Android Developer Console API

The Android Developer Console API is a RESTful service that lets verified developers automate Android developer verification workflows in the Android Developer Console, including retrieving developer accounts, checking key eligibility requirements, registering Android package names, registering app signing keys, and verifying key ownership.

Overview, use cases, and implementation context

Key use cases and features

• Automated CI/CD package name registration: Register dozens or hundreds of Android package names programmatically (CreateAndroidPackage).
• Pre-flight historical key policy inspection: Programmatically inspect whether Google has previously observed a package name in the ecosystem and whether registering a specific signing certificate requires key ownership verification (GetAndroidPackageRegistrationPolicy).
• Automated app signing key registration and ownership verification: Register public signing certificate SHA-256 fingerprints (CreateAndroidPackageKey), retrieve unique verification challenge tokens (verificationToken), and automate proof of private key possession using single-request or resumable signed APK uploads (VerifyAndroidPackageKeyOwnership).
• Programmatic justification submission: Submit ownership justifications (JustifyAndroidPackageKeyRegistration).
• Status monitoring: Monitor registration status across developer accounts, package names, and app signing keys (GetDeveloperAccount, ListDeveloperAccounts, GetAndroidPackage, ListAndroidPackages, GetAndroidPackageKey, ListAndroidPackageKeys).

End-to-end implementation workflow

1. Verify developer identity once in the UI: Complete developer identity verification (INDIVIDUAL or ORGANIZATION) in the Android Developer Console so verificationState is VERIFIED.
2. Enable the API and authenticate: Enable androiddeveloperconsole.googleapis.com in your Google Cloud project and obtain a user-delegated OAuth 2.0 Bearer access token with scope https://www.googleapis.com/auth/androiddeveloperconsole.
3. Discover your developer account resource name: Call GET /v1/developerAccounts (ListDeveloperAccounts) to retrieve developerAccounts/{developer_account} and verify verificationState is VERIFIED.
4. Check registration policy for the package name: Call GET /v1/developerAccounts/{id}/androidPackages/{pkg}/registrationPolicy (GetAndroidPackageRegistrationPolicy) to inspect keySelectionStrategy (SELECT_KEY_FROM_LIST or USE_ANY_KEY) and any known historical signing keys (knownKeys).
5. Create the Android package resource: Call POST /v1/developerAccounts/{id}/androidPackages?androidPackageId={pkg} (CreateAndroidPackage) with body {"name": ""} (creates resource in DRAFT state).
6. Register your app signing key fingerprint: Call POST /v1/developerAccounts/{id}/androidPackages/{pkg}/keys (CreateAndroidPackageKey) with JSON body {"certificateFingerprintSha256": "..."}. Inspect the returned state:
   • DRAFT: Proof of private key ownership is required, and the response includes a unique verificationToken for Step 7.
   • IN_REVIEW: Proof of ownership and justification are skipped automatically (for example, when registering a new package name that has never been seen on Android, or when you have already verified ownership of this signing key for another package name in the same DeveloperAccount). Skip Step 7 and the justification call in Step 8, and proceed directly to polling GetAndroidPackage and GetAndroidPackageKey.
7. Build and upload the verification APK (if state is DRAFT): Embed the returned verificationToken string into assets/adi-registration.properties inside a minimal APK matching packageName, sign it with your private app signing key, and upload it using POST /upload/v1/developerAccounts/{id}/androidPackages/{pkg}/keys/{sha256}:verify (VerifyAndroidPackageKeyOwnership).
8. Submit justification (if required) and poll registration status: If the key is in OWNERSHIP_VERIFIED state and registrationJustificationRequired is true, call POST /v1/developerAccounts/{id}/androidPackages/{pkg}/keys/{sha256}:justifyAndroidPackageKeyRegistration (JustifyAndroidPackageKeyRegistration). Poll GetAndroidPackage and GetAndroidPackageKey until state reaches REGISTERED.

Local CLI commands for preparing key fingerprints and verification APKs

• Extract SHA-256 certificate fingerprint from a keystore (keytool):

  keytool -list -v -keystore release-key.jks -alias my-key-alias

• Verify SHA-256 signing certificate digest on a built APK (apksigner):

  apksigner verify --print-certs app-release.apk

• Inspect APK package name and embedded token file before upload (aapt2 and unzip):

  aapt2 dump badging app-release.apk | head -n 1
  unzip -p app-release.apk assets/adi-registration.properties

Android Developer Console UI and API capabilities

Service configuration and authentication

All API requests must use HTTPS and include an Authorization: Bearer ACCESS_TOKEN header obtained using the OAuth 2.0 Web Server flow for a Google Account that has completed developer identity verification in the Android Developer Console.

API resources and endpoints

The Android Developer Console API organizes resources in the following hierarchy:

• DeveloperAccount (developerAccounts/{developer_account})
  • AndroidPackage (developerAccounts/{developer_account}/androidPackages/{android_package})
    • AndroidPackageRegistrationPolicy (developerAccounts/{developer_account}/androidPackages/{android_package}/registrationPolicy)
    • AndroidPackageKey (developerAccounts/{developer_account}/androidPackages/{android_package}/keys/{key})

Resource: DeveloperAccount

Represents an account in the Android Developer Console associated with a developer identity.

Enum: DeveloperAccount.VerificationState

Methods: DeveloperAccount

Resource: AndroidPackage

Represents an Android package name registered or being registered under a DeveloperAccount.

Enum: AndroidPackage.State

Resource: AndroidPackageRegistrationPolicy

Singleton resource returned by GetAndroidPackageRegistrationPolicy that describes historical public signing keys detected for a package name and whether registering the package name with a given signing key requires a written justification.

Enum: KnownKey.JustificationRequirement

Enum: AndroidPackageRegistrationPolicy.KeySelectionStrategy

Methods: AndroidPackage

Resource: AndroidPackageKey

Represents a public app signing certificate fingerprint associated with an AndroidPackage and tracks ownership verification and registration review state.

Enum: AndroidPackageKey.State

Methods: AndroidPackageKey

Error handling

When an API request fails, the Android Developer Console API returns an HTTP 4xx or 5xx status code and a standard google.rpc.Status JSON error body:

{
  "error": {
    "code": 400,
    "message": "Invalid certificate fingerprint SHA256 format.",
    "status": "INVALID_ARGUMENT",
    "details": []
  }
}

HTTP status codes and common resolutions

HTTP request and response examples

Replace placeholder values such as ACCESS_TOKEN, 1234567890, com.example.myapp, and 60e860e8... with your own values.

1. GetDeveloperAccount

curl -X GET \
  -H "Authorization: Bearer ACCESS_TOKEN" \
  "https://androiddeveloperconsole.googleapis.com/v1/developerAccounts/1234567890"

Response:

{
  "name": "developerAccounts/1234567890",
  "displayName": "Example Developer",
  "verificationState": "VERIFIED"
}

2. ListDeveloperAccounts

curl -X GET \
  -H "Authorization: Bearer ACCESS_TOKEN" \
  "https://androiddeveloperconsole.googleapis.com/v1/developerAccounts"

Response:

{
  "developerAccounts": [
    {
      "name": "developerAccounts/1234567890",
      "displayName": "Example Developer",
      "verificationState": "VERIFIED"
    }
  ]
}

3. GetAndroidPackageRegistrationPolicy

curl -X GET \
  -H "Authorization: Bearer ACCESS_TOKEN" \
  "https://androiddeveloperconsole.googleapis.com/v1/developerAccounts/1234567890/androidPackages/com.example.myapp/registrationPolicy"

Response:

{
  "name": "developerAccounts/1234567890/androidPackages/com.example.myapp/registrationPolicy",
  "knownKeys": [
    {
      "certificateFingerprintSha256": "60e860e8d77251234567890abcdef1234567890abcdef1234567890abcdef123",
      "justificationRequirement": "NOT_REQUIRED"
    }
  ],
  "keySelectionStrategy": "SELECT_KEY_FROM_LIST"
}

4. CreateAndroidPackage

curl -X POST \
  -H "Authorization: Bearer ACCESS_TOKEN" \
  -H "Content-Type: application/json; charset=utf-8" \
  -d '{"name": ""}' \
  "https://androiddeveloperconsole.googleapis.com/v1/developerAccounts/1234567890/androidPackages?androidPackageId=com.example.myapp"

Response:

{
  "name": "developerAccounts/1234567890/androidPackages/com.example.myapp",
  "packageName": "com.example.myapp",
  "state": "DRAFT",
  "registeredAppStore": false
}

5. GetAndroidPackage

curl -X GET \
  -H "Authorization: Bearer ACCESS_TOKEN" \
  "https://androiddeveloperconsole.googleapis.com/v1/developerAccounts/1234567890/androidPackages/com.example.myapp"

Response:

{
  "name": "developerAccounts/1234567890/androidPackages/com.example.myapp",
  "packageName": "com.example.myapp",
  "state": "REGISTERED",
  "registeredAppStore": false
}

6. ListAndroidPackages

curl -X GET \
  -H "Authorization: Bearer ACCESS_TOKEN" \
  "https://androiddeveloperconsole.googleapis.com/v1/developerAccounts/1234567890/androidPackages?pageSize=100"

Response:

{
  "androidPackages": [
    {
      "name": "developerAccounts/1234567890/androidPackages/com.example.myapp",
      "packageName": "com.example.myapp",
      "state": "REGISTERED",
      "registeredAppStore": false
    }
  ],
  "nextPageToken": ""
}

7. CreateAndroidPackageKey

curl -X POST \
  -H "Authorization: Bearer ACCESS_TOKEN" \
  -H "Content-Type: application/json; charset=utf-8" \
  -d '{
    "certificateFingerprintSha256": "60e860e8d77251234567890abcdef1234567890abcdef1234567890abcdef123"
  }' \
  "https://androiddeveloperconsole.googleapis.com/v1/developerAccounts/1234567890/androidPackages/com.example.myapp/keys"

Response:

{
  "name": "developerAccounts/1234567890/androidPackages/com.example.myapp/keys/60e860e8d77251234567890abcdef1234567890abcdef1234567890abcdef123",
  "certificateFingerprintSha256": "60e860e8d77251234567890abcdef1234567890abcdef1234567890abcdef123",
  "state": "DRAFT",
  "verificationToken": "token_xyz987654321"
}

8. GetAndroidPackageKey

curl -X GET \
  -H "Authorization: Bearer ACCESS_TOKEN" \
  "https://androiddeveloperconsole.googleapis.com/v1/developerAccounts/1234567890/androidPackages/com.example.myapp/keys/60e860e8d77251234567890abcdef1234567890abcdef1234567890abcdef123"

Response:

{
  "name": "developerAccounts/1234567890/androidPackages/com.example.myapp/keys/60e860e8d77251234567890abcdef1234567890abcdef1234567890abcdef123",
  "certificateFingerprintSha256": "60e860e8d77251234567890abcdef1234567890abcdef1234567890abcdef123",
  "state": "REGISTERED"
}

9. ListAndroidPackageKeys

curl -X GET \
  -H "Authorization: Bearer ACCESS_TOKEN" \
  "https://androiddeveloperconsole.googleapis.com/v1/developerAccounts/1234567890/androidPackages/com.example.myapp/keys?pageSize=100"

Response:

{
  "androidPackageKeys": [
    {
      "name": "developerAccounts/1234567890/androidPackages/com.example.myapp/keys/60e860e8d77251234567890abcdef1234567890abcdef1234567890abcdef123",
      "certificateFingerprintSha256": "60e860e8d77251234567890abcdef1234567890abcdef1234567890abcdef123",
      "state": "REGISTERED"
    }
  ],
  "nextPageToken": ""
}

10. VerifyAndroidPackageKeyOwnership

Option A: Single-request media upload

curl -X POST \
  -H "Authorization: Bearer ACCESS_TOKEN" \
  -H "Content-Type: application/octet-stream" \
  --data-binary @app-release.apk \
  "https://androiddeveloperconsole.googleapis.com/upload/v1/developerAccounts/1234567890/androidPackages/com.example.myapp/keys/60e860e8d77251234567890abcdef1234567890abcdef1234567890abcdef123:verify?uploadType=media"

Option B: Resumable upload protocol (recommended for large APKs or CI/CD)

Step 1: Start the resumable upload session and extract the returned X-Goog-Upload-URL header:

curl -i -X POST \
  "https://androiddeveloperconsole.googleapis.com/upload/v1/developerAccounts/1234567890/androidPackages/com.example.myapp/keys/60e860e8d77251234567890abcdef1234567890abcdef1234567890abcdef123:verify" \
  -H "Authorization: Bearer ACCESS_TOKEN" \
  -H "X-Goog-Upload-Protocol: resumable" \
  -H "X-Goog-Upload-Command: start" \
  -H "X-Goog-Upload-Header-Content-Length: FILE_SIZE_IN_BYTES" \
  -H "X-Goog-Upload-Header-Content-Type: application/vnd.android.package-archive" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "developerAccounts/1234567890/androidPackages/com.example.myapp/keys/60e860e8d77251234567890abcdef1234567890abcdef1234567890abcdef123"
  }'

Step 2: Upload the signed APK binary to UPLOAD_SESSION_URI and finalize the session:

curl -X PUT \
  "UPLOAD_SESSION_URI" \
  -H "Content-Length: FILE_SIZE_IN_BYTES" \
  -H "X-Goog-Upload-Offset: 0" \
  -H "X-Goog-Upload-Command: upload, finalize" \
  --data-binary "@app-release.apk"

Response:

{
  "name": "developerAccounts/1234567890/androidPackages/com.example.myapp/keys/60e860e8d77251234567890abcdef1234567890abcdef1234567890abcdef123",
  "certificateFingerprintSha256": "60e860e8d77251234567890abcdef1234567890abcdef1234567890abcdef123",
  "state": "IN_REVIEW"
}

11. JustifyAndroidPackageKeyRegistration

curl -X POST \
  -H "Authorization: Bearer ACCESS_TOKEN" \
  -H "Content-Type: application/json; charset=utf-8" \
  -d '{
    "justification": "We previously distributed com.example.myapp directly from https://downloads.example.com and are migrating to our rotated production key."
  }' \
  "https://androiddeveloperconsole.googleapis.com/v1/developerAccounts/1234567890/androidPackages/com.example.myapp/keys/60e860e8d77251234567890abcdef1234567890abcdef1234567890abcdef123:justifyAndroidPackageKeyRegistration"

Response:

{
  "name": "developerAccounts/1234567890/androidPackages/com.example.myapp/keys/60e860e8d77251234567890abcdef1234567890abcdef1234567890abcdef123",
  "certificateFingerprintSha256": "60e860e8d77251234567890abcdef1234567890abcdef1234567890abcdef123",
  "state": "IN_REVIEW",
  "registrationJustificationRequired": true
}

Additional resources

• Register package names with the Android Developer Console API
• Check app registration status with the Android Developer ID Status API
• Register on Android Developer Console
• Register on Google Play Console