Android developer verification: Paths for Play, third party app distributors, and hobbyists

Welcome, everyone, to our ADS 2026 talk on developer verification.

I'm Rob Clifford from the Android Developer Relations team, joined by my colleague Naheed Vora from a Product Manager from the app and ecosystem trust team.

Today, we're going to go over some of the most important information you need for Android developer verification to ensure that your apps remain compliant.

Our mission here is simple.

We want to give every developer, whether you manage multi-million-dollar apps on Google Play, publish across other app stores such as Samsung, Oppo, Vivo, Honor, and Xiaomi, or build open source tools and student prototypes on the weekends, you'll have a well-lit path forward to verification.

We want to thank you for your questions and feedback because they've directly influenced our app experience and new tools to make these requirements even easier for every developer.

And the adoption has been strong.

Millions of apps have been registered globally since verification opened for everyone in March, and our recent regional launch has also been smooth with registered apps making up over 99% of app installs in the countries we've started launching these protections, which are Brazil, Indonesia, Singapore, and Thailand.

By the end of this session, you should know exactly which verification pathway matches your workflow, how to take advantage of zero-touch automated claims, how the install time verifier works on device, and your key roll-out milestones leading up to global enforcement next year.

Naheed will kick us off with a recap of how developer verification aims to protect the ecosystem and an overview of the exact developer groups affected and what they need.

Naheed, take it away.

Thanks, Rob.

So, to understand why we are introducing Android developer verification, we have to look at the, adversarial landscape, facing our ecosystem.

So today, financial fraud, toll fraud, banking trojans, they cost billions of dollars, in user harm.

When we analyze these threats, there's one pattern that comes out.

Malicious syndicates, they exploit, anonymity to rapidly and repeatedly spread harmful apps, financial fraud, and scams, which take a huge effort to identify.

And by the time we identify them, they have moved on to next target and next package.

And so verification breaks that pattern, that asymmetry, by linking every distributed app to a verified, accountable legal entity or a developer.

Verification substantially raises this economic barrier for scammers and disrupts the viability of this burner malware networks.

We're building a foundation layer for the whole Android ecosystem, and we are partnering with distributors, all around the world to raise the platform security while maintaining the open foundation for the Android.

So, to ensure this compliance, we have created four different pathways for you.

First is for the developers on Google Play.

Over 99% of you have already completed trader ID, and over 99% of your apps are already registered on Play.

Second, for those developers who distribute outside of Play, we have created a dedicated portal, on and we'll talk about that in a bit, where you can identify yourself and then register your packages.

Third, students and hobbyists.

Our limited distribution account is available at no additional cost.

This is free.

There's no ID verification, and the flow is easy for you to authorize the devices you want to share with simple QR-code or handshake.

And thanks to your feedback, we're actually announcing that we're going to raise the limit today from 20 to 50, and that will roll out pretty soon.

And the last one is for power users.

For power users and open source experimenters, you'll have a way to have the freedom through transparent warnings, and we'll talk about that as well later.

So let's deep dive into the first vertical, Google Play Developers.

As I said before, most of you are already verified, and most of your packages are already verified.

Furthermore, Play Console automatically, any package that you register will register through the back-end registry.

However, there is one critical scenario that you should check out immediately.

A lot of you distribute apps outside of Play, for enterprise variants or for, other stores as well.

You need to make sure that if you are using a different package name or a signing key, we would not recognize those apps.

So you need to make sure that they are registered, and here's what you need to do.

There would be a Developer Verification tab on Play Console, and you can go and register those apps there.

Now, let's examine the second vertical.

These are apps distributed outside of Google Play.

To support you without any dependency on Google Play Console, what we have created is a dedicated console for you.

It's android.google.com/developerconsole.

The onboarding workflows is just three simple steps.

The first step is you create your account.

You can register as an organization or as an individual.

Second, you can complete your ID verification.

So, if you're an organization, you need a D-U-N-S number.

If you don't have that, you need to it takes at least 30 days, so you need to go and register and start that process immediately.

And then the last step is register your packages and keys, and there is a very simple way to upload a package and prove that that signing key belongs to you.

And that's it.

Now, I'll turn it over to Rob, who can talk about tools and APIs to make your life easy.

Thanks, Naheed.

So, as organizations prepare for ecosystem-wide adoption, automation becomes even more essential, especially for large studios and third-party distributors who manage anywhere between dozens and thousands of apps.

We need to accommodate these use cases, and to do so, we built the Android Developer Console API to enable seamless, programmatic registration for those use cases where going through this process manually would create a significant bottleneck.

To begin, let's talk about the integration model for the API.

Since Android Developer Verification applies to apps, not just on Play, but others as well, the Android Developer Console API exists to provide the necessary framework for other stores to easily integrate the compliance workflow directly into their user experience.

So, using the Android Developer Console API, you can confirm that the account is verified, programmatically manage generation and completion criteria, manage registrations, which includes handling of new packages, or you can associate any public signing key to deal with packages that have already been registered, or deal with existing packages where the API is enforcing cryptographic proof of ownership through the verification token.

If you manage keys on behalf of your developers, your store back end can automate this process entirely without manual developer interaction.

And finally, the API includes conflict resolution rules based on real install volume, so keys representing over 50% of known installs get priority, preventing unauthorized squatting on established package names.

The Android Developer Console API also includes a helpful authentication model using the standard OAuth 2.0 web server flow with the Android Developer Console scope.

Because developer verification is tied to a verified legal entity under a Google account, traditional service accounts and API keys cannot be used.

Instead, in CI/CD environments like GitHub Actions or Cloud Build, you perform a one-time consent flow with access type offline, store the refresh token securely in your secret manager, and generate short-lived access tokens on demand.

Lastly, the Android Developer Console API is not only available to app distributors besides Play.

Whilst stores can leverage this functionality to improve the compliance flow for their developers, it is also available directly to developers to build into flows as they see fit, whether this is for integration into developer CI/CD flows, or for publishers that manage large catalogs of different apps and need to develop customized solutions for managing the verification status of their whole portfolio.

The Android Developer Console API provides robust tools to make it easy to stay on top of compliance.

To get started using the Developer Console API, check out our developer documentation using the QR-code shown here.

In addition to the Android Developer Console API, we've also introduced the Android Developer Status API to let you check whether an Android app package name is already registered to a verified developer.

If you build software development tools, IDEs, or automated CI/CD workflows, you can integrate this server-to-server API to help your users check package registration status, validate where the app signing certificate matches the registered credentials, and prompt them to register unrecognized apps.

For those with us here at ADS, if you check out the Android platform demo sessions, you can take a look at how this API can check the registration of your live packages.

Now, let's take a look at this third vertical, limited distribution accounts.

We designed this pathway specifically to ensure that students, hobbyists, and independent makers have a way to continue building and sharing apps on Android with their friends, family, classmates, and colleagues.

Using this flow is 100% free.

There's no annual fee, no D-U-N-S number, and no business registration paperwork.

All you need is a Google account.

Registering a package for use in limited distribution is simple.

All you need to do is go to the Android Developer Console and register a valid package name, such as Camera Magic, and give it a friendly name.

Once you've entered your package name, you finish registering by adding a public SHA-256 key generated during build step, and doing this will bind that package and build name to your account, registering it as yours.

Once you've registered your package successfully, you can share it with someone else by adding their device as an associate of your developer account.

You do this by creating a new associated device in the developer console, assigning it a friendly name, and then generating a QR code and link that you can share with the owner of this new device.

When they open the link, they will be prompted to answer whether or not you are a developer that they know and trust and whether or not they want to allow their apps to be installed on your device.

Once a user has consented, they will receive their own generated code to send back to you and once you enter that code, their device will be allowed to install apps associated with your developer account.

In addition to limited distribution as an alternative for developers, we also have the Advanced Flow as an option for power users who want to continue installing unregistered packages at their own discretion.

We built the Advanced Flow to allow experienced users to install unregistered apps when they choose to accept the risk, while keeping critical guardrails in place against social engineering scams for everyday users.

In real world financial fraud and call forwarding scams, criminals rely on urgency, fear, and high pressure phone coercion to force victims into side loading malicious payloads.

By requiring a device reboot and an unskippable 24-hour countdown, Advanced Flow disrupts this pressure, giving potential victims the time and space to make an informed decision about what they're being asked to do.

To enable this option, you'll begin by putting your device into developer mode by going to Settings, About phone, and tapping the build number 7 times.

If you're watching this and you weren't already a developer, congratulations on your new role.

Thank you for laughing.

Now that the device is in developer mode, we can access the Advanced Flow option by going to System, Developer options, and toggling allow apps from unverified developers.

Once you've toggled this option, you may need to enter your PIN and then you'll have to acknowledge the warning indicating that if somebody is telling you to do this, it's likely a scam.

Next, you restart the device to initiate the 24-hour security delay.

This step is critical in helping victims of scams get an opportunity to de-escalate from urgency tactics employed by scammers, and then get help in shutting down this attempt to exploit them.

During the 24-hour window, Settings displays an active countdown timer of the time remaining before you can use the Advanced Flow.

Once the 24 hours is up, the user can select whether to disable verification temporarily for 7 days or to keep it off permanently.

One last time, the user has to acknowledge the risk inherent with removing this default safety precaution before tapping Done to complete the device configuration for Advanced Flow.

From that point forward, users are able to install unregistered apps.

This gives power users the unrestricted control over apps that they want to install that they expect, while keeping everyday users safe.

Now let's review our rollout timeline for developer verification.

Phase 1 began in March 2026 with the introduction of the Android Developer Console.

And then Phase 2 started 5 months later when developer tooling became more generally available.

Phase 3 was our most recent critical milestone, September 30th, 2026.

On this date, regional enforcement began across the 4 regional rollout markets we mentioned before: Brazil, Indonesia, Singapore, and Thailand.

In these markets now, 7 major partner stores enforce verified developer requirements.

Phase 4 will look to expand this user protection requirement thoughtfully and incrementally next year in 2027.

And lastly, it's important to note that if you're based in China, but you distribute to these enforced regions, you must also register the apps that are going to be distributed as well.

I'll pass this back to Naheed to close us out and give a recap on what you need to do.

All right.

All right.

So, thanks, Rob.

So, to recap the most critical steps, so for developers who distribute on Play, audit your apps on the Play Console today and make sure that your apps are registered and claimed, the specifically the ones that you distribute outside of Play.

Secondly, for apps you exclusively distribute outside of Play, create your Android Developer Console account, this link.

And then for students and hobbyists, you can create your free account and distribute up to 50 devices.

Thank you all so much for joining us today.

We are thrilled to partner with you and making Android a safer and a secure ecosystem for billions of users worldwide.

There's a QR code on the next slide where you can access the developer documentation.

We can't wait to see you what you build next.

Have a wonderful Android Dev Summit.

Thank you.