Android Developer Verification: What App Owners Must Do Before 2027

By the MobileMerit team · Updated 13 November 2026 · 15 min read · Checked against Google’s official documentation

Key takeaways

• It checks who you are, not your app. Verification confirms the developer’s identity and links it to the app’s package name and signing key. It is not a content review.
• It applies to every install source. Google Play, Samsung Galaxy Store, Xiaomi GetApps and four other stores already check registration in the first-wave countries, and Google plans to extend this to all third-party stores.
• Play developers are mostly done. Google says most Play developers are already verified and over 99% of apps are registered. The remaining 1% is where problems hide.
• Off-Play apps need work. APKs on your website, enterprise side-builds and apps in other stores must be registered, and you may need to prove you own the signing key with a signed APK.
• Unregistered apps lose installs. Users can still sideload them, but only through ADB or a one-time flow with a 24-hour wait.

What is Android developer verification?

Android developer verification is a requirement that every app installed on a certified Android device must be registered by a developer whose identity Google has verified. A new Google system service, the Android Developer Verifier, checks at install time whether the app’s package name and signing key belong to a verified developer.

Google’s reason is security. It cites analysis showing over 90 times more malware from sideloaded sources than on Google Play, and wants to stop bad actors from publishing again and again under new, anonymous identities. Verification does not review your app’s content or where it came from. It only confirms who you are.

In practice, every app needs two things linked together:

1. A verified developer identity: an individual or an organisation, confirmed through Play Console or the new Android Developer Console.
2. A registered package name: your app ID (for example com.example.myapp) linked to the signing key or keys you use to sign it.

Android developer verification timeline (2026–2027)

The seven stores checking registration in the first wave are Google Play, HONOR App Market, OPPO App Market, Samsung Galaxy Store, Transsion Palm Store, vivo V-Appstore and Xiaomi GetApps. Google says verification will soon expand to all third-party Android app stores.

Who must verify (and who doesn’t)

The requirement depends on how you distribute, not on what tools you build with. Use the chart and table below to find your path.

Two further details from Google: if you distribute on Google Play, your apps across all form factors must be registered. For apps distributed only outside Play, the September 2026 requirement covers phones and tablets, though Google recommends registering every form factor.

Account types and costs

Play Console vs Android Developer Console

Step by step: if your app is on Google Play

1. Open the verification page. In Play Console, go to Android developer verification. It lists every package name and its registration status.
2. Check every app, including old and unlisted ones. If you already verified your identity in Play Console, Google registers eligible apps automatically. Apps using Play App Signing are claimed automatically because Google holds the signing key.
3. Fix any app that isn’t registered. Use the manual claim process: select Register package name, enter the package name and a friendly name, then add or select the signing key (see signing-key ownership below).
4. Register your off-Play builds here too. If the same app or a different app is also on Galaxy Store, Xiaomi GetApps or your website, register those package names and signing keys in Play Console. You don’t need a separate Android Developer Console account.
5. Add extra keys. If an off-Play build is signed with a different key (common with some third-party stores), add that key’s SHA-256 fingerprint to the registered package name.

Android Studio also shows each app’s registration status when you generate a signed App Bundle or APK, which makes a useful last check before release.

Step by step: if you distribute outside Google Play only

1. Create an account at android.google.com/developerconsole and pay the $25 registration fee (or choose a free limited distribution account if you only share with up to 20 devices).
2. Verify your identity. Individuals provide identity documents and contact details. Organisations provide a D-U-N-S number and a website verified in Google Search Console.
3. Register each package name. For a brand-new package name, upload the public key certificate from your signing key pair. For a package name that already exists on Android devices, prove you own the private key by uploading a signed APK.
4. Automate if you have many apps. The Android Developer Console API lets you register and manage package names from your own tooling and CI/CD pipeline, including bulk registration.
5. Confirm the status in the console or with the Developer ID Status API before your next release.

How to prove signing-key ownership

This is the step that trips up most teams, especially when an app was built by a freelancer, an agency or an old team member.

1. Find your certificate fingerprint

Each registration is tied to the SHA-256 fingerprint of your signing certificate. Get it with keytool (included with the JDK) or Gradle:

# keytool: replace the keystore file and alias with yours
keytool -list -v -keystore my-release-key.jks -alias my-key-alias

# or, from the root of an Android / Flutter android project
./gradlew signingReport

If you use Play App Signing, the app signing key’s certificate is shown on the App integrity page in Play Console.

2. New vs existing package names

3. Build the proof APK

When you choose Upload APK, the console gives you a short snippet to place in a file named adi-registration.properties inside the APK’s assets/ folder. Then sign the APK with the private key that matches the certificate you selected, and upload it.

# Native Android project
app/src/main/assets/adi-registration.properties

# Flutter project: use the Android assets folder,
# NOT a pubspec.yaml asset (those are packaged under flutter_assets/)
android/app/src/main/assets/adi-registration.properties

# Build and confirm the file is at the APK root assets folder
flutter build apk --release
unzip -l build/app/outputs/flutter-apk/app-release.apk | grep adi-registration

Tip: always run the unzip -l check. If the file shows up as assets/flutter_assets/..., it is in the wrong place and the proof will fail. For Unity, Godot and other engines, use the engine’s custom Android/Gradle build option so you can add files to the Android assets folder, then check the exported APK the same way.

4. Apps signed by a third-party store

If a store such as Samsung Galaxy Store signs your app for you, upload your build to that store, download the final signed APK from it, and upload that APK as proof.

What happens if your app isn’t registered

From the enforcement date in each country, certified Android devices block normal installs and updates of unregistered apps from participating stores. Users can still install them, but only through:

• ADB, the developer command-line tool. It is unchanged and has no waiting period.
• The advanced flow, a one-time device setting with deliberate friction to stop scam-coached installs.

For a business, this means lost downloads, failed updates (including security fixes) and support tickets from users who see warnings. It’s a small job to avoid and a costly one to fix after launch.

Special cases: agencies, game engines and enterprise apps

Apps built by an agency or freelancer

Verification links the app to whoever owns the developer account and the signing key. If your agency published the app under its account, the agency’s identity is attached to your product. Before 2027, make sure:

• the app sits in a Play Console or Android Developer Console account you own (transfer it if not);
• you have the upload/signing keystore and passwords, or the app uses Play App Signing;
• apps moved between accounts show as registered. Migrated package names sometimes need a manual claim.

Flutter, Unity and Godot apps

Nothing about verification depends on the framework. What matters is the package name, the signing key and, for proof of ownership, getting the verification file into the APK’s root assets/ folder.

Apps in closed testing only

Apps that never reached production, or whose signing key was rotated without being re-uploaded, are the ones most often missed by automatic registration. Check them by hand.

Enterprise and in-house apps

Apps installed on managed devices through an organisation’s own store don’t need verification. Register them anyway if staff might install them on personal devices.

What to do this week, by role

Checklist: before the 2027 global rollout

• List every app you’ve ever shipped: Play, other stores, website APKs, client builds, test builds.
• Confirm you own the developer account for each one, not an ex-employee or agency.
• Back up all keystores, aliases and passwords. Note which apps use Play App Signing.
• Open Play Console → Android developer verification and confirm every package shows as registered.
• Register off-Play package names and add extra signing keys (for example Galaxy Store-signed builds).
• Outside Play only: create an Android Developer Console account and verify your identity.
• Organisations: get a D-U-N-S number (allow up to 28 days) and verify your website in Search Console.
• Test the proof-APK process on one app first, using the unzip -l check.
• Move hobby and internal test builds to a limited distribution account if you share with 20 devices or fewer.
• Add “registration status” to your release checklist. Android Studio shows it when you build a signed APK or bundle.

Common mistakes to avoid

Glossary

Certified Android device

A phone or tablet that ships with Google Play services after passing Google’s compatibility tests. Verification checks run on these devices.

Package name

Your app’s unique ID, such as com.example.myapp. It can’t be changed after you publish.

Signing key

The private key used to sign your APK or App Bundle. It proves updates come from the same developer.

Upload key

The key you sign uploads to Google Play with when you use Play App Signing. Google then re-signs the app with the app signing key.

Play App Signing

A Google Play service that stores your app signing key for you. Apps using it are claimed automatically for verification.

Android Developer Verifier

The Google system service on devices that checks whether an app is registered to a verified developer.

Android Developer Console

Google’s new console for developers who distribute apps only outside Google Play.

Limited distribution account

A free account with no government ID check that lets students and hobbyists share apps with up to 20 devices.

Advanced flow

A one-time device setting, with a 24-hour wait, that lets power users install apps from unverified developers.

D-U-N-S number

A free nine-digit business identifier from Dun & Bradstreet that organisations use to verify their identity.

ADB

Android Debug Bridge, the developer command-line tool. Installing apps with ADB is unaffected by verification.

Frequently asked questions

Official resources

• Android developer verification guides (Android Developers)
• Developer verification FAQ (Android Developers)
• Understanding Android developer verification (Google Help)
• Register package names in Play Console (Play Console Help)
• Prove ownership of an existing package name (Play Console Help)
• Verification rolling out to all developers (Android Developers Blog)
• Android Developer Console sign-up

Related MobileMerit guides: How to publish an app on Google Play · Android app submission checklist · Android app development

Update log

• 13 November 2026: Added key-numbers panel, install-time and key-proof diagrams, console comparison, actions by role, glossary and two new FAQs.
• 12 November 2026: First published, checked against Google’s developer verification documentation.

This guide reflects Google’s published documentation as of 13 November 2026. Google may update dates and requirements; check the official resources above before acting.