Your Field Team Installs Your App From an APK and Android Will Ask Who Made It
Your company has an app that is not in any store. The field engineers use it. It was built for them, signed with a key kept on the build server, and shared as an APK file on a download page. New starters tap the link,
Your company has an app
that is not in any store.
The field engineers use it.
It was built for them,
signed with a key
kept on the build server,
and shared as an APK file
on a download page.
New starters
tap the link,
allow the install,
and get to work.
It has worked this way
for years.
It may not
for much longer.
In August 2025
Google announced
a change for certified Android devices,
which is most of the Android phones
people actually buy.
Apps will have to be registered
by a verified developer
before those phones
will install them.
Not only apps from Google Play.
Apps from anywhere.
Other stores.
Download pages.
Your file.
The plan Google published
had dates.
Verification opened to all developers
in March 2026.
The requirement began
in September 2026
in Brazil, Indonesia, Singapore and Thailand.
It extends to the rest of the world
from 2027.
Developers on Google Play
already verify who they are,
so most public apps
will not notice.
Apps that live
outside the store
are the ones it is aimed at.
Yours lives there.
Registration means
proving who the developer is,
and registering the app's package name
and its signing key.
That is the part
worth starting now.
Do you know
which legal entity
should own the registration?
Do you know
who has the signing key?
Is it the same key
the app has always used,
or did someone rebuild it once
on a laptop?
Has anyone written down
every package name
your company ships this way?
Including the one
a contractor made in 2021.
None of that is hard.
All of it takes longer
than a release.
You may decide
a managed device platform
that distributes private apps
is the better home for it.
That is a real option,
and it also takes time to set up.
The worst way to find out
is a new starter on a Monday,
tapping the link,
and their phone refusing.
Anything you distribute
outside the usual channel
depends on that channel
staying open.
Find out who decides that,
and what they will ask for.
– Serguey Asael Shinder
Originally published by Dev.to Security. Aggregated on AIWithGhost for educational purposes — full credit and traffic to the original publisher.