How Android Apps Ask Permission and Prove Trust (Play Integrity)

medium

Learn with your AI

Pick a depth. Each prompt opens in your AI pre-loaded with the lesson. Click a row to preview the prompt.

Or teach me the whole lesson:

Why this matters

Android's permission model evolved from install-time (pre-6.0) to runtime (6.0+) to scoped (10+). Modern apps must request dangerous permissions at use-time, with UI prompts. SafetyNet (now Play Integrity API) lets apps attest device integrity — has the device been rooted, is it a stock OEM build, was it tampered. The attestation is cryptographically signed by Google.

Demo

Modern Android permission: requestPermissions([ACCESS_FINE_LOCATION]) at use-time. User sees prompt: 'allow once / while using / deny'. App handles each branch. Play Integrity API: integrityManager.requestIntegrityToken() returns a JWT signed by Google asserting device integrity.

Try it yourself

Build a tiny Android app that requests location at use-time. Test the UX flow.
Integrate Play Integrity API. Note what's attested and what isn't (it's a signal, not a fortress).
Read the SafetyNet → Play Integrity migration docs.

How Android Apps Ask Permission and Prove Trust (Play Integrity)

Why this matters

Demo

Try it yourself

References