have depends on where you ship

Play-only apps. Google says more than 99% of Play apps were registered automatically from details you already gave Play, and new apps get their package registered when you create them. Your job is a quick audit: check the Play Console Home page for any app flagged as needing registration, confirm your details under Settings > Developer account, and fix anything left over. Play Console's guidance warns that unregistered apps risk removal from Google Play globally, so do not skip this.

APKs distributed elsewhere (your website, partner stores, enterprise channels, F-Droid-style repos). This is where the real work is. With a Play Console account, you can register off-Play apps from inside Play Console. Without one, create an Android Developer Console account, verify your identity and register packages there. A full account is a one-time $25. If you are an organization without a D-U-N-S number, request it today: it can take up to 28 days.

Students and hobbyists. A free limited distribution account needs no government ID but only reaches up to 20 devices. Good for a class project or a closed test group, not for a public release.

Getting the certificate data with keytool and apksigner

Registration works per package name. For a new package you supply the public key certificate. For an existing package with installs, you prove key ownership by uploading an APK signed with the matching private key.

Print fingerprints and export the certificate from your keystore (swap in your own path and alias):

# SHA-256 and other fingerprints for the signing key keytool -list -v -keystore release.jks -alias release # Public key certificate as PEM, for registering a new package keytool -exportcert -rfc -keystore release.jks -alias release -file release-cert.pem 

Before registering, confirm the key in your keystore is the one your users actually have installed:

apksigner verify --print-certs app-release.apk 

If the fingerprints disagree, stop. The usual causes are an old key, a key held by a build service, or a release someone else signed. Once they match, sign the proof APK the console asks for:

apksigner sign --ks release.jks --ks-key-alias release \ --out signed-proof.apk unsigned-proof.apk 

In Play Console the flow is: Android developer verification page > Package names tab > Register package name. You get an email when it completes.

A few edge cases worth knowing: if one package name has been signed by several keys (forks, repackaged builds), the key behind more than 50% of known installs gets priority. With no majority, any key with at least 50 installs can register directly; smaller ones go through a request to Google. Agencies handling many packages can automate this with the Android Developer ID Status API and the Android Developer Console API.

What still works without registration

• ADB installs are exempt, so your local dev and test loop does not change.
• The advanced flow lets power users allow unverified apps: enable developer mode, confirm no one is pressuring them, restart, wait a day, re-authenticate with biometrics or PIN, then allow unverified installs for seven days or indefinitely, with a warning on every install.

That second path is a safety valve, not a distribution channel. Hardly any regular user will wait 24 hours to install your app. Treat registration as required.

The checklist

• [ ] Identity verified (Play Console Settings > Developer account, or Android Developer Console)
• [ ] D-U-N-S number on file if you publish as an organization
• [ ] Chosen the right account type: free limited (20 devices) or full ($25)
• [ ] Listed every package you distribute, on and off Play, including old downloads
• [ ] Checked each package's registration status
• [ ] Exported the certificate (new) or prepared a signed proof APK (existing)
• [ ] Matched fingerprints with apksigner verify --print-certs
• [ ] Removed download links for packages you no longer maintain
• [ ] Documented which key signs each package and who controls it
• [ ] Added "register package before announcing" to your release checklist
• [ ] Told sideload users in the four countries their updates will keep working

Key takeaways

• Enforcement is live in four countries now and is planned globally for 2027.
• Play-only developers are mostly registered already, but should still audit Play Console.
• Off-Play APKs need explicit registration; start D-U-N-S early because it can take 28 days.
• Use keytool and apksigner to make sure the key you register is the key users already trust.
• ADB stays exempt, so testing is unaffected.

The original post has the full timeline, FAQ and sources in its Android developer verification checklist for app makers. Once your app is installable again, it still has to be found, and AppRanker's app leaderboard links each listing straight to its store page.

If you ship APKs outside Google Play, what was the hardest part of registering your packages: the identity step, the D-U-N-S wait, or tracking down which key signed your old releases?