Cover: apps outside Play, who must verify and by when. 12 Nov 2025 early access; 30 Mar 2026 open to every developer; Aug 2026 limited distribution for 20 devices and the advanced flow; 30 Sep 2026 enforced in Brazil, Indonesia, Singapore and Thailand for 7 app stores; 2027 all apps on certified devices worldwide

Google now requires Android apps on certified devices to come from a developer who has verified their identity and registered the app's package name with its signing key. Apps on Google Play were mostly handled automatically. The teams that have work to do are the ones that ship outside Play: APKs on their own website, enterprise apps, alternative stores, and test builds sent to testers by link or QR code. This is what changed, what is enforced today and what comes in 2027, and the exact steps, from Google's developer verification documentation and blog as they read on 25 October 2026.

The timeline

text
date           what happened
Aug 2025       requirement announced
12 Nov 2025    early access in the Android Developer Console (apps outside Play)
30 Mar 2026    verification open to all developers, in the Android Developer
               Console and in Play Console
Jun-Jul 2026   the Android Developer Verifier system service reaches most devices;
               registration Status API goes global
Aug 2026       limited distribution accounts (20 devices) and the 'advanced flow'
               for experienced users launch globally
30 Sep 2026    enforcement starts on certified devices in Brazil, Indonesia,
               Singapore and Thailand, for installs from participating stores
2027           expands worldwide to all apps on certified Android devices

What is enforced right now, and what isn't

Since 30 September 2026 the check runs in four countries, and Google's FAQ limits it, for now, to apps installed from seven participating stores: Google Play, HONOR App Market, OPPO App Market, Samsung Galaxy Store, Palm Store, V-Appstore and Xiaomi GetApps. Its wording is that if you distribute through other stores, or users sideload your app directly, the requirements won't apply to your app yet. Not every Google page agrees: the limited distribution guide says unregistered package names will no longer be installable on certified devices in those regions, without mentioning stores, and Android Authority reported in August that a Google community manager said the install source doesn't matter, only the registration. Read the FAQ as today's rule and the stricter pages as where it is going.

text
install path                          today (Oct 2026)                  2027
Play, or one of the 7 stores,         unregistered app blocked          blocked worldwide
  in BR / ID / SG / TH
same stores, other countries          not checked                       blocked worldwide
APK from your website or a QR link    not checked (FAQ)                 blocked unless registered
adb install (and Android Studio)      exempt                            exempt
your organisation's managed store     exempt                            exempt
AOSP / non-certified devices          not covered                       not covered
user turned on the advanced flow      warning, 'Install anyway'         warning, 'Install anyway'

Google gives Android 7 and up as the scope on its developer site; its consumer help page says Android 8 and up. Either way the check comes through Google Play services, so phones without Google services are outside it.

Two kinds of account

text
                       full distribution                 limited distribution
for                    anyone distributing apps          students, hobbyists, 'no
                                                         commercial intent'
fee                    $25 once (Play developers         free
                       already verified: no new fee)
identity               government photo ID + proof of    Google Account with 2-step
                       address; organisations add a      verification, payments
                       D-U-N-S number, a website in      profile, contact email
                       Search Console and company docs
installs               unlimited                         up to 20 devices whose users
                                                         accepted an invitation
moving                 -                                 can upgrade to full; full
                                                         can't move to limited

For a business the choice is made for you: limited distribution excludes commercial use, so a company's QA phones belong under a full account. Start with the slow part: a D-U-N-S number is free from Dun & Bradstreet but Google warns it can take up to 28 days. The individual form takes about 10 minutes if the documents are at hand.

Registering a package, step by step

Apps on Play that use Play App Signing were registered automatically (Google says 99% of Play apps), and the rest had until 30 September 2026 to register in Play Console. For an app that ships only outside Play, it happens in the Android Developer Console at android.google.com/developerconsole:

bash
# 1. the SHA-256 fingerprint of the key that signs what you ship
apksigner verify --print-certs app-release.apk | grep SHA-256
# or from the keystore
keytool -list -v -keystore release.keystore -alias release | grep SHA256

# 2. Android Developer Console > Packages > add package name + fingerprint
#    status: In review

# 3. prove you hold the key: the console gives you a verification token
#    put it in app/src/main/assets/adi-registration.properties
#    build, sign with the SAME release key, upload that APK
#    status: Registered (and an email)

A package can have several registered keys. If the name is already claimed by someone else you can ask to share it, with an extra review; Google settles disputes in favour of the developer whose keys cover more than half of the app's known installs. And the rule that should change how you store keys: if you lose your signing key, you can't register the package. Our code signing guide covers making and backing up keys.

Count your packages and keys first

Registration is per package name and per signing key, and build setups multiply both. A typical React Native app with three variants, worked through:

text
package                     signed with                       register?
com.acme.app                release key                       yes
com.acme.app.staging        release key                       yes (same key, new name)
com.acme.app.debug          each developer's own debug.keystore
                            (a different fingerprint on every  no: install these with adb,
                            machine)                           which is exempt
white-label: com.client.app the client's key                  the client registers it

to register: 2 packages x 1 key = 2 entries
if testers get staging by QR link: it must be registered by 2027

Two choices keep the list short. Install debug builds with adb (or Android Studio, which uses adb) instead of sending them by link; or, if testers need debug builds over the air, commit one shared debug keystore for the team and register that fingerprint once. And if an alternative store re-signs your APK with its own key, register that store's fingerprint too, from the copy it serves.

Testers and the advanced flow

A tester whose phone must install an unregistered build has two routes. adb install from a computer always works and skips every wait. On the phone itself, Android's advanced flow lets an experienced user allow apps from unverified developers, once:

text
1. Developer options > 'Apps from unverified developers'
   > Allow apps from unverified developers
2. confirm with the screen lock, and that nobody is coaching you
3. restart, then wait 24 hours (one time only)
4. confirm with fingerprint or PIN; allow for 7 days or indefinitely
-> every unverified install still shows a warning with 'Install anyway'
-> updates to unregistered apps fail while the setting is off (adb still works)

The 24-hour wait is the part to plan around: a tester can't do it in the meeting where they need the build. For testers in Brazil, Indonesia, Singapore or Thailand installing through one of the seven stores, register now; for everyone else, register before 2027 and keep adb as the fallback.

Check registration in CI

Google's Developer ID Status API answers, for a package and a fingerprint, whether it is registered. It takes an API key from a Cloud project, allows 1,000 requests a day per project, and makes a cheap release gate before a build goes out by link:

bash
curl -s -H "X-Goog-Api-Key: $DEV_ID_STATUS_KEY" \
  "https://androiddeveloperidstatus.googleapis.com/v1/packages/com.acme.app/packageRegistrationStatus:check?certificateFingerprint=$SHA256"
# REGISTERED | NOT_REGISTERED | REGISTERED_WITH_ANOTHER_CERTIFICATE_FINGERPRINT

REGISTERED_WITH_ANOTHER_CERTIFICATE_FINGERPRINT is the one to stop on: the name is registered, but not with the key this build is signed with, which is exactly what happens when CI signs with a different keystore from the one you registered. Registration itself can be automated too, through the Android Developer Console API, but only with a user's OAuth consent (no service accounts): keep a refresh token in a CI secret.

The checklist

text
[ ] organisation: request a D-U-N-S number now (up to 28 days)
[ ] create the account: Play Console if you're on Play, else the Android
    Developer Console ($25, ID, proof of address)
[ ] list every package name you ship (flavors, staging, white-label)
[ ] list every key that signs them (apksigner verify --print-certs)
[ ] register each package + key; ship the adi-registration.properties APK
[ ] register store re-signing keys too
[ ] back up the signing keys: a lost key can't be registered
[ ] CI: Status API check before a build goes out by link
[ ] testers: adb for debug builds; document the advanced flow and its 24 h wait
The aipps.dev install-link tool after an APK upload: a QR code, hello-aipps-1.2.0, Android APK, 4.6 MB, 2 d 23 h left, the https://aipps.dev/t/ link with Copy link, Open page and Delete
An APK on an aipps.dev install link. Links like this keep working for registered apps; from 2027 an unregistered package needs adb or the advanced flow.

aipps.dev builds your Android app with the key you register and puts each build on a QR install page for testers.

Make an install link

Related: ad hoc vs TestFlight vs Play internal testing for the store routes that avoid sideloading, and the 2026 and 2027 store deadlines.

Sources, read 25 October 2026: Android Developers, Developer verification (overview, guides, FAQ, Android Developer Console, full distribution, limited distribution, Developer Console API, check registration status); Google Android Help, answer 17065026; Android Developers Blog, 12 November 2025, 30 March 2026 and 18 June 2026 (updated 15 July) posts; Android Authority, 18 August 2026 (advanced flow rollout) and 1-2 October 2026 (what is enforced); Malwarebytes, 27 August 2025 (announcement).