Start here

Android developer verification requirements

Android developer verification connects a verified developer identity with registered package names and signing keys. Since September 30, 2026, the first protections apply to installations from seven participating stores on certified Android 7 or higher devices in Brazil, Indonesia, Singapore and Thailand; Google Play has a separate package-registration requirement.

Guide summary

Understand Android developer verification, package registration and signing certificates, including the scope now in effect in the first four countries.

For: Independent developers, open-source maintainers, app stores and release teams that distribute Android apps on or outside Google Play.

Release sequence

  1. Identify every active package name, including apps distributed outside Google Play.
  2. Record the SHA-256 fingerprint for each current production signing certificate.
  3. Confirm the developer identity and package-name registration in Play Console or Android Developer Console, according to your distribution path.
  4. For each affected store channel, compare the production package name and delivered certificate fingerprint with the registration record.
  5. Resolve remaining console actions and certificate mismatches; keep the broader 2027 rollout on the release roadmap.

Quick facts

First phaseIn effect since September 30, 2026
Initial countriesBrazil, Indonesia, Singapore, Thailand
Device scopeCertified Android 7 or higher
Broader rollout2027 and beyond
Field note

The first phase is limited to the named participating stores, four countries and certified devices. Android says ADB remains unchanged; unregistered sideloading can use the advanced flow with a different user experience. Google's Play package-registration help separately states that unregistered Play apps will be removed from Play; check the actual account and app status in Play Console.

Detailed guidance

Separate identity, package and certificate

Developer identity verification establishes who is responsible for an app. Package registration links that verified identity to a package name. Certificate registration records which signing identity is authorized for the package. A green result in one layer does not prove the other two are complete.

For the first phase, make one release-register row per store-delivered artifact for users in Brazil, Indonesia, Singapore or Thailand on certified Android 7 or higher devices. Record the developer account, package name, storefront, production certificate fingerprint, registration state and last checked date. After the console marks a package complete, check the exact pair again; track Google's broader 2027 rollout as future scope.

  • Use the identity on the production artifact, not a debug build.
  • Track Play and non-Play channels separately.
  • Resolve the Play Console Home task separately from the regional store audit.
  • Escalate package ownership conflicts before changing a key.

Have the production package name and signing certificate ready? Query the official registration state, then use the result to choose your next step.

Run status check →

Frequently asked questions

Does developer verification replace store review?

No. Registration links a verified developer, package name and signing key for Android installation checks. It does not approve app content, billing, target API, or an individual store listing.

Does the September 30, 2026 date apply to every sideload?

No. The first phase is scoped to installations from named participating stores in four countries on certified devices. Android says the ADB workflow remains unchanged, while unregistered sideloading uses the separate advanced flow.

Sources and review

Last reviewed: