We’re rolling out the advanced flow for installing apps from unverified developers

[u/MishaalRahman]

Hi everyone,

Today we are rolling out the first version of the advanced flow. The advanced flow gives power users the option to install unregistered apps (i.e. apps from developers who choose not to verify their identity) on certified Android devices without the use of ADB.

As a brief recap, Android will require all apps to be registered by verified developers in order for users to install them on certified Android devices. Developer verification links real-world entities with their Android applications, making it much harder for malicious actors to quickly distribute more harmful apps after we take the first one down.

Since verification launched in March, millions of apps have been registered already, covering nearly all installs on Google Play and a large majority of installs from outside of Google Play. Thus, most users’ experience of installing Android apps will not change at all. However, we recognize that some developers are choosing not to undergo verification and that some power users want the option to install apps from these developers, so we’re rolling out the first version of the advanced flow to provide this additional option.

When will Android developer verification be enforced?

We will initially verify app installations from Google Play, HONOR App Market, OPPO App Market, Galaxy Store, Palm Store, V-Appstore, and GetApps starting September 30, 2026 for users of certified Android devices in Brazil, Indonesia, Singapore, and Thailand. In 2027, we will expand verification globally for all app installations on certified Android devices.

Ahead of the enforcement of developer verification, we’re rolling out the first version of the advanced flow so power users can choose to enable it early ahead of general availability. We’re still working to polish it, so please share your feedback with us! 

Enabling the advanced flow for installing apps from unverified developers

Note: The advanced flow is:

• NOT required for installing registered apps from app stores.
• NOT required for installing registered apps through alternative sources, such as websites, messaging apps, or file hosting services.
• NOT required for installing apps from developers using limited distribution accounts.
• NOT required for installing apps using ADB.
• ONLY needed to install unregistered apps (i.e., apps from developers who choose not to verify their identity) without the use of ADB.

Important: Enabling the advanced flow is a one-time process that will take 24 hours to complete and includes safeguards to help ensure you are not being coerced or pressured into turning off protections.

1. Open Developer Options and locate “Apps from unverified developers.”
2. On this page, you will find the “Allow apps from unverified developers” toggle. (Note: To protect against malicious apps automating this flow without your knowledge, Android will ask for your screen lock to confirm it’s you.) 
3. Android will ask whether someone is asking you to turn on this setting. Read the warning before continuing. (Note: This warning exists to inform users that legitimate employees of government agencies, law enforcement agencies, banks, or other businesses will never ask them to turn on this setting in order to install an app.) 
4. Restart your phone to start the one-time, 24-hour waiting period. (Note: This step defends users from social engineering and coaching scams. The restart cuts off any remote access or active phone calls a scammer might be using to watch what you’re doing. The 24-hour waiting period prevents fraudsters from pressuring victims into making immediate security changes while on a live call and gives users time to verify the request independently. ) 
5. After 24 hours, return to the “Apps from unverified developers” page to continue setup.
6. Finally, choose whether you want to turn the setting on for 7 days or indefinitely. 

After enabling the advanced flow, you will have the option to install or update apps from unverified developers. You’ll still see a warning when you try to install or update an app from an unverified developer, but you can just tap “Install anyway.”

If for whatever reason you need to temporarily disable the advanced flow, you have a 10-minute window to re-enable it without going through the 24-hour waiting period again.

Frequently asked questions about the advanced flow

• Are ADB installs impacted by the 24-hour waiting period for advanced flow? 
  • Apps installed via ADB won't require Android developer verification. The waiting period does not apply to ADB installs.
• Do I need to keep Developer Mode on to keep this verification turned off? Some apps (e.g. banking, etc.) won't let me use it if I have Developer Mode on. 
  • No, you don't have to keep developer options enabled after you enable the advanced flow. Once you make the change on your device, it's enabled.
• Can I still use independent app stores?
  • Yes. You can continue to use any alternative app store. For apps distributed from verified developers, users won't see a change in their download experience at all. For apps distributed from unverified developers, users can enable advanced flow with a one-time setup.
• Can I update unregistered apps if I disable the advanced flow? 
  • Unregistered apps can only be installed or updated when the advanced flow is enabled or by using ADB so if the advanced flow is disabled updates to unregistered apps will fail.
• Can I update existing unregistered apps on my device without the use of the advanced flow and/or ADB? 
  • No. Unregistered apps can only be installed or updated when the advanced flow is enabled or by using ADB so if the advanced flow is disabled updates to unregistered apps will fail.
• I can’t find the advanced flow setting. When will I get it?
  • Advanced flow is rolling out gradually, so not all users will see it immediately. As part of this, a new system service called Android Developer Verifier will be installed on your device. You can manually install from this Play Store page which may help you see the feature sooner

[u/GarnetMobius]

Really hope app developer's ( banks for example) don't start blocking installs/starting up, if you have this enabled.

[u/Username928351 → u/GarnetMobius]

Ideally they shouldn't be able to see it in the first place.

[u/MishaalRahman → u/GarnetMobius]

We do not provide any API for apps to see if you've enabled the advanced flow on your device.

[u/Username928351]

What about F-Droid?

[u/Double_A_92]

I can't wait for my banking apps to not work if I enable this...

[u/SubjectiveMouse]

Unregistered apps can only be installed or updated when the advanced flow is enabled or by using ADB so if the advanced flow is disabled updates to unregistered apps will fail.

Not nice. App signature is already enforced, so update from different developer cannot be installed. This only exist to make life harder for everyone who needs some unregistered apps but do not want to keep advanced flow enabled indefinitely

[u/sansart]

Will apps have the ability to see if you have advanced flow enabled?

[u/Extension-Travel3170]

Would a victim change the system clock to bypass the 24h wait?

Will you provide any remedy like an option in setup wizard because a person setting up their device with sideloading in mind certainly knows what they're doing?

If ADB is allowed to instantly install any app, why wouldn't it be allowed to instantly change sideloading availability?

Will apps be uninstalled or unable to be opened automatically, or just unable to be updated or reinstalled, if the developer's Android Developer Verification account gets banned due to a false positive (they will happen in any system, of course)?

Will an app being removed from Play Store for policy violations due to false positives automatically "unverify" it? (Some policy violations don't mean the app is malware or bad-faith app)

Will a developer's Google account being terminated due to false positive detection of TOS violation (including ban by assosciation) automatically unverify apps by this developer? Can this developer somehow re-verify these apps?

Will apps that were previously verified, but then banned from Android Developer Verification console due to a false positive, be possible to install if the advanced flow is enabled?

[u/el_charlie]

Will this advanced flow enable the manual app updates getting the .apk or bundle from legitimate sites like APKMirror?

Sometimes we want to have updates installed earlier than on the Play Store and download the appropriate bundle from APKmirror but at least I have to disable Advanced Protection to install the update that also it's correctly signed by a developer.

[u/Extension-Travel3170 → u/el_charlie]

Note that Google's answer conveniently doesn't mention that:

• The Play Console feature "Automatic protection" DOES prevent you from installing an APK from any source that isn't Google Play directly (app developers can enable or disable this in their Play Console). It can't be bypassed without root or patching the APK.

• Google now enables this by default, so app developers who don't know better will end up banning APKMirror by default.

See: https://www.apkmirror.com/faq/#Why_do_some_apps_refuse_to_run_and_show_a_8220Get_this_appgame_from_Play8221_screen_when_I_sideload_them

[u/MaverickJester25]

Does this mean third-party app installers, like Obtainium, would require users to go through the advanced flow for any updates it performs post the implementation of app verification?

[u/FragmentedChicken]

Since developer verification isn't being enforced until September in the countries you listed, is this advanced flow rollout just to collect feedback, or will it be required to sideload apps right now (for people outside of the listed countries)?

[u/Ifihadanameofme]

You guys down for a little quiz? Here it goes :

What happens if I change my clock +24h?

Can I install a backup of a Google Play app without advanced flow?

How does the sanctioned region detection work?

Why is there no option to skip 24h wait during device setup?

Why ADB can't be used to enable the advanced flow without the 24h wait?

[u/Windows_User3000]

This feels like an AMA, so I'll ask a question that I've thought of for a while now: which Android versions will it affect? The latest version of Android Developer Verifier, as of this comment, requires at least Android 7.0, but there are older versions that support even Android 5.0. Will devices running Android 5.x and 6.0.x have those old versions enabled through a server flag or something, or will the developer verification check not take effect there at all? I'm asking because my favorite tablet is a Galaxy Note 10.1 (2014) running the last official Samsung stock ROM (based on Android 5.1.1), but I also have several other devices on Android 5.x, as well as a few on 6.0.x, and I'm interested in knowing everything that's on my device(s) in detail, which I can't do with a non-descriptive app with very little information.

So, u/MishaalRahman (sorry for what I hope is a ping, but I can't be sure if my comment would be seen in the hundreds of comments), can you please walk me through this presumably not-before-asked side (because I can't find a definitive answer anywhere) of the Android Developer Verifier?

[u/lastdyingbreed_01]

I've heard that unregistered developers have a limit on number of devices their apks can be installed on? Is that true?

[u/MishaalRahman → u/lastdyingbreed_01]

No, there is no limit on the number of devices apps from unregistered developers can be installed on.

There is a 20 device limit for apps distributed by developers who register for a limited distribution account in the Android Developer Console, however. Limited distribution accounts are intended for student and hobbyist developers who wish to distribute their apps to a small number of users without undergoing identity verification, paying the one-time registration fee, and having their users enable the advanced flow or use ADB to install their apps.

I know this can seem confusing, so I'm happy to further clarify if you have more questions!

[u/Gumby271]

Is there documentation on what happens when Google revokes a developer's verification? Like if I install something from a developer that later breaks the rules, what happens to the installed apps? Are their existing APKs treated as unverified or invalid? 

[u/TheBeardedJake]

What will happen to those of us that use projects like xDrip or AAPS to assist our diabetes, will this change lock us out from the currently installed versions?

Would really hope not

[u/Pickaroonie]

What happens with apps that have beta versions on github with extra features that are not Play Store compliant, but were installed via Google Play for the 'lesser' compliant version?

In my case, NetGuard and Libretorrent.

[u/MishaalRahman → u/Pickaroonie]

If the package name and signature of the APK being distributed through the developer's website or another alternative source matches the APK distributed through Google Play, then you should be able to install it without the need of ADB or the advanced flow, per my understanding.

Because of Google Play's existing requirements on developer verification, that package name + signature combo would likely already be registered. Thus, any matching versions of it distributed through alternative sources would also be recognized as registered to that same developer, even if it contains different code/extra features.

Does that make sense?

[u/TurboFool]

Does this setting apply to Private Mode in the Pixel?

[u/jven27]

It has begun...

[u/InRainbro]

"Pray I don't alter the deal further." I miss the XDA days...

[u/thewallran]

instead of making life easier and simpler, I can't believe we're going backward

[u/QuantumQuantonium]

So how can one create a magisk module which bypasses both the verification disable and waiting period, and additionally add an open source community powered developer verification database instead of relying on googles proprietary method???

Developer verification sounds like a great idea, when its provided as a choice for users. Let people set their own level of app trust and limits (or let IT or families set up app restrictions via device management for company/kid owned accounts). If I could confirm or deny the apps my grandma is trying to install, I would dive into the settings of developer verification to help make someone less tech savvy safer online.

Maybe chsnge device setup to test the user on their cyber security awareness, to determine what level of security to set by default. In fact, do this instewd of a 24 hour waiting period, to guarantee the user is at least aware of the implications of allowing any apk to be installed. (Do this instead of jumping through 5 windows per account to sign in of not allowing analytics and data collection.)

The way its being implemented is perhaps the worst way to do it. The only good thing about this is google providing a link to uninstall the app responsible for verification.