Android application signature verification

The Android endpoint can verify the request source through Package Name and App Signature, reducing the risk of package name impersonation, re-signing, and Public API Key abuse.

Package Name

Package Name should be exactly the same as the package name of the actual Android application, for example:

com. company. app

Do not fill in the app display name, download address, or product name. If you use different package names for Debug, test, and production applications, you should plan the configurations separately.

App Signature

App Signature verifies the application's signing credentials. Obtain the actual signing information from the Android build and release process and enter it as required by the console. Pay special attention to:

• Debug signatures are usually different from Release signatures.
• Store re-signed credentials may differ from local Release signatures.
• Multiple channels or different publishing environments may use different signatures.
• The signed value must be complete, well-formatted and avoid extra spaces.

Configuration error troubleshooting

If the Android request is denied:

1. Confirm the Package Name from the actual installation package.
2. Confirm the signature type used by the current build.
3. Check the App Signature against the console configuration.
4. Confirm that the Public API Key belongs to the current Android endpoints.
5. Reinstall the latest build and test again.

Illustration: Android signature verification