Android Developer Verification: What Changes in 2027

Android developer verification is Google's new rule that every app installed on a certified Android phone must be registered by a developer whose identity Google has checked. It has been enforced since 30 September 2026 in four countries, and Google says it goes global in 2027. If you ship APKs outside Google Play (client test builds, a POS app for a shop, an internal tool), this is the part of Android that changes for you. Here is what is live today, what the Android Developer Console and Google Play Console each do, how sideloading still works, and what I would set up now from Sri Lanka.

What Android developer verification actually checks

Google's guide describes it as linking "real-world entities (individuals and organizations) with their Android applications". In practice it is three things:

• A verified developer account. Either your existing Google Play Console account or a new Android Developer Console (ADC) account.
• A registered package name. Your applicationId is tied to the SHA-256 fingerprint of the certificate you sign with.
• A device-side check. A system service Google rolled out to most devices in June 2026 checks the registration at install time (Android Developers Blog, June 2026).

The check runs on certified Android devices, which covers most phones sold with Google apps. It is about who signed the app, not what the app does. Google's FAQ says verification does not collect information about your app's content or functionality.

Developer verification timeline and rollout

This is the official rollout as of today:

The participating stores in the first phase are Google Play, HONOR App Market, OPPO App Market, Samsung Galaxy Store, Transsion Palm Store, vivo V-Appstore and Xiaomi GetApps (guide).

Sri Lanka is not in the first wave. Google has not said anything specific about Sri Lanka, so my reading is that apps installed here are affected from the global rollout in 2027. Treat that as an inference, not an announcement. Android Authority and The Verge covered the 30 September start if you want the news angle.

Android Developer Console vs Google Play Console

These are the two most searched names around this topic, and the rule for which one you use is simple:

• Only on Google Play: use your existing Play Console. Google says Play automatically registers 99% of apps, and apps using Play App Signing are claimed for you (overview).
• On Play and outside Play: still use Play Console. It has a new Android developer verification page to register the off-Play apps and extra signing keys.
• Only outside Play: create an account in the Android Developer Console.

You can see the status of each package in three places: the Android developer verification page in Play Console, the Package names tab in the ADC (Registered, Not registered or Draft), and Android Studio when you generate a signed APK or AAB (Android Studio Panda 4 and later, per the FAQ).

Full distribution vs limited distribution

Inside the ADC you choose an account type. This is where most freelancers need to think for a minute.

Sources: full distribution, limited distribution, ADC Help: choose a distribution.

A few details that matter for real projects:

• Google says the full identity check typically takes about 10 minutes if your documents are ready. A D-U-N-S number is free but can take up to 28 days, so start early if you register as a company.
• Limited distribution only works for brand-new package names that have never been seen on Android. You can't move a package from a Play account into it.
• Device invites by shared link expire after 7 days. Removing a device stops installs and updates on it, and Google says that can't be undone.
• The document examples on the full distribution page are US examples. I could not find a list of accepted Sri Lankan documents, and the FAQ only says Google is "actively working to support multiple forms of payment" for the fee. Check the console yourself before you promise a client a timeline.

The 20 vs 50 devices discrepancy

At Android Dev Summit 2026 (28 to 29 October), Google said it would "raise the limit today from 20 to 50, and that will roll out pretty soon" (talk page). The limited distribution guide and ADC Help 17131204 now say 50 devices. The overview page, the main guide and Help 16640817 still say 20.

There is a second small conflict. The FAQ says a limited account can be migrated to full distribution (not the other way). Help 16640817 says the plan can't be changed after creation and you create a new account instead. If you think you will need full distribution later, the safe move is to start with full.

Register a package name with its SHA-256 fingerprint

Registration needs the package name, the SHA-256 fingerprint of your signing certificate and, for an existing package name, proof that you hold the private key. The ADC gives you a small snippet to place in your app's assets folder; you build an APK signed with your key and upload it (ADC guide).

Get the fingerprint from your keystore:

keytool -list -v -keystore upload-keystore.jks -alias upload
# look for the line starting with "SHA256:"

Or read it straight from a signed APK, which is the safer check because it proves what you actually shipped:

apksigner verify --print-certs build/app/outputs/flutter-apk/app-release.apk
# "Signer #1 certificate SHA-256 digest: ..."

For a Flutter project, the snippet file goes in android/app/src/main/assets/ (create the folder if it does not exist), then:

flutter build apk --release

When the same package name has been signed by different keys, Google gives priority to the key behind more than 50% of known installs. Otherwise any key with a sizeable cluster (50+ installs) can register, and after that it is first come, first served. Everyone else needs a new package name or an exception request. If you use Play App Signing, note that the key users see is Google's app signing key, not your upload key; Play handles that registration for you.

Sideloading developer verification: the advanced flow

For apps that stay unregistered, users get the advanced flow, which Google previewed in its March 2026 post. The setup is one-time per device:

1. Turn on developer options: Settings, About phone, tap Build number seven times.
2. In System, Developer options, turn on "allow apps from unverified developers".
3. Confirm nobody is coaching you through it, restart the phone and sign back in.
4. Wait the one-time 24-hour period, then confirm with your fingerprint, face or PIN.
5. Choose to allow it for 7 days or indefinitely.

After that, each install of an unregistered app still shows an unverified developer warning with an Install Anyway button. Developer options do not need to stay on. If the user turns the advanced flow off, updates to unregistered apps fail.

This is fine for a power user. It is not something I would ask a shop owner to do for their POS app.

Does ADB still work?

Yes. Google's guide says "ADB workflow and experience stays the same". Installs over ADB need no verification and skip the 24-hour wait:

adb devices
adb install -r build/app/outputs/flutter-apk/app-release.apk

There is no ADB command to skip the 24-hour wait for the on-device advanced flow, though (FAQ). ADB is for your own test devices and a client device you have in your hands, not for distributing to users.

What this means for Sri Lankan freelancers

Freelance Android work in Sri Lanka usually goes out three ways: Play Store releases, test APKs to clients over WhatsApp or Drive, and private builds such as a POS or staff app installed directly. Here is how each one lands in 2027:

• Play Store apps: little changes. Check the Android developer verification page in Play Console and make sure each app shows as registered.
• Client test builds: either ship them through Play internal testing (covered by your Play account) or register the package in your account. A limited distribution account suits only brand-new package names and a small, fixed set of devices.
• POS and private APKs: these need a registered package under a full distribution account, either yours or the client's. Decide who owns the account before launch, because the account holds the identity and the keys.
• Managed company devices: Google says enterprise apps installed from an organization's managed store on managed devices don't need verification, though registering is still recommended.

If you are also sorting out how to get paid for this kind of work, my PayPal in Sri Lanka guide covers that side. For the other Play changes this year, see the Google Play policy update for October 2026 and Flutter 3.50's stricter Android intent verification.

Checklist before the 2027 rollout

• List every app you have shipped outside Play, with its package name and who owns it.
• Find and back up each signing keystore. Note the alias and the SHA-256 fingerprint.
• Play apps: open the Android developer verification page in Play Console and confirm status.
• Off-Play only: create an Android Developer Console account and choose full or limited distribution.
• Organizations: request a D-U-N-S number now and verify the company website in Search Console.
• Register each package name, adding the console snippet to assets and uploading a signed APK.
• Check status in the ADC Package names tab or in Android Studio when you build a signed APK.
• For testers, check the device limit your own ADC shows (20 or 50).
• Tell clients who install APKs directly that from 2027 unregistered builds need the advanced flow or ADB.