[{"data":1,"prerenderedAt":2619},["ShallowReactive",2],{"\u002Fblog\u002Fsign-in-with-apple-private-icloud-com-relay-domain-2026\u002F":3,"\u002Fblog\u002Fsign-in-with-apple-private-icloud-com-relay-domain-2026\u002F-related":430,"\u002Fblog\u002Fsign-in-with-apple-private-icloud-com-relay-domain-2026\u002F-resources":2601},{"id":4,"title":5,"author":6,"body":10,"category":365,"createdAt":366,"description":367,"disclosure":368,"extension":369,"faq":370,"howTo":368,"lastVerified":368,"location":389,"meta":390,"navigation":396,"ogImage":368,"path":397,"primaryKeyword":398,"readingTime":399,"related":400,"seo":404,"sources":405,"stem":420,"tags":421,"takeaways":422,"updatedAt":366,"url":428,"__hash__":429},"blog\u002Fblog\u002Fsign-in-with-apple-private-icloud-com-relay-domain-2026.md","Sign in with Apple New Relay Domain private.icloud.com 2026",{"name":7,"social":8},"Simon Dziak",{"twitter":9},"@SzymonDziak",{"type":11,"value":12,"toc":354},"minimark",[13,20,23,29,34,102,113,117,120,148,151,155,158,220,223,227,230,247,250,254,257,271,274,277,281,331,338,342],[14,15,16],"p",{},[17,18,19],"strong",{},"Apple's August 24, 2026 developer post says that starting later this year, new Sign in with Apple addresses, previously issued on privaterelay.appleid.com, will be issued on private.icloud.com. Apple gives no exact date. Existing privaterelay.appleid.com addresses keep working, so your app can see both domains. Apple asks developers to make account systems, email validation logic and allowlists accept the new domain in addition to the old one.",[14,21,22],{},"I checked Apple's post and docs on October 19, 2026. Apple can change a date or wording, so open the linked page before you plan around it.",[14,24,25,28],{},[17,26,27],{},"Disclosure:"," App369 is my studio. I build and fix Flutter and Firebase apps, and the last section mentions what I sell. Apple doesn't pay me for anything on this page.",[30,31,33],"h2",{"id":32},"the-dated-table","The dated table",[35,36,37,56],"table",{},[38,39,40],"thead",{},[41,42,43,47,50,53],"tr",{},[44,45,46],"th",{},"Change",[44,48,49],{},"Who is affected",[44,51,52],{},"Date",[44,54,55],{},"What to do",[57,58,59,74,88],"tbody",{},[41,60,61,65,68,71],{},[62,63,64],"td",{},"New Sign in with Apple relay addresses move from privaterelay.appleid.com to private.icloud.com",[62,66,67],{},"Any app or website that uses Sign in with Apple and validates, filters or stores user emails",[62,69,70],{},"Post dated August 24, 2026. Issuing starts \"later this year\" with no exact date",[62,72,73],{},"Accept both domains in validation, allowlists and account lookups",[41,75,76,79,82,85],{},[62,77,78],{},"Existing privaterelay.appleid.com addresses",[62,80,81],{},"Users who already signed in with Apple and hid their email",[62,83,84],{},"No change announced. Apple says they \"will continue to work and forward mail to users without interruption\"",[62,86,87],{},"Keep the old domain accepted. Do not rewrite stored addresses",[41,89,90,93,96,99],{},[62,91,92],{},"iCloud+ Hide My Email",[62,94,95],{},"Users who made addresses in iCloud settings, not through Sign in with Apple",[62,97,98],{},"Apple says they \"will remain on icloud.com\"",[62,100,101],{},"Nothing new for this feature",[14,103,104,105,112],{},"Source for all three rows: ",[106,107,111],"a",{"href":108,"rel":109},"https:\u002F\u002Fdeveloper.apple.com\u002Fnews\u002F?id=1ptvdtcm",[110],"nofollow","Apple Developer News",".",[30,114,116],{"id":115},"what-apple-does-and-does-not-say","What Apple does and does not say",[14,118,119],{},"The post is short, so here is the whole of what I can verify.",[121,122,123,132,139,145],"ul",{},[124,125,126,127,131],"li",{},"It says new addresses will be issued on ",[128,129,130],"code",{},"private.icloud.com"," \"starting later this year.\"",[124,133,134,135,138],{},"It says existing addresses on ",[128,136,137],{},"privaterelay.appleid.com"," continue to work.",[124,140,141,142,112],{},"It says Hide My Email addresses remain on ",[128,143,144],{},"icloud.com",[124,146,147],{},"It tells developers to make sure \"account systems, email validation logic, and allowlists\" accept the new domain in addition to the old one.",[14,149,150],{},"It gives no exact date, no list of affected apps, and no technical detail about the sending side. I am not going to guess at any of those.",[30,152,154],{"id":153},"checks-to-run-in-your-code","Checks to run in your code",[14,156,157],{},"Because I can't see your code, treat this as a search list. Each item is my reading of what Apple's one-line instruction means in practice.",[159,160,161,181,193,202,208,214],"ol",{},[124,162,163,166,167,169,170,173,174,177,178,180],{},[17,164,165],{},"Email regexes and validators."," Search for ",[128,168,137],{},", ",[128,171,172],{},"appleid.com"," and ",[128,175,176],{},"privaterelay"," across your app, backend, admin tools and tests. A validator that hardcodes the old domain, or a pattern that allows only a fixed set of domains, would reject a ",[128,179,130],{}," address.",[124,182,183,186,187,189,190,192],{},[17,184,185],{},"Allowlists and blocklists."," If you allow only certain domains, for example in a business-only or invite-only app, add the new domain. If you block free or consumer domains, check whether your ",[128,188,144],{}," rules match ",[128,191,130],{}," (an exact match will not, a suffix match will) and that this is what you intend.",[124,194,195,198,199,201],{},[17,196,197],{},"Disposable-email filters."," Some filters, or third-party lists, treat relay-style addresses as risky. Check what yours does with a ",[128,200,130],{}," address, and what it does with the old domain today, so the two behave the same way.",[124,203,204,207],{},[17,205,206],{},"Backend dedupe and account matching."," If any job groups accounts by email domain, or tries to match a Sign in with Apple user to an existing account by email, check that it does not assume one relay domain. Do not merge accounts on the email alone.",[124,209,210,213],{},[17,211,212],{},"Analytics, CRM and email tools."," Segments, rules and suppression lists that mention the old domain need the new one added. Downstream tools may have their own validation.",[124,215,216,219],{},[17,217,218],{},"Stored data."," Leave existing addresses as they are. Apple says they keep working.",[14,221,222],{},"My advice: add the new domain next to the old one, never in place of it. Apple says existing addresses keep working, so expect users on both.",[30,224,226],{"id":225},"outbound-email-through-the-relay","Outbound email through the relay",[14,228,229],{},"Apple's post does not announce a change here. What the help page says today, in the Certificates, Identifiers & Profiles docs for the private email relay:",[121,231,232,235,238,241,244],{},[124,233,234],{},"To send email through the relay, you register your outbound email domains or addresses in the Email Sources section of Certificates, Identifiers & Profiles.",[124,236,237],{},"Apple says outbound email through the relay must authenticate with SPF and\u002For DKIM, and recommends using both if possible.",[124,239,240],{},"The registered domain and the envelope sender domain must match exactly for the SPF check. If your email provider uses its own envelope domain, DKIM is required, and the signature domain must match the registered From: domain.",[124,242,243],{},"Per Apple, if you don't register all the source domains or emails you use, mail sent to the relay will bounce.",[124,245,246],{},"Individuals can register up to 32 email sources and organizations up to 100.",[14,248,249],{},"The help page does not name any Apple relay domains, and nothing I read says the new domain changes these steps. My suggestion is to open that page, confirm your sending domains show as passing the SPF check, and send a test message to a relay address after Apple starts issuing the new domain.",[30,251,253],{"id":252},"firebase-and-flutter","Firebase and Flutter",[14,255,256],{},"I looked for anything official on the new domain.",[121,258,259,265],{},[124,260,261,264],{},[17,262,263],{},"Firebase Auth."," The Flutter federated authentication page covers Apple sign-in setup, a nonce and ID token, and revoking tokens. In the part of the page I read, it does not mention the private relay or either domain. I read the whole page and found no mention of the relay or either domain.",[124,266,267,270],{},[17,268,269],{},"sign_in_with_apple"," (8.2.0 on pub.dev when I read it). The example requests the email scope. The page has an Apple Mail Relay section that says you need an SPF record because users may choose the private relay. It names no relay domain.",[14,272,273],{},"So I can't say how either library treats the new domain, and I won't guess. The email string comes back from Apple, so the risk is in what your own code does with it afterwards. Check any Cloud Function, security rule or trigger of yours that reads the email.",[14,275,276],{},"My advice: do not assume your auth library filters on the domain. Search your own functions and rules for the old domain.",[30,278,280],{"id":279},"a-short-plan","A short plan",[159,282,283,294,304,310,316,325],{},[124,284,285,288,289,173,291,293],{},[17,286,287],{},"Search"," your repos for ",[128,290,137],{},[128,292,172],{},", including tests and fixtures.",[124,295,296,299,300,173,302,112],{},[17,297,298],{},"Update"," validators, allowlists, blocklists and filters to accept both ",[128,301,137],{},[128,303,130],{},[124,305,306,309],{},[17,307,308],{},"Review"," dedupe and account-matching code so it doesn't treat the email domain as an identity.",[124,311,312,315],{},[17,313,314],{},"Check"," your outbound mail: registered sender domains, SPF, DKIM, and the status in your Apple developer account.",[124,317,318,321,322,324],{},[17,319,320],{},"Test"," a fresh Apple ID sign-in with Hide My Email on a real device once Apple starts issuing the new domain, and again on a release build. Apple gives no date, so I would add a test fixture with a ",[128,323,130],{}," address now and run it against your validators.",[124,326,327,330],{},[17,328,329],{},"Watch"," Apple's developer news for the actual start date.",[14,332,333,334,112],{},"For every other dated Apple, Google Play and Firebase requirement in 2026 and 2027, see ",[106,335,337],{"href":336},"\u002Fblog\u002Fapp-store-google-play-deadlines-2026-2027\u002F","App Store and Google Play deadlines for 2026 and 2027",[30,339,341],{"id":340},"need-a-hand","Need a hand?",[14,343,344,345,349,350,112],{},"If your Flutter app uses Sign in with Apple and you want the validation, allowlists and email setup checked before the new domain appears, the ",[106,346,348],{"href":347},"\u002Ffixed-price\u002Fflutter-firebase-bug-fix\u002F","App Fix Ticket"," covers it in two fixed-price steps. A $450 Diagnosis gives you the root cause with evidence and a fixed repair quote within 3 business days, credited toward the fix. If you go ahead, the $1,200 Fix takes 5 business days and comes as a pull request. Or ",[106,351,353],{"href":352},"\u002Fcontact\u002F","send me a short description",{"title":355,"searchDepth":356,"depth":356,"links":357},"",2,[358,359,360,361,362,363,364],{"id":32,"depth":356,"text":33},{"id":115,"depth":356,"text":116},{"id":153,"depth":356,"text":154},{"id":225,"depth":356,"text":226},{"id":252,"depth":356,"text":253},{"id":279,"depth":356,"text":280},{"id":340,"depth":356,"text":341},"AI & Technology","2026-10-19T10:00:00.000Z","Apple will issue new Sign in with Apple relay addresses on private.icloud.com instead of privaterelay.appleid.com, starting later in 2026. What Apple says, what to check in your email validation, allowlists and outbound mail, checked October 19, 2026.",null,"md",[371,374,377,380,383,386],{"question":372,"answer":373},"What is changing with Sign in with Apple relay addresses?","Apple's August 24, 2026 developer news post says that starting later this year, new Sign in with Apple addresses, previously issued on privaterelay.appleid.com, will be issued on private.icloud.com. Apple does not give a more exact date in the post.",{"question":375,"answer":376},"Do my existing users' relay addresses stop working?","Apple's post says existing addresses on privaterelay.appleid.com will continue to work and forward mail to users without interruption. The post does not say existing addresses will be changed.",{"question":378,"answer":379},"Does this affect iCloud+ Hide My Email?","Apple's post says that after further consideration and reviewing community feedback, iCloud+ Hide My Email addresses will remain on icloud.com. The change applies to new Sign in with Apple addresses.",{"question":381,"answer":382},"What exactly does Apple tell developers to do?","Apple says developers with apps or websites that use Sign in with Apple should ensure their account systems, email validation logic and allowlists accept addresses on private.icloud.com in addition to privaterelay.appleid.com.",{"question":384,"answer":385},"Do I need to change my outbound email setup for the private relay?","Apple's post does not mention a change to sender registration. Apple's Certificates, Identifiers & Profiles help page says that to send email through the relay you register your sending domains or addresses, and that mail must authenticate with SPF and\u002For DKIM. Nothing there says the new domain changes this, so I would re-check your setup but not assume a change.",{"question":387,"answer":388},"Does Firebase Auth or the Flutter sign_in_with_apple package handle the new domain?","I could not confirm it. Firebase's Flutter federated authentication page does not mention the relay or either domain. The sign_in_with_apple page on pub.dev does not name a relay domain either. Treat any claim that they handle private.icloud.com for you as unverified, and test it.","Boynton Beach, FL",{"readingTimeStats":391},{"text":392,"minutes":393,"time":394,"words":395},"6 min read",5.835,350100,1167,true,"\u002Fblog\u002Fsign-in-with-apple-private-icloud-com-relay-domain-2026","sign in with apple private.icloud.com","7 min",[401,402,403],"app-store-google-play-deadlines-2026-2027","google-play-contacts-permissions-policy-2027","google-sign-in-android-deprecated-credential-manager-2026",{"title":5,"description":367},[406,408,411,414,417],{"title":407,"url":108},"Apple Developer News, Update: New domain for Sign in with Apple (August 24, 2026)",{"title":409,"url":410},"Apple Developer Documentation, Communicating using the private email relay service","https:\u002F\u002Fdeveloper.apple.com\u002Fdocumentation\u002Fsigninwithapple\u002Fcommunicating-using-the-private-email-relay-service\u002F",{"title":412,"url":413},"Apple Developer Help, Configure private email relay service","https:\u002F\u002Fdeveloper.apple.com\u002Fhelp\u002Faccount\u002Fconfigure-app-capabilities\u002Fconfigure-private-email-relay-service\u002F",{"title":415,"url":416},"Firebase Docs, Federated identity and social sign-in (Flutter)","https:\u002F\u002Ffirebase.google.com\u002Fdocs\u002Fauth\u002Fflutter\u002Ffederated-auth",{"title":418,"url":419},"pub.dev, sign_in_with_apple","https:\u002F\u002Fpub.dev\u002Fpackages\u002Fsign_in_with_apple","blog\u002Fsign-in-with-apple-private-icloud-com-relay-domain-2026","sign in with apple private.icloud.com, privaterelay.appleid.com, apple private email relay, sign in with apple email validation, apple hide my email icloud.com, sign in with apple allowlist, firebase auth apple sign in, flutter sign_in_with_apple, apple private relay spf dkim",[423,424,425,426,427],"Apple's August 24, 2026 post says that starting later this year, new Sign in with Apple addresses, previously issued on privaterelay.appleid.com, will be issued on private.icloud.com. Apple gives no exact date.","Apple says existing addresses on privaterelay.appleid.com will continue to work and forward mail to users without interruption. So you will have two relay domains in your data, not a swap.","Apple's action item is to make sure account systems, email validation logic and allowlists accept private.icloud.com in addition to privaterelay.appleid.com.","iCloud+ Hide My Email addresses stay on icloud.com, according to the same post. They are a separate feature from Sign in with Apple relay addresses.","Firebase's Flutter federated auth page and the sign_in_with_apple package page say nothing about the new domain on the page, so the checks are in your own code: regexes, allowlists, filters and dedupe logic.","https:\u002F\u002Fapp369.com\u002Fblog\u002Fsign-in-with-apple-private-icloud-com-relay-domain-2026\u002F","exxkZ0sUJwuAP55L95IBaPfdz4wvI8C-sbxC0rwBdQg",[431,1426,2025],{"id":432,"title":433,"author":434,"body":436,"category":365,"createdAt":1352,"description":1353,"disclosure":368,"extension":369,"faq":1354,"howTo":368,"lastVerified":368,"location":389,"meta":1370,"navigation":396,"ogImage":368,"path":1376,"primaryKeyword":1377,"readingTime":1378,"related":1379,"seo":1383,"sources":1384,"stem":1415,"tags":1416,"takeaways":1417,"updatedAt":1423,"url":1424,"__hash__":1425},"blog\u002Fblog\u002Fapp-store-google-play-deadlines-2026-2027.md","App Store and Google Play Deadlines for 2026 and 2027",{"name":7,"social":435},{"twitter":9},{"type":11,"value":437,"toc":1344},[438,444,447,452,456,1250,1262,1265,1275,1278,1282,1299,1302,1306,1322,1325,1329,1335,1337],[14,439,440,443],{},[17,441,442],{},"The App Store and Google Play requirements that affect mobile app owners in 2026 and 2027 fit in one table: Xcode 26 uploads since April 28, 2026, target API 36 and Play Billing Library 8 since August 31, 2026, 16 KB page size support from February 1, 2027, and five Firebase shutdowns between March 22 and September 30, 2027."," The table below is sorted by date, and every row links to the page where the platform states it.",[14,445,446],{},"I checked each one on October 18, 2026. Rows whose date has passed are marked \"In effect\".",[14,448,449,451],{},[17,450,27],{}," App369 is my studio. I build and fix Android and iOS apps, mostly in Flutter, and the last section mentions what I sell. Apple and Google don't pay me for anything on this page.",[30,453,455],{"id":454},"all-dates-in-order","All dates, in order",[35,457,458,476],{},[38,459,460],{},[41,461,462,464,467,470,473],{},[44,463,52],{},[44,465,466],{},"What changes",[44,468,469],{},"Status",[44,471,472],{},"Source",[44,474,475],{},"My guide",[57,477,478,505,528,554,578,600,623,652,677,704,729,755,778,800,826,850,874,898,922,943,967,991,1016,1043,1064,1085,1111,1135,1158,1182,1205,1226],{},[41,479,480,483,489,492,499],{},[62,481,482],{},"January 31, 2026",[62,484,485,488],{},[17,486,487],{},"Apple."," Apple asked developers to answer the updated age rating questions in App Store Connect by this date, to avoid an interruption when submitting app updates. Affects: every app on the App Store.",[62,490,491],{},"In effect",[62,493,494],{},[106,495,498],{"href":496,"rel":497},"https:\u002F\u002Fdeveloper.apple.com\u002Fnews\u002Fupcoming-requirements\u002F",[110],"Apple",[62,500,501],{},[106,502,504],{"href":503},"\u002Fblog\u002Fapp-store-age-rating-questions-update-2026\u002F","Age rating questions",[41,506,507,510,515,517,522],{},[62,508,509],{},"April 28, 2026",[62,511,512,514],{},[17,513,487],{}," Uploads to App Store Connect must be built with Xcode 26 or later, using an SDK for iOS 26, iPadOS 26, tvOS 26, visionOS 26 or watchOS 26. Affects: anyone uploading a build, including Flutter apps.",[62,516,491],{},[62,518,519],{},[106,520,498],{"href":496,"rel":521},[110],[62,523,524],{},[106,525,527],{"href":526},"\u002Fblog\u002Fitms-90725-sdk-version-issue-xcode-26-flutter-2026\u002F","ITMS-90725 and Xcode 26",[41,529,530,533,539,541,548],{},[62,531,532],{},"August 31, 2026",[62,534,535,538],{},[17,536,537],{},"Google Play."," New apps and app updates must target Android 16 (API level 36) or higher. Wear OS and Android Automotive OS apps need API 35, and Android XR apps need API 34. Affects: anyone publishing a new app or an update.",[62,540,491],{},[62,542,543],{},[106,544,547],{"href":545,"rel":546},"https:\u002F\u002Fsupport.google.com\u002Fgoogleplay\u002Fandroid-developer\u002Fanswer\u002F11926878",[110],"Play Console Help",[62,549,550],{},[106,551,553],{"href":552},"\u002Fblog\u002Fgoogle-play-target-api-36-android-16-requirement-2026\u002F","Target API 36",[41,555,556,558,563,565,572],{},[62,557,532],{},[62,559,560,562],{},[17,561,537],{}," New apps and updates must use Play Billing Library 8 or later. Version 7 is no longer accepted by default. Affects: apps with in-app purchases or subscriptions.",[62,564,491],{},[62,566,567],{},[106,568,571],{"href":569,"rel":570},"https:\u002F\u002Fdeveloper.android.com\u002Fgoogle\u002Fplay\u002Fbilling\u002Fdeprecation-faq",[110],"Android Developers",[62,573,574],{},[106,575,577],{"href":576},"\u002Fblog\u002Fplay-billing-library-7-deprecated-update-to-8-2026\u002F","Billing Library 8",[41,579,580,583,588,590,596],{},[62,581,582],{},"September 2026",[62,584,585,587],{},[17,586,487],{}," Answers to the new social media questions in the age rating questionnaire are required when submitting new apps or updates, or apps for notarization for alternative distribution. Apple gives the month, not a day. Affects: every app on the App Store.",[62,589,491],{},[62,591,592],{},[106,593,498],{"href":594,"rel":595},"https:\u002F\u002Fdeveloper.apple.com\u002Fnews\u002F?id=tlur8uvi",[110],[62,597,598],{},[106,599,504],{"href":503},[41,601,602,605,610,612,617],{},[62,603,604],{},"September 9, 2026",[62,606,607,609],{},[17,608,487],{}," iOS and iPadOS apps uploaded to App Store Connect must target iOS 13 or later. Affects: anyone uploading an iOS or iPadOS build.",[62,611,491],{},[62,613,614],{},[106,615,498],{"href":496,"rel":616},[110],[62,618,619],{},[106,620,622],{"href":621},"\u002Fblog\u002Fios-27-sdk-requirement-april-2027-xcode-27-flutter\u002F","iOS 27 SDK checklist",[41,624,625,628,633,635,646],{},[62,626,627],{},"September 14, 2026",[62,629,630,632],{},[17,631,487],{}," Xcode 27 was released. Flutter's docs say Apple mandates the UIScene life cycle for UIKit apps built with the iOS 27 SDK, and that Flutter apps built with Xcode 27 without it fail to launch. Affects: anyone building with Xcode 27, including Flutter apps with a custom AppDelegate.",[62,634,491],{},[62,636,637,169,642],{},[106,638,641],{"href":639,"rel":640},"https:\u002F\u002Fdocs.flutter.dev\u002Frelease\u002Fbreaking-changes\u002Fuiscenedelegate",[110],"Flutter docs",[106,643,498],{"href":644,"rel":645},"https:\u002F\u002Fdeveloper.apple.com\u002Fnews\u002Freleases\u002F",[110],[62,647,648],{},[106,649,651],{"href":650},"\u002Fblog\u002Fflutter-uiscene-migration-xcode-27-app-wont-launch-2026\u002F","UIScene migration",[41,653,654,657,663,665,671],{},[62,655,656],{},"September 30, 2026",[62,658,659,662],{},[17,660,661],{},"Google Play \u002F Android."," Developer verification protections begin for apps installed from participating stores in Brazil, Indonesia, Singapore and Thailand on certified devices running Android 7 or higher. Affects: anyone distributing Android apps.",[62,664,491],{},[62,666,667],{},[106,668,571],{"href":669,"rel":670},"https:\u002F\u002Fdeveloper.android.com\u002Fdeveloper-verification",[110],[62,672,673],{},[106,674,676],{"href":675},"\u002Fblog\u002Fandroid-developer-verification-requirement-2026\u002F","Developer verification",[41,678,679,682,688,691,698],{},[62,680,681],{},"October 30, 2026",[62,683,684,687],{},[17,685,686],{},"Google APIs."," Google says the legacy Fitbit Web API will be turned off and will no longer function or sync data. Support already ended on September 30, 2026. Affects: apps that read Fitbit data through the Fitbit Web API.",[62,689,690],{},"Upcoming",[62,692,693],{},[106,694,697],{"href":695,"rel":696},"https:\u002F\u002Fdevelopers.google.com\u002Fhealth",[110],"Google Health API",[62,699,700],{},[106,701,703],{"href":702},"\u002Fblog\u002Fgoogle-fit-api-deprecated-health-connect-2026\u002F","Google Fit to Health Connect",[41,705,706,708,714,716,723],{},[62,707,681],{},[62,709,710,713],{},[17,711,712],{},"Supabase."," New tables in the public schema stop getting automatic Data API access in existing projects, so they need an explicit grant. Affects: apps with a Supabase backend.",[62,715,690],{},[62,717,718],{},[106,719,722],{"href":720,"rel":721},"https:\u002F\u002Fsupabase.com\u002Fchangelog\u002F45329-breaking-change-tables-not-exposed-to-data-and-graphql-api-automatically",[110],"Supabase",[62,724,725],{},[106,726,728],{"href":727},"\u002Fblog\u002Fsupabase-permission-denied-new-tables-october-30-2026\u002F","Supabase permission denied",[41,730,731,734,739,741,749],{},[62,732,733],{},"November 1, 2026",[62,735,736,738],{},[17,737,537],{}," End of the extension Google offers for the target API 36 and Billing Library 7 deadlines. Affects: anyone who requested an extension.",[62,740,690],{},[62,742,743,169,746],{},[106,744,547],{"href":545,"rel":745},[110],[106,747,571],{"href":569,"rel":748},[110],[62,750,751,169,753],{},[106,752,553],{"href":552},[106,754,577],{"href":576},[41,756,757,760,765,767,772],{},[62,758,759],{},"Later in 2026 (no date given)",[62,761,762,764],{},[17,763,487],{}," New Sign in with Apple relay addresses are issued on private.icloud.com instead of privaterelay.appleid.com. Existing relay addresses keep working. Affects: apps and backends that validate, allowlist or filter users' email by domain.",[62,766,690],{},[62,768,769],{},[106,770,111],{"href":108,"rel":771},[110],[62,773,774],{},[106,775,777],{"href":776},"\u002Fblog\u002Fsign-in-with-apple-private-icloud-com-relay-domain-2026\u002F","Sign in with Apple relay domain",[41,779,780,783,788,790,796],{},[62,781,782],{},"End of 2026",[62,784,785,787],{},[17,786,686],{}," The Google Fit APIs, including the REST API, are supported only until the end of 2026. Affects: apps that read fitness data through Google Fit.",[62,789,690],{},[62,791,792],{},[106,793,571],{"href":794,"rel":795},"https:\u002F\u002Fdeveloper.android.com\u002Fhealth-and-fitness\u002Fhealth-connect\u002Fmigration\u002Ffit",[110],[62,797,798],{},[106,799,703],{"href":702},[41,801,802,805,811,813,820],{},[62,803,804],{},"January 1, 2027",[62,806,807,810],{},[17,808,809],{},"Firebase."," New users can no longer start using the FCM InstanceId server APIs and device groups. Firebase says new users can onboard before this date. Affects: new integrations that use those APIs.",[62,812,690],{},[62,814,815],{},[106,816,819],{"href":817,"rel":818},"https:\u002F\u002Ffirebase.google.com\u002Fdocs\u002Fcloud-messaging\u002Ftroubleshooting",[110],"Firebase",[62,821,822],{},[106,823,825],{"href":824},"\u002Fblog\u002Ffcm-legacy-api-shutdown-http-v1-migration-2026\u002F","FCM migration",[41,827,828,831,836,838,844],{},[62,829,830],{},"Early 2027",[62,832,833,835],{},[17,834,487],{}," Existing apps in the EEA, UK or US whose category is Health & Fitness or Medical, or that are marked in the age rating questionnaire as containing frequent Medical or Treatment Information, must declare a regulated medical device status in App Store Connect. Without it, you can no longer submit app updates. New apps have needed it since March 26, 2026. Apple gives no exact date. Affects: health, fitness and medical apps.",[62,837,690],{},[62,839,840],{},[106,841,498],{"href":842,"rel":843},"https:\u002F\u002Fdeveloper.apple.com\u002Fnews\u002F?id=nyqbfz1y",[110],[62,845,846],{},[106,847,849],{"href":848},"\u002Fblog\u002Fapp-store-medical-device-status-declaration-2027\u002F","Medical device status",[41,851,852,855,860,862,868],{},[62,853,854],{},"January 27, 2027",[62,856,857,859],{},[17,858,537],{}," Four sensitive-permission changes take effect: the Contacts Permissions policy (use the Android Contact Picker unless the app needs broad access), the location button as the minimum for one-time precise location, no READ_CALL_LOG for phone-call account verification, and no geofencing as a foreground service use case. Google ties the contacts and location rules to apps that target Android 17 (API level 37) or later; its call log and geofencing pages give no target API. A 30-day self extension is available in Play Console. Affects: apps that request READ_CONTACTS, ACCESS_FINE_LOCATION or READ_CALL_LOG, or run geofencing in a foreground service.",[62,861,690],{},[62,863,864],{},[106,865,547],{"href":866,"rel":867},"https:\u002F\u002Fsupport.google.com\u002Fgoogleplay\u002Fandroid-developer\u002Ftable\u002F12921780",[110],[62,869,870],{},[106,871,873],{"href":872},"\u002Fblog\u002Fgoogle-play-contacts-permissions-policy-2027\u002F","Play permission changes",[41,875,876,879,884,886,892],{},[62,877,878],{},"February 1, 2027",[62,880,881,883],{},[17,882,537],{}," Updates that don't support 16 KB memory page sizes can't be released, for apps targeting Android 15 (API level 35) and higher. Affects: apps with native code, which includes Flutter apps.",[62,885,690],{},[62,887,888],{},[106,889,571],{"href":890,"rel":891},"https:\u002F\u002Fdeveloper.android.com\u002Fguide\u002Fpractices\u002Fpage-sizes",[110],[62,893,894],{},[106,895,897],{"href":896},"\u002Fblog\u002Fgoogle-play-16kb-page-size-flutter-android-2026\u002F","16 KB page size",[41,899,900,903,908,910,916],{},[62,901,902],{},"February 2027 (no day given)",[62,904,905,907],{},[17,906,537],{}," New technical quality thresholds apply: memory (90th percentile by device RAM and app state), bitmap memory, and at least 25% DEX optimization, obfuscation and shrinking for apps over 10 MB of DEX (games over 50 MB). Google says missing them can affect an app's visibility and publishing capabilities. Affects: all Android apps.",[62,909,690],{},[62,911,912],{},[106,913,547],{"href":914,"rel":915},"https:\u002F\u002Fsupport.google.com\u002Fgoogleplay\u002Fandroid-developer\u002Fanswer\u002F17492799",[110],[62,917,918],{},[106,919,921],{"href":920},"\u002Fblog\u002Fgoogle-play-memory-dex-zero-tap-sign-in-requirements-2027\u002F","Play quality rules",[41,923,924,927,932,934,939],{},[62,925,926],{},"2027 (no month stated)",[62,928,929,931],{},[17,930,661],{}," Developer verification capability expands globally for all apps on certified Android devices. Affects: anyone distributing Android apps.",[62,933,690],{},[62,935,936],{},[106,937,571],{"href":669,"rel":938},[110],[62,940,941],{},[106,942,676],{"href":675},[41,944,945,948,953,955,961],{},[62,946,947],{},"March 22, 2027",[62,949,950,952],{},[17,951,809],{}," Firebase Studio shuts down and remaining data is permanently deleted. Affects: anyone with a Firebase Studio workspace.",[62,954,690],{},[62,956,957],{},[106,958,819],{"href":959,"rel":960},"https:\u002F\u002Ffirebase.google.com\u002Fdocs\u002Fstudio\u002Fmigrating-project",[110],[62,962,963],{},[106,964,966],{"href":965},"\u002Fblog\u002Ffirebase-studio-shutting-down-migrate-project-2027\u002F","Firebase Studio shutdown",[41,968,969,972,977,979,985],{},[62,970,971],{},"March 31, 2027",[62,973,974,976],{},[17,975,809],{}," Firebase Extensions service shuts down. Installed extensions keep running, but you lose the ability to update, reconfigure or uninstall them through the console or CLI. Affects: apps with installed extensions.",[62,978,690],{},[62,980,981],{},[106,982,819],{"href":983,"rel":984},"https:\u002F\u002Ffirebase.google.com\u002Fdocs\u002Fextensions\u002Ffaq-and-troubleshooting",[110],[62,986,987],{},[106,988,990],{"href":989},"\u002Fblog\u002Ffirebase-extensions-shutting-down-replace-2027\u002F","Firebase Extensions shutdown",[41,992,993,996,1001,1003,1009],{},[62,994,995],{},"April 2027",[62,997,998,1000],{},[17,999,487],{}," Apps uploaded to App Store Connect must be built with the iOS 27 and iPadOS 27 SDK or later (tvOS, visionOS and watchOS 27 SDKs for those platforms). Apple gives the month, not a day. Affects: every iOS and Flutter app that ships an update.",[62,1002,690],{},[62,1004,1005],{},[106,1006,498],{"href":1007,"rel":1008},"https:\u002F\u002Fdeveloper.apple.com\u002Fnews\u002F?id=k1mtkt1k",[110],[62,1010,1011,169,1013],{},[106,1012,622],{"href":621},[106,1014,1015],{"href":650},"UIScene and Xcode 27",[41,1017,1018,1020,1025,1027,1039],{},[62,1019,995],{},[62,1021,1022,1024],{},[17,1023,487],{}," Apple's news post says any app or game submitted must include screenshots for iPhone Duo. Its screenshot specifications page says they will be required for any app using the iOS 27.1 SDK or later. Apple gives the month, not a day. Affects: App Store submissions.",[62,1026,690],{},[62,1028,1029,169,1034],{},[106,1030,1033],{"href":1031,"rel":1032},"https:\u002F\u002Fdeveloper.apple.com\u002Fnews\u002F?id=kkphp5qo",[110],"Apple news",[106,1035,1038],{"href":1036,"rel":1037},"https:\u002F\u002Fdeveloper.apple.com\u002Fhelp\u002Fapp-store-connect\u002Freference\u002Fapp-information\u002Fscreenshot-specifications",[110],"Apple specs",[62,1040,1041],{},[106,1042,622],{"href":621},[41,1044,1045,1047,1052,1054,1060],{},[62,1046,995],{},[62,1048,1049,1051],{},[17,1050,487],{}," Apple's submitting page says iOS and iPadOS apps uploaded to App Store Connect must target iOS 15 or later. The upcoming requirements page still lists iOS 13 as the minimum since September 9, 2026. Apple gives the month, not a day. Affects: apps whose deployment target is iOS 13 or 14.",[62,1053,690],{},[62,1055,1056],{},[106,1057,498],{"href":1058,"rel":1059},"https:\u002F\u002Fdeveloper.apple.com\u002Fapp-store\u002Fsubmitting\u002F",[110],[62,1061,1062],{},[106,1063,622],{"href":621},[41,1065,1066,1069,1074,1076,1081],{},[62,1067,1068],{},"April 2027 (no day given)",[62,1070,1071,1073],{},[17,1072,537],{}," Apps that support user sign-in must support zero-tap sign-in restoration through the Restore Credentials API, with exemptions Google lists (including games). Affects: Android apps with sign-in.",[62,1075,690],{},[62,1077,1078],{},[106,1079,547],{"href":914,"rel":1080},[110],[62,1082,1083],{},[106,1084,921],{"href":920},[41,1086,1087,1090,1096,1098,1105],{},[62,1088,1089],{},"Q2 2027 (no day given)",[62,1091,1092,1095],{},[17,1093,1094],{},"Google Mobile Ads (iOS)."," Version 11.x of the Google Mobile Ads SDK for iOS is sunset. Google says it will give the exact date with two months' notice. After sunset, ad requests return a no fill with an error. Affects: iOS and Flutter apps that serve AdMob or Ad Manager ads on v11.",[62,1097,690],{},[62,1099,1100],{},[106,1101,1104],{"href":1102,"rel":1103},"https:\u002F\u002Fdevelopers.google.com\u002Fadmob\u002Fios\u002Fdeprecation",[110],"Google for Developers",[62,1106,1107],{},[106,1108,1110],{"href":1109},"\u002Fblog\u002Fadmob-google-mobile-ads-sdk-sunset-versions-2027\u002F","AdMob SDK sunset dates",[41,1112,1113,1116,1121,1123,1129],{},[62,1114,1115],{},"June 15, 2027",[62,1117,1118,1120],{},[17,1119,809],{}," Firebase ML custom model hosting shuts down. Affects: apps that host custom models in Firebase ML.",[62,1122,690],{},[62,1124,1125],{},[106,1126,819],{"href":1127,"rel":1128},"https:\u002F\u002Ffirebase.google.com\u002Fdocs\u002Fml\u002Fmigrate-to-cloud-storage",[110],[62,1130,1131],{},[106,1132,1134],{"href":1133},"\u002Fblog\u002Ffirebase-ml-model-hosting-shutting-down-migrate-2027\u002F","Firebase ML model hosting shutdown",[41,1136,1137,1140,1146,1148,1154],{},[62,1138,1139],{},"June 30, 2027",[62,1141,1142,1145],{},[17,1143,1144],{},"Google Mobile Ads (Android)."," Version 23.x of the Google Mobile Ads SDK for Android is sunset, so ad requests from it stop filling. Affects: Android and Flutter apps that serve AdMob or Ad Manager ads on v23.",[62,1147,690],{},[62,1149,1150],{},[106,1151,1104],{"href":1152,"rel":1153},"https:\u002F\u002Fdevelopers.google.com\u002Fadmob\u002Fandroid\u002Fdeprecation",[110],[62,1155,1156],{},[106,1157,1110],{"href":1109},[41,1159,1160,1163,1168,1170,1177],{},[62,1161,1162],{},"August 2027 (no day given)",[62,1164,1165,1167],{},[17,1166,661],{}," Google's Android 17 post says new apps and updates on Google Play will be required to target API level 37. For apps targeting API 37, orientation, resizability and aspect ratio restrictions are ignored on screens whose smallest width is over 600dp, and the temporary opt-out from Android 16 is removed. Games are exempt. Affects: apps that lock portrait or set resizeableActivity=false.",[62,1169,690],{},[62,1171,1172],{},[106,1173,1176],{"href":1174,"rel":1175},"https:\u002F\u002Fdeveloper.android.com\u002Fblog\u002Fposts\u002Fprepare-your-app-for-the-resizability-and-orientation-changes-in-android-17",[110],"Android Developers Blog",[62,1178,1179],{},[106,1180,1181],{"href":552},"Target API 36 guide",[41,1183,1184,1187,1192,1194,1199],{},[62,1185,1186],{},"August 31, 2027",[62,1188,1189,1191],{},[17,1190,537],{}," Billing Library 8 reaches its own deadline. New apps and updates must use Billing Library 9 or later. Extension available until November 1, 2027. Affects: apps with in-app purchases or subscriptions.",[62,1193,690],{},[62,1195,1196],{},[106,1197,571],{"href":569,"rel":1198},[110],[62,1200,1201],{},[106,1202,1204],{"href":1203},"\u002Fblog\u002Fplay-billing-library-9-migration-deadline-2027\u002F","Billing Library 9",[41,1206,1207,1210,1215,1217,1222],{},[62,1208,1209],{},"September 29, 2027",[62,1211,1212,1214],{},[17,1213,809],{}," The FCM InstanceId server APIs and device groups are decommissioned. Affects: servers that manage topics or tokens through the old APIs.",[62,1216,690],{},[62,1218,1219],{},[106,1220,819],{"href":817,"rel":1221},[110],[62,1223,1224],{},[106,1225,825],{"href":824},[41,1227,1228,1231,1236,1238,1244],{},[62,1229,1230],{},"September 30, 2027",[62,1232,1233,1235],{},[17,1234,809],{}," Firebase Test Lab is fully shut down. Affects: CI pipelines that run tests on Test Lab.",[62,1237,690],{},[62,1239,1240],{},[106,1241,819],{"href":1242,"rel":1243},"https:\u002F\u002Ffirebase.google.com\u002Fdocs\u002Ftest-lab",[110],[62,1245,1246],{},[106,1247,1249],{"href":1248},"\u002Fblog\u002Ffirebase-test-lab-shutting-down-alternatives-2027\u002F","Firebase Test Lab shutdown",[14,1251,1252,1253,1257,1258,1261],{},"Two more notes. Apple's privacy manifest rules (May 1, 2024 for required reason APIs and February 12, 2025 for common SDKs, see the ",[106,1254,1256],{"href":1255},"\u002Fblog\u002Fapple-privacy-manifest-itms-91053-itms-91061-flutter-fix-2026\u002F","privacy manifest guide",") and the FCM legacy send shutdown (July 22, 2024, see the ",[106,1259,1260],{"href":824},"FCM migration guide",") already passed before 2026. I keep them in their own guides because they still cause upload and delivery errors.",[30,1263,498],{"id":1264},"apple",[14,1266,1267,1268,169,1270,173,1272,112],{},"Apple's page names one build rule that matters most: Xcode 26 or later since April 28, 2026. Apple's September 9, 2026 news post adds the next one: starting April 2027, uploads must be built with the iOS 27 and iPadOS 27 SDK or later, which means Xcode 27. Apple's October 5, 2026 post also says that from April 2027 every submission needs iPhone Duo screenshots. The bigger change with Xcode 27 is the UIScene life cycle, which a Flutter app on 3.41 or later with an unmodified AppDelegate gets automatically. A custom AppDelegate needs manual changes. The guides are ",[106,1269,527],{"href":526},[106,1271,1015],{"href":650},[106,1273,1274],{"href":1255},"privacy manifest errors",[14,1276,1277],{},"My advice: check which Xcode your build machine uses before your next upload, and test a build with Xcode 27 before you need one.",[30,1279,1281],{"id":1280},"google-play-and-android","Google Play and Android",[14,1283,1284,1285,1288,1289,169,1292,169,1294,173,1296,112],{},"The Play rules come in pairs. Target API 36 and Billing Library 8 both took effect on August 31, 2026 with an extension to November 1, 2026. After that, February 1, 2027 brings the 16 KB page size rule, and on August 31, 2027 Google requires Billing Library 9 or later for new apps and updates. The ",[106,1286,1287],{"href":1203},"Billing Library 9 guide"," covers that move. Separately, Android developer verification started on September 30, 2026 in four countries, with a global expansion in 2027. The guides are ",[106,1290,1291],{"href":552},"target API 36",[106,1293,897],{"href":896},[106,1295,577],{"href":576},[106,1297,1298],{"href":675},"developer verification",[14,1300,1301],{},"My advice: if you are still behind on API 36 or Billing 8, ship that update before November 1, 2026. Then do the 16 KB check before February 1, 2027, since it is the next date that can block a release.",[30,1303,1305],{"id":1304},"firebase-and-google-apis","Firebase and Google APIs",[14,1307,1308,1309,169,1313,169,1316,1318,1319,112],{},"Firebase has five shutdown dates in 2027, plus the January 1 cutoff for new users of the InstanceId APIs. Firestore, Authentication, Cloud Functions and Hosting are not on the list. Google Fit APIs are supported only until the end of 2026, and Google points to Health Connect and the Google Health API. The legacy Fitbit Web API goes first: Google says it will be turned off on October 30, 2026. The guides are ",[106,1310,1312],{"href":1311},"\u002Fblog\u002Ffirebase-deprecations-shutdown-dates-2026\u002F","Firebase shutdown dates",[106,1314,1315],{"href":824},"FCM HTTP v1 migration",[106,1317,703],{"href":702}," and, if you use it, ",[106,1320,1321],{"href":727},"Supabase new table permissions",[14,1323,1324],{},"My advice: open the Firebase console for every project you own and look at Extensions, Machine Learning, Test Lab and Studio. Those are the products with a date attached.",[30,1326,1328],{"id":1327},"how-i-keep-this-page-current","How I keep this page current",[14,1330,1331,1332,112],{},"Every row links to the page where the platform states the date. If a source says only a month or \"later this year\", I write exactly that. When a platform moves a date, I change the row and the updated date at the top of this page. If you spot a date that looks wrong, ",[106,1333,1334],{"href":352},"tell me",[30,1336,341],{"id":340},[14,1338,1339,1340,349,1342,112],{},"If one of these deadlines lands on an app you can't update yourself, the ",[106,1341,348],{"href":347},[106,1343,353],{"href":352},{"title":355,"searchDepth":356,"depth":356,"links":1345},[1346,1347,1348,1349,1350,1351],{"id":454,"depth":356,"text":455},{"id":1264,"depth":356,"text":498},{"id":1280,"depth":356,"text":1281},{"id":1304,"depth":356,"text":1305},{"id":1327,"depth":356,"text":1328},{"id":340,"depth":356,"text":341},"2026-10-18T22:00:00.000Z","One dated table of the App Store, Google Play, Firebase and Google API requirements that affect mobile app owners in 2026 and 2027, with the primary source for each date, checked October 18, 2026.",[1355,1358,1361,1364,1367],{"question":1356,"answer":1357},"What is the next Google Play deadline?","The deadline of November 1, 2026 is the end of the extension window for the target API 36 and Billing Library 7 deadlines. After that, the next one is February 1, 2027, when Google says app updates that don't support 16 KB memory page sizes can't be released.",{"question":1359,"answer":1360},"What Xcode version does the App Store require?","Apple's upcoming requirements page says that since April 28, 2026, apps uploaded to App Store Connect must be built with Xcode 26 or later using an SDK for iOS 26, iPadOS 26, tvOS 26, visionOS 26 or watchOS 26. Apple's September 9, 2026 news post adds the next one: starting April 2027, iOS and iPadOS apps must be built with the iOS 27 and iPadOS 27 SDK or later. Apple gives the month, not a day.",{"question":1362,"answer":1363},"Do these deadlines apply to apps already published?","It depends on the rule. Google says existing apps must target API 35 or higher to stay available to new users on newer Android versions, and existing apps keep working on version 7 of Play Billing until you ship an update. Most upload-side rules, such as the Xcode SDK minimum, apply when you submit a new build.",{"question":1365,"answer":1366},"Which deadlines affect a Flutter app?","Nearly all of the Apple and Google Play rows do, because a Flutter app is a normal iOS and Android app underneath. The Firebase rows apply only if you use that Firebase product. The Supabase row applies only if you use Supabase.",{"question":1368,"answer":1369},"How will I know if a date changes?","Each row links to the page where the platform states the date, and I list the date I checked it. Dates can move, so check the linked page before you plan around one. I update this page when a platform changes a date.",{"readingTimeStats":1371},{"text":1372,"minutes":1373,"time":1374,"words":1375},"11 min read",10.505,630300,2101,"\u002Fblog\u002Fapp-store-google-play-deadlines-2026-2027","app store deadlines 2026","6 min",[1380,1381,1382],"google-play-target-api-36-android-16-requirement-2026","itms-90725-sdk-version-issue-xcode-26-flutter-2026","firebase-deprecations-shutdown-dates-2026",{"title":433,"description":1353},[1385,1387,1389,1391,1393,1395,1397,1399,1401,1403,1405,1407,1409,1411,1413],{"title":1386,"url":695},"Google for Developers, Google Health API (Fitbit Web API dates)",{"title":1388,"url":496},"Apple Developer, Upcoming requirements",{"title":1390,"url":644},"Apple Developer, Releases",{"title":1392,"url":639},"Flutter docs, Migrate to UIScene life cycle",{"title":1394,"url":545},"Play Console Help, Target API level requirements for Google Play apps",{"title":1396,"url":569},"Android Developers, Play Billing Library deprecation FAQ",{"title":1398,"url":890},"Android Developers, Support 16 KB page sizes",{"title":1400,"url":669},"Android Developers, Android developer verification",{"title":1402,"url":794},"Android Developers, Migrate from the Google Fit APIs",{"title":1404,"url":817},"Firebase, FCM troubleshooting (InstanceId and device groups deprecation)",{"title":1406,"url":959},"Firebase, Migrate from Firebase Studio",{"title":1408,"url":983},"Firebase, Extensions FAQ and troubleshooting",{"title":1410,"url":1127},"Firebase, Migrate Firebase ML model hosting to Cloud Storage",{"title":1412,"url":1242},"Firebase, Test Lab",{"title":1414,"url":720},"Supabase changelog, Tables not exposed to the Data API automatically","blog\u002Fapp-store-google-play-deadlines-2026-2027","app store deadlines 2026, google play deadlines 2026, app store requirements 2027, google play requirements 2027, target api 36 deadline, play billing library 8 deadline, 16 kb page size deadline, xcode 26 requirement, firebase shutdown dates, mobile app compliance calendar",[1418,1419,1420,1421,1422],"Most 2026 deadlines have already hit. Since April 28, 2026 iOS uploads need Xcode 26 or later, and since August 31, 2026 Google Play needs new apps and updates to target API 36 and use Play Billing Library 8.","Google lets you request an extension for both Play deadlines until November 1, 2026. That is the last date to ship an update if you are still behind.","The next hard date for Android is February 1, 2027. Google says updates that don't support 16 KB memory page sizes can't be released after that.","On iOS, apps built with Xcode 27 must use the UIScene life cycle or they fail to launch. Xcode 27 was released on September 14, 2026.","Firebase has five shutdowns between March 22 and September 30, 2027. Core services such as Firestore and Authentication are not on the list.","2026-10-19T20:00:00.000Z","https:\u002F\u002Fapp369.com\u002Fblog\u002Fapp-store-google-play-deadlines-2026-2027\u002F","FbOh9MP9nZ4xpsiM__nWK3lNaJZ_VN9MYPFUGpr2LaA",{"id":1427,"title":1428,"author":1429,"body":1431,"category":365,"createdAt":366,"description":1945,"disclosure":368,"extension":369,"faq":1946,"howTo":368,"lastVerified":368,"location":389,"meta":1962,"navigation":396,"ogImage":368,"path":1968,"primaryKeyword":1969,"readingTime":1970,"related":1971,"seo":1973,"sources":1974,"stem":2015,"tags":2016,"takeaways":2017,"updatedAt":366,"url":2023,"__hash__":2024},"blog\u002Fblog\u002Fgoogle-play-contacts-permissions-policy-2027.md","Google Play Contacts and Location Permission Changes 2027",{"name":7,"social":1430},{"twitter":9},{"type":11,"value":1432,"toc":1931},[1433,1439,1442,1447,1449,1565,1568,1572,1575,1578,1581,1584,1600,1603,1606,1610,1616,1622,1628,1638,1642,1651,1656,1662,1665,1669,1674,1679,1685,1689,1694,1699,1721,1725,1732,1810,1813,1818,1833,1840,1849,1860,1863,1866,1868,1918,1922,1924],[14,1434,1435,1438],{},[17,1436,1437],{},"Google Play's deadlines table lists January 27, 2027 for four sensitive-permission changes: a new Contacts Permissions policy, the location button as the recommended minimum for precise location, no more READ_CALL_LOG for phone-number verification, and geofencing removed as a foreground service use case."," The contacts and location button rules are tied to apps that target Android 17 (API level 37) or later. Google's call log and geofencing pages say only \"effective January 27, 2027\" and give no target API. The June 2026 Play newsletter says \"Starting October 28, 2026\" for the contacts and location changes, and I could not reconcile the two dates.",[14,1440,1441],{},"I checked each one on October 19, 2026. Google can change a date, so open the linked page before you plan around it.",[14,1443,1444,1446],{},[17,1445,27],{}," App369 is my studio. I build and fix Flutter and Firebase apps, and the last section mentions what I sell. Google doesn't pay me for anything on this page.",[30,1448,33],{"id":32},[35,1450,1451,1468],{},[38,1452,1453],{},[41,1454,1455,1457,1460,1463,1466],{},[44,1456,46],{},[44,1458,1459],{},"Announced",[44,1461,1462],{},"Declaration",[44,1464,1465],{},"Compliance date",[44,1467,472],{},[57,1469,1470,1496,1519,1543],{},[41,1471,1472,1475,1478,1481,1485],{},[62,1473,1474],{},"Contacts Permissions policy",[62,1476,1477],{},"April 15, 2026",[62,1479,1480],{},"Play Console prompts start September 2026",[62,1482,1483],{},[17,1484,854],{},[62,1486,1487,169,1491],{},[106,1488,1490],{"href":866,"rel":1489},[110],"Deadlines table",[106,1492,1495],{"href":1493,"rel":1494},"https:\u002F\u002Fsupport.google.com\u002Fgoogleplay\u002Fandroid-developer\u002Fanswer\u002F16935362",[110],"Help Center",[41,1497,1498,1501,1503,1506,1510],{},[62,1499,1500],{},"Location button (precise location)",[62,1502,1477],{},[62,1504,1505],{},"Precise-location declaration available November 2026",[62,1507,1508],{},[17,1509,854],{},[62,1511,1512,169,1515],{},[106,1513,1490],{"href":866,"rel":1514},[110],[106,1516,1495],{"href":1517,"rel":1518},"https:\u002F\u002Fsupport.google.com\u002Fgoogleplay\u002Fandroid-developer\u002Fanswer\u002F17033915",[110],[41,1520,1521,1524,1527,1530,1534],{},[62,1522,1523],{},"READ_CALL_LOG for phone verification",[62,1525,1526],{},"July 15, 2026 (per the table)",[62,1528,1529],{},"None listed",[62,1531,1532],{},[17,1533,854],{},[62,1535,1536,169,1539],{},[106,1537,1490],{"href":866,"rel":1538},[110],[106,1540,1495],{"href":1541,"rel":1542},"https:\u002F\u002Fsupport.google.com\u002Fgoogleplay\u002Fandroid-developer\u002Fanswer\u002F10208820",[110],[41,1544,1545,1548,1550,1552,1556],{},[62,1546,1547],{},"Geofencing as a foreground service use case",[62,1549,1477],{},[62,1551,1529],{},[62,1553,1554],{},[17,1555,854],{},[62,1557,1558,169,1561],{},[106,1559,1490],{"href":866,"rel":1560},[110],[106,1562,1495],{"href":1563,"rel":1564},"https:\u002F\u002Fsupport.google.com\u002Fgoogleplay\u002Fandroid-developer\u002Fanswer\u002F16965181",[110],[14,1566,1567],{},"The contacts article says compliance is mandatory on January 27, 2027 for apps that target Android 17 or later (API level 37+). The location article says compliance is mandatory for \"all apps\" on that date, but it requires the location button for apps that target Android 17 or later, and expects enforcement for those apps in late January 2027. Both say a self extension of 30 days will be available in Play Console, and that apps in scope are subject to enforcement after that date. The call log and geofencing pages state the effective date only, with no target API, so I can't say whether a lower target API protects you there.",[30,1569,1571],{"id":1570},"the-date-conflict","The date conflict",[14,1573,1574],{},"Two Google sources give two different dates, and I want to show both.",[14,1576,1577],{},"The policy deadlines table lists 2027-01-27 as the deadline for each of the four rows, with announcement dates of 2026-04-15 (and 2026-07-15 for READ_CALL_LOG). The Help Center articles repeat it: the contacts article says \"January 27, 2027: Policy compliance is mandatory for all apps that target Android 17 or later (API level 37+).\"",[14,1579,1580],{},"The June 2026 Play newsletter, under \"Policy deadlines and reminders\", says: \"Starting October 28, 2026: Contacts permissions: Developers must use the Android Contact Picker for apps that do not require broad contact access.\" It says the same date for the location button. It does not mention READ_CALL_LOG or geofencing.",[14,1582,1583],{},"What I could verify for each reading:",[121,1585,1586,1591,1597],{},[124,1587,1588,1590],{},[17,1589,854],{}," appears on the deadlines table and in four Help Center articles as the effective or mandatory date.",[124,1592,1593,1596],{},[17,1594,1595],{},"October 28, 2026"," appears on the newsletter page. It does not appear in the Help Center articles I read.",[124,1598,1599],{},"The April 2026 Android Developers Blog post says \"new pre-review checks in the Play Console will be available starting October 27\". That is one day off from October 28, and the post does not say the two are the same thing. It also says the contacts declaration form \"will be available before October.\"",[14,1601,1602],{},"My reading is that October 27 or 28 marks the start of Play Console checks and January 27, 2027 is the date compliance becomes mandatory. That is my inference. No page I found states it, so treat it as unconfirmed.",[14,1604,1605],{},"My advice: plan to be done before October 28, 2026 if you can, and use January 27, 2027 as the hard date. Open Play Console, check any prompt or pre-launch warning on your app, and follow what it says.",[30,1607,1609],{"id":1608},"_1-contacts-permissions-policy","1. Contacts Permissions policy",[14,1611,1612,1615],{},[17,1613,1614],{},"What changes."," The Help Center article says apps that target Android 17 or later \"may only request the READ_CONTACTS permission if the Android Contact Picker is not sufficient for your app to provide core functionality.\" Contacts are treated as personal and sensitive data under the User Data policy.",[14,1617,1618,1621],{},[17,1619,1620],{},"Who must act."," Any app that targets Android 17 (API level 37) or later and requests READ_CONTACTS. Google says private apps and enterprise device management apps are exempt. If your app asks for contacts to share or invite, the April 2026 Android Developers Blog says to switch to the picker and remove READ_CONTACTS.",[14,1623,1624,1627],{},[17,1625,1626],{},"The declaration."," If you keep the permission, you complete a declaration in Play Console that shows your access needs and why the Contact Picker is insufficient. The article says a custom picker \"does not qualify as a reason to retain Contacts access.\"",[14,1629,1630,1633,1634,1637],{},[17,1631,1632],{},"The catch."," The article states that the Android Contact Picker \"is not backported to previous versions and only exists for Android 17 or later (API level 37+).\" It is invoked with the ",[128,1635,1636],{},"Intent.ACTION_PICK_CONTACTS"," intent. If your app supports older Android versions, you need to decide what those users get.",[30,1639,1641],{"id":1640},"_2-the-location-button","2. The location button",[14,1643,1644,1646,1647,1650],{},[17,1645,1614],{}," Google's preview article says it is \"introducing the location button as the recommended minimum scope for precise location.\" For apps that target Android 17 or later, if precise location is needed only for one-time, user-initiated actions, you must implement the Android location button and declare it in the manifest with the ",[128,1648,1649],{},"onlyForLocationButton"," flag.",[14,1652,1653,1655],{},[17,1654,1620],{}," Any app that requests ACCESS_FINE_LOCATION. The minimum-scope article says all apps requesting precise location must complete a declaration in Play Console and explain why the location button or coarse location is insufficient. Apps that need precise, persistent access must show it is essential to core functionality.",[14,1657,1658,1661],{},[17,1659,1660],{},"Dates."," Announced April 15, 2026. The precise-location declaration becomes available in November 2026. Compliance is mandatory January 27, 2027.",[14,1663,1664],{},"My advice: list every place your app asks for precise location. For each, ask whether it is a one-time action the user starts, such as \"find stores near me\". Those are the ones the button is for.",[30,1666,1668],{"id":1667},"_3-read_call_log-and-phone-verification","3. READ_CALL_LOG and phone verification",[14,1670,1671,1673],{},[17,1672,1614],{}," The SMS and call log article says Google \"will no longer permit account verification via phone call as a use case for the READ_CALL_LOG permission\", effective January 27, 2027. The article already requires apps using these permission groups to be actively registered as the default SMS, Phone or Assistant handler.",[14,1675,1676,1678],{},[17,1677,1620],{}," Apps that read the call log to confirm a user's phone number, for example by matching an incoming verification call.",[14,1680,1681,1684],{},[17,1682,1683],{},"What to use instead."," The article recommends the Digital Credentials API to verify accounts without sensitive permissions, and mentions that the SMS Retriever API can do SMS-based verification automatically. If neither is an option, users can enter a verification code manually.",[30,1686,1688],{"id":1687},"_4-geofencing-as-a-foreground-service","4. Geofencing as a foreground service",[14,1690,1691,1693],{},[17,1692,1614],{}," The foreground service preview article says: \"We're removing geofencing as an approved foreground services use case.\" It adds that developers can instead use the Geofence API. Effective January 27, 2027.",[14,1695,1696,1698],{},[17,1697,1620],{}," Apps that run a location-type foreground service just to monitor geofences. The article still lists background location updates for user-initiated location sharing and navigation, so a service that does those is a separate question.",[14,1700,1701,1704,1705,1708,1709,1712,1713,1716,1717,1720],{},[17,1702,1703],{},"What the Geofence API needs."," Android's geofencing guide says your app must request ",[128,1706,1707],{},"ACCESS_FINE_LOCATION",", and ",[128,1710,1711],{},"ACCESS_BACKGROUND_LOCATION"," if it targets Android 10 (API level 29) or higher. You create a ",[128,1714,1715],{},"GeofencingClient"," through ",[128,1718,1719],{},"LocationServices",". Note that the geofencing guide's permissions are themselves sensitive and fall under Play's location rules above.",[30,1722,1724],{"id":1723},"the-flutter-angle","The Flutter angle",[14,1726,1727,1728,1731],{},"Flutter apps get these permissions from three places: your own ",[128,1729,1730],{},"AndroidManifest.xml",", plugin manifests, and the Play policy checks on the final build. Here is what I could verify on pub.dev.",[121,1733,1734,1752,1780,1791],{},[124,1735,1736,1739,1740,1743,1744,1747,1748,1751],{},[17,1737,1738],{},"permission_handler"," (13.0.2 when I read it) has ",[128,1741,1742],{},"Permission.contacts"," and a rationale check, ",[128,1745,1746],{},"Permission.contacts.shouldShowRequestRationale",", on Android. Its page also says that on Android 10 and later you request foreground location first, then call ",[128,1749,1750],{},"Permission.locationAlways.request()",". The page does not mention Android 17, the Contact Picker or the location button.",[124,1753,1754,1757,1758,173,1761,1764,1765,1768,1769,1772,1773,1775,1776,1779],{},[17,1755,1756],{},"flutter_contacts"," (2.6.0) tells you to add ",[128,1759,1760],{},"READ_CONTACTS",[128,1762,1763],{},"WRITE_CONTACTS"," to your manifest. Its ",[128,1766,1767],{},"FlutterContacts.native.showPicker()"," needs no contacts permission on either platform. The page says calling it with ",[128,1770,1771],{},"properties"," on Android requires ",[128,1774,1760],{},". The page does not mention Android 17, so I can't say whether ",[128,1777,1778],{},"showPicker()"," uses the new system picker on API 37.",[124,1781,1782,1785,1786,173,1788,1790],{},[17,1783,1784],{},"contacts_service"," (0.6.3) is listed as published 5 years ago. Its README says to add ",[128,1787,1760],{},[128,1789,1763],{}," and that it does not handle permission requests itself. I did not see a discontinued note on the page.",[124,1792,1793,1796,1797,1708,1800,1802,1803,1805,1806,1809],{},[17,1794,1795],{},"geolocator"," (14.1.1) tells you to add ",[128,1798,1799],{},"ACCESS_COARSE_LOCATION",[128,1801,1707],{}," only if you need precise location. For ",[128,1804,1711],{}," it says apps targeting Android 10 and later need it for updates in the background. It states that ",[128,1807,1808],{},"FOREGROUND_SERVICE_LOCATION"," is required from Android 14 for a location foreground service and that the plugin's manifest declares it.",[14,1811,1812],{},"None of those pages describe the new Play policy, so whether a given plugin version is compliant is something you need to test, not assume.",[1814,1815,1817],"h3",{"id":1816},"removing-a-permission-from-the-merged-manifest","Removing a permission from the merged manifest",[14,1819,1820,1821,1824,1825,1828,1829,1832],{},"Android's manifest documentation describes the ",[128,1822,1823],{},"tools:node=\"remove\""," marker as one that removes an element from the merged manifest, used \"when you discover an element in your merged manifest that you don't need that was provided by a lower-priority manifest file that's out of your control (such as an imported library).\" The page declares the namespace as ",[128,1826,1827],{},"xmlns:tools=\"http:\u002F\u002Fschemas.android.com\u002Ftools\""," on the ",[128,1830,1831],{},"\u003Cmanifest>"," element.",[14,1834,1835,1836,1839],{},"For a permission, the pattern in ",[128,1837,1838],{},"android\u002Fapp\u002Fsrc\u002Fmain\u002FAndroidManifest.xml"," looks like this:",[1841,1842,1847],"pre",{"className":1843,"code":1845,"language":1846},[1844],"language-text","\u003Cmanifest xmlns:android=\"http:\u002F\u002Fschemas.android.com\u002Fapk\u002Fres\u002Fandroid\"\n    xmlns:tools=\"http:\u002F\u002Fschemas.android.com\u002Ftools\">\n\n    \u003Cuses-permission\n        android:name=\"android.permission.READ_CALL_LOG\"\n        tools:node=\"remove\" \u002F>\n","text",[128,1848,1845],{"__ignoreMap":355},[14,1850,1851,1852,1855,1856,1859],{},"The Android page's own example removes a ",[128,1853,1854],{},"meta-data"," element, not a ",[128,1857,1858],{},"uses-permission"," line. Applying it to a permission follows from the general rule, but I have not run it against your build. Build a release, then read the merged manifest and confirm the line is gone.",[14,1861,1862],{},"One more caution. Removing a permission a plugin needs will break that plugin feature at runtime. Remove only what you have confirmed your app does not use.",[14,1864,1865],{},"My advice: for each of the four permissions, search your own manifest and your merged manifest, then work out which plugin adds it before you change anything.",[30,1867,280],{"id":279},[159,1869,1870,1876,1891,1897,1906,1912],{},[124,1871,1872,1875],{},[17,1873,1874],{},"Check Play Console."," Look for prompts about READ_CONTACTS and precise location on each app, and note the dates they show.",[124,1877,1878,1881,1882,169,1884,169,1886,173,1889,112],{},[17,1879,1880],{},"Find the permissions."," Read the merged manifest for ",[128,1883,1760],{},[128,1885,1707],{},[128,1887,1888],{},"READ_CALL_LOG",[128,1890,1808],{},[124,1892,1893,1896],{},[17,1894,1895],{},"Trace each to a feature."," Sharing or inviting: use the picker. One-time precise location: use the location button. Call-log verification: move to the Digital Credentials API or SMS Retriever. Geofence monitoring: move to the Geofence API.",[124,1898,1899,1902,1903,112],{},[17,1900,1901],{},"Decide your target API."," The contacts and location rules apply to apps that target Android 17 or later. For the target API deadline itself, see ",[106,1904,1905],{"href":552},"my Android 16 target API guide",[124,1907,1908,1911],{},[17,1909,1910],{},"File declarations"," only for permissions you truly keep, and write down the user-facing feature each one supports.",[124,1913,1914,1917],{},[17,1915,1916],{},"Test a release build"," on a real device, with a clean install, before you submit.",[14,1919,333,1920,112],{},[106,1921,337],{"href":336},[30,1923,341],{"id":340},[14,1925,1926,1927,349,1929,112],{},"If your Flutter app requests contacts, precise location, call log or geofencing permissions and you want it sorted before Google Play enforces the change, the ",[106,1928,348],{"href":347},[106,1930,353],{"href":352},{"title":355,"searchDepth":356,"depth":356,"links":1932},[1933,1934,1935,1936,1937,1938,1939,1943,1944],{"id":32,"depth":356,"text":33},{"id":1570,"depth":356,"text":1571},{"id":1608,"depth":356,"text":1609},{"id":1640,"depth":356,"text":1641},{"id":1667,"depth":356,"text":1668},{"id":1687,"depth":356,"text":1688},{"id":1723,"depth":356,"text":1724,"children":1940},[1941],{"id":1816,"depth":1942,"text":1817},3,{"id":279,"depth":356,"text":280},{"id":340,"depth":356,"text":341},"Google Play's sensitive-permission changes for Android apps: the Contacts Permissions policy, the location button, READ_CALL_LOG for phone verification and geofencing foreground services. The dates, who must act, and what it means for Flutter, checked October 19, 2026.",[1947,1950,1953,1956,1959],{"question":1948,"answer":1949},"When do the new Google Play contacts and location rules apply?","Google's Policy Deadlines table lists January 27, 2027 for the Contacts Permissions policy and the location button. The contacts Help Center article says compliance is mandatory for apps that target Android 17 or later on that date, with a 30-day automatic self extension in Play Console. The location article applies the location button to apps that target Android 17 or later. The June 2026 newsletter separately says \"Starting October 28, 2026\", and I found no page that explains the gap.",{"question":1951,"answer":1952},"Do I have to stop using READ_CONTACTS?","Not always. Google's policy says apps that target Android 17 or later may only request READ_CONTACTS if the Android Contact Picker is not sufficient to provide core functionality. If you keep it, you complete a declaration in Play Console that explains why the picker is not enough. A custom in-app contact picker does not count as a reason, according to the article.",{"question":1954,"answer":1955},"What replaces READ_CALL_LOG for phone number verification?","Google's article says it will no longer permit account verification via phone call as a use case for READ_CALL_LOG, effective January 27, 2027. It points to the Digital Credentials API, and mentions the SMS Retriever API for SMS-based verification.",{"question":1957,"answer":1958},"Is geofencing banned in Android apps?","No. Google is removing geofencing as an approved foreground services use case, effective January 27, 2027, and says developers can instead use the Geofence API. Android's geofencing guide describes the Geofence API through GeofencingClient.",{"question":1960,"answer":1961},"How do I remove a permission a Flutter plugin adds?","Add xmlns:tools=\"http:\u002F\u002Fschemas.android.com\u002Ftools\" to the manifest element of android\u002Fapp\u002Fsrc\u002Fmain\u002FAndroidManifest.xml, then add a uses-permission line for that permission with tools:node=\"remove\". Android's manifest documentation describes the marker as removing an element from the merged manifest that a lower-priority manifest, such as a library, provided. Its own example removes a meta-data element, so test the permission case on a release build. Then check the merged manifest to confirm it is gone.",{"readingTimeStats":1963},{"text":1964,"minutes":1965,"time":1966,"words":1967},"10 min read",9.115,546900,1823,"\u002Fblog\u002Fgoogle-play-contacts-permissions-policy-2027","google play contacts permissions policy","10 min",[401,1380,1972],"android-developer-verification-requirement-2026",{"title":1428,"description":1945},[1975,1977,1980,1983,1986,1989,1991,1993,1995,1997,2000,2003,2006,2009,2012],{"title":1976,"url":866},"Play Console Help, Policy Deadlines",{"title":1978,"url":1979},"Android Developers, Play Monthly newsletter, June 2026","https:\u002F\u002Fdeveloper.android.com\u002Fnewsletter\u002Fplay-monthly\u002F2026\u002Fcontent\u002Fjune",{"title":1981,"url":1982},"Android Developers Blog, updated Play policies (April 2026)","https:\u002F\u002Fandroid-developers.googleblog.com\u002F2026\u002F04\u002Fgiving-users-clearer-choice-and-everyone-a-safer-more-trusted-app-ecosystem.html",{"title":1984,"url":1985},"Play Console Help, Permissions and APIs that Access Sensitive Information","https:\u002F\u002Fsupport.google.com\u002Fgoogleplay\u002Fandroid-developer\u002Fanswer\u002F16558241",{"title":1987,"url":1988},"Play Console Help, Preview: Permissions and APIs that Access Sensitive Information","https:\u002F\u002Fsupport.google.com\u002Fgoogleplay\u002Fandroid-developer\u002Fanswer\u002F16909972",{"title":1990,"url":1493},"Play Console Help, Understanding Restricted Permissions with minimum scope alternatives",{"title":1992,"url":1517},"Play Console Help, Minimum Scope: Foreground Location Access and the Location Button",{"title":1994,"url":1541},"Play Console Help, Use of SMS or Call Log permission groups",{"title":1996,"url":1563},"Play Console Help, Preview: foreground service and full-screen intent requirements",{"title":1998,"url":1999},"Android Developers, Create and monitor geofences","https:\u002F\u002Fdeveloper.android.com\u002Fdevelop\u002Fsensors-and-location\u002Flocation\u002Fgeofencing",{"title":2001,"url":2002},"Android Developers, Merge multiple manifest files","https:\u002F\u002Fdeveloper.android.com\u002Fbuild\u002Fmanage-manifests",{"title":2004,"url":2005},"pub.dev, permission_handler","https:\u002F\u002Fpub.dev\u002Fpackages\u002Fpermission_handler",{"title":2007,"url":2008},"pub.dev, flutter_contacts","https:\u002F\u002Fpub.dev\u002Fpackages\u002Fflutter_contacts",{"title":2010,"url":2011},"pub.dev, contacts_service","https:\u002F\u002Fpub.dev\u002Fpackages\u002Fcontacts_service",{"title":2013,"url":2014},"pub.dev, geolocator","https:\u002F\u002Fpub.dev\u002Fpackages\u002Fgeolocator","blog\u002Fgoogle-play-contacts-permissions-policy-2027","google play contacts permissions policy, android contact picker, READ_CONTACTS google play, google play location button, onlyForLocationButton, READ_CALL_LOG google play, sms retriever api, geofencing foreground service google play, flutter permission_handler contacts, flutter tools:node remove permission, google play policy january 27 2027",[2018,2019,2020,2021,2022],"Google Play's policy deadlines table lists January 27, 2027 for all four changes: the Contacts Permissions policy, the location button, READ_CALL_LOG for phone verification, and geofencing as a foreground service use case. Google ties the contacts and location button rules to apps that target Android 17 (API level 37) or later; its call log and geofencing pages give no target API.","One Google source says something different. The June 2026 Play newsletter says \"Starting October 28, 2026\" for the contacts and location changes. I could not reconcile the two with a primary source, so I plan around January 27, 2027 and treat October 28 as an earlier date to watch.","Apps that target Android 17 (API level 37) or later may request READ_CONTACTS only if the Android Contact Picker is not sufficient for core functionality, and they must file a Play Console declaration.","The Contact Picker exists only on Android 17 or later (API level 37+) and is not backported, so an app that still supports older Android versions needs a plan for them.","In Flutter, the permissions usually enter your app through plugins. Check the merged manifest, and remove one you do not need with tools:node=\"remove\" on a uses-permission line in your own AndroidManifest.xml.","https:\u002F\u002Fapp369.com\u002Fblog\u002Fgoogle-play-contacts-permissions-policy-2027\u002F","eOmFpbw-YCW6fgOWP6XWYACYav4WLw2GRePECTKpAVE",{"id":2026,"title":2027,"author":2028,"body":2030,"category":365,"createdAt":2527,"description":2528,"disclosure":368,"extension":369,"faq":2529,"howTo":368,"lastVerified":368,"location":389,"meta":2548,"navigation":396,"ogImage":368,"path":2554,"primaryKeyword":2555,"readingTime":2556,"related":2557,"seo":2560,"sources":2561,"stem":2591,"tags":2592,"takeaways":2593,"updatedAt":2527,"url":2599,"__hash__":2600},"blog\u002Fblog\u002Fgoogle-sign-in-android-deprecated-credential-manager-2026.md","Google Sign-In for Android Is Deprecated: Moving to Credential Manager",{"name":7,"social":2029},{"twitter":9},{"type":11,"value":2031,"toc":2518},[2032,2053,2056,2060,2064,2151,2154,2158,2161,2195,2199,2208,2324,2328,2338,2405,2408,2412,2503,2505],[14,2033,2034,2037,2038,173,2041,2044,2045,2048,2049,2052],{},[17,2035,2036],{},"Google Sign-In for Android is deprecated, and Sign in with Google now runs through Credential Manager."," If your app still uses ",[128,2039,2040],{},"GoogleSignInClient",[128,2042,2043],{},"GoogleSignInOptions"," from ",[128,2046,2047],{},"play-services-auth",", or One Tap, move it to Credential Manager before Google removes the old code from the SDK. In a Flutter app the move is an upgrade to ",[128,2050,2051],{},"google_sign_in"," 7, which is a breaking release. Much of the work is in the code, and some of the bugs afterwards are in the setup.",[14,2054,2055],{},"If you landed here from an old link to Google's Android sign-in guide, that address now redirects to the Credential Manager overview. The dates and behavior below come from Android Developers, the Android Developers Blog and the Flutter plugin pages, as listed in the sources. I checked each page on October 18, 2026.",[14,2057,2058,1446],{},[17,2059,27],{},[30,2061,2063],{"id":2062},"what-changed-and-when","What changed, and when",[35,2065,2066,2078],{},[38,2067,2068],{},[41,2069,2070,2073,2076],{},[44,2071,2072],{},"When",[44,2074,2075],{},"What happened",[44,2077,472],{},[57,2079,2080,2094,2107,2120,2137],{},[41,2081,2082,2085,2088],{},[62,2083,2084],{},"September 11, 2024",[62,2086,2087],{},"Google announces that Credential Manager replaces its legacy Android sign-in APIs, and publishes a removal timeline",[62,2089,2090],{},[106,2091,1176],{"href":2092,"rel":2093},"https:\u002F\u002Fandroid-developers.googleblog.com\u002F2024\u002F09\u002Fstreamlining-android-authentication-credential-manager-replaces-legacy-apis.html",[110],[41,2095,2096,2099,2102],{},[62,2097,2098],{},"Q1 2025",[62,2100,2101],{},"Smart Lock for Passwords: listed as fully shut down",[62,2103,2104],{},[106,2105,1176],{"href":2092,"rel":2106},[110],[41,2108,2109,2112,2115],{},[62,2110,2111],{},"H1 2025",[62,2113,2114],{},"Credential Saving API and the Sign in with Google button API: listed for removal",[62,2116,2117],{},[106,2118,1176],{"href":2092,"rel":2119},[110],[41,2121,2122,2127,2132],{},[62,2123,2124],{},[17,2125,2126],{},"H2 2025",[62,2128,2129],{},[17,2130,2131],{},"One Tap and Google Sign-In for Android: listed for removal",[62,2133,2134],{},[106,2135,1176],{"href":2092,"rel":2136},[110],[41,2138,2139,2142,2145],{},[62,2140,2141],{},"Now",[62,2143,2144],{},"Google's migration page says legacy Google Sign-In is deprecated and will be removed from the Play services Auth SDK in a future release",[62,2146,2147],{},[106,2148,571],{"href":2149,"rel":2150},"https:\u002F\u002Fdeveloper.android.com\u002Fidentity\u002Fsign-in\u002Flegacy-gsi-migration",[110],[14,2152,2153],{},"The two sources don't give the same date. The 2024 post gave half-year targets; the migration page, last updated March 6, 2026, gives none. What both say is the same: the old APIs are on their way out, and new work belongs on Credential Manager.",[1814,2155,2157],{"id":2156},"what-the-old-addresses-do-today","What the old addresses do today",[14,2159,2160],{},"Checked on October 18, 2026:",[121,2162,2163,2173,2179,2189],{},[124,2164,2165,2168,2169,2172],{},[17,2166,2167],{},"developers.google.com\u002Fidentity\u002Fsign-in\u002Fandroid\u002Fstart-integrating",", the old setup guide, ",[17,2170,2171],{},"redirects"," to the Android Credential Manager overview.",[124,2174,2175,2178],{},[17,2176,2177],{},"developers.google.com\u002Fidentity\u002Fsign-in\u002Fandroid\u002Fsign-in"," redirects there too.",[124,2180,2181,2184,2185,2188],{},[17,2182,2183],{},"developers.google.com\u002Fidentity\u002Fsign-in\u002Fandroid\u002Flegacy-gsi-migration"," returned ",[17,2186,2187],{},"404",". The live migration page is on developer.android.com, linked in the sources.",[124,2190,2191,2194],{},[17,2192,2193],{},"developers.google.com\u002Fidentity\u002Fone-tap\u002Fandroid\u002Foverview"," redirects to a page that says One Tap for Android is deprecated.",[30,2196,2198],{"id":2197},"moving-a-native-android-app-to-credential-manager","Moving a native Android app to Credential Manager",[14,2200,2201,2202,2207],{},"The steps follow Google's ",[106,2203,2206],{"href":2204,"rel":2205},"https:\u002F\u002Fdeveloper.android.com\u002Fidentity\u002Fsign-in\u002Fcredential-manager-siwg-implementation",[110],"Sign in with Google implementation guide",":",[159,2209,2210,2232,2242,2263,2284,2290,2300,2313],{},[124,2211,2212,2215,2216,169,2219,173,2222,2225,2226,2231],{},[17,2213,2214],{},"Add the dependencies."," Add ",[128,2217,2218],{},"androidx.credentials:credentials",[128,2220,2221],{},"androidx.credentials:credentials-play-services-auth",[128,2223,2224],{},"com.google.android.libraries.identity.googleid:googleid",". Check the ",[106,2227,2230],{"href":2228,"rel":2229},"https:\u002F\u002Fdeveloper.android.com\u002Fjetpack\u002Fandroidx\u002Freleases\u002Fcredentials",[110],"androidx.credentials release page"," for the current stable version: on October 18, 2026 the newest stable release listed was 1.6.0, while Google's sample used a 1.7.0 alpha.",[124,2233,2234,2237,2238,2241],{},[17,2235,2236],{},"Use your web client ID."," Google's guide passes the ",[17,2239,2240],{},"Web"," client ID you set up for OAuth in your Google Cloud project as the server client ID, even in an Android app. The project also has to know your Android app: the Flutter plugin's docs list a wrong package name or a missing signing SHA as common causes of failed sign-in.",[124,2243,2244,2247,2248,2251,2252,2255,2256,2259,2260,112],{},[17,2245,2246],{},"Build the request."," For the bottom-sheet flow, use ",[128,2249,2250],{},"GetGoogleIdOption"," with your web client ID. Google's guide first sets ",[128,2253,2254],{},"setFilterByAuthorizedAccounts(true)"," to offer accounts that already signed in, with ",[128,2257,2258],{},"setAutoSelectEnabled(true)"," for returning users. For a \"Sign in with Google\" button, use ",[128,2261,2262],{},"GetSignInWithGoogleOption",[124,2264,2265,2268,2269,2272,2273,2276,2277,2280,2281,112],{},[17,2266,2267],{},"Call Credential Manager."," Create it with ",[128,2270,2271],{},"CredentialManager.create(context)"," and call ",[128,2274,2275],{},"getCredential"," with the request. When the result is a ",[128,2278,2279],{},"GoogleIdTokenCredential",", read it with ",[128,2282,2283],{},"GoogleIdTokenCredential.createFrom(credential.data)",[124,2285,2286,2289],{},[17,2287,2288],{},"Verify the ID token on your server."," Send the ID token to your backend and verify it there. If you use Firebase Authentication, use the Google ID token with Firebase Auth.",[124,2291,2292,2295,2296,2299],{},[17,2293,2294],{},"Move scopes to AuthorizationClient."," Google says sign-in and authorization are separate actions now. If your app reads Drive, Calendar or another Google API, request those scopes with the ",[128,2297,2298],{},"AuthorizationClient"," API when the user needs that feature, not at sign-in.",[124,2301,2302,2305,2306,2309,2310,112],{},[17,2303,2304],{},"Replace silent sign-in."," Google's migration page says to use a request with ",[128,2307,2308],{},"filterByAuthorizedAccounts"," set to true and auto-select on, in place of ",[128,2311,2312],{},"silentSignIn",[124,2314,2315,2318,2319,169,2321,2323],{},[17,2316,2317],{},"Remove the old code."," Once the new path works, remove ",[128,2320,2040],{},[128,2322,2043],{}," and any One Tap code, so an old error can't be mistaken for a new one.",[30,2325,2327],{"id":2326},"moving-a-flutter-app-to-google_sign_in-7","Moving a Flutter app to google_sign_in 7",[14,2329,2330,2331,2334,2335,2337],{},"On Android, ",[128,2332,2333],{},"google_sign_in_android"," 7.0.0 switched to Credential Manager. Its changelog says it removed the deprecated Google Sign In for Android SDK. ",[128,2336,2051],{}," 7.0.0 is a breaking release, and its changelog lists the main changes:",[121,2339,2340,2356,2370,2387],{},[124,2341,2342,2348,2349,2352,2353,112],{},[17,2343,2344,2347],{},[128,2345,2346],{},"GoogleSignIn"," is a singleton."," Use ",[128,2350,2351],{},"GoogleSignIn.instance"," instead of creating your own ",[128,2354,2355],{},"GoogleSignIn(...)",[124,2357,2358,2361,2362,2365,2366,2369],{},[17,2359,2360],{},"Initialize first."," Call and await ",[128,2363,2364],{},"initialize",", passing ",[128,2367,2368],{},"serverClientId"," where needed, before any other method.",[124,2371,2372,2378,2379,2382,2383,2386],{},[17,2373,2374,2375,112],{},"Sign-in is ",[128,2376,2377],{},"authenticate()"," Check ",[128,2380,2381],{},"supportsAuthenticate()"," first, because not every platform supports it. ",[128,2384,2385],{},"attemptLightweightAuthentication()"," covers returning users.",[124,2388,2389,2392,2393,2396,2397,2400,2401,2404],{},[17,2390,2391],{},"Authentication and authorization are separate."," Access tokens and server auth codes come from separate calls through the account's ",[128,2394,2395],{},"authorizationClient",", with ",[128,2398,2399],{},"authorizationForScopes"," to check and ",[128,2402,2403],{},"authorizeScopes"," to ask, from a user interaction.",[14,2406,2407],{},"Plan for the upgrade to touch every place your app signs in, reads the current user or asks for scopes. It isn't a version bump you can make in one line.",[30,2409,2411],{"id":2410},"when-sign-in-breaks-after-the-move","When sign-in breaks after the move",[35,2413,2414,2427],{},[38,2415,2416],{},[41,2417,2418,2421,2424],{},[44,2419,2420],{},"What you see",[44,2422,2423],{},"What it usually means",[44,2425,2426],{},"What to check",[57,2428,2429,2453,2464,2475,2489],{},[41,2430,2431,2434,2437],{},[62,2432,2433],{},"\"serverClientId must be provided on Android\"",[62,2435,2436],{},"The plugin can't find your web OAuth client",[62,2438,2439,2442,2443,2446,2447,2450,2451],{},[128,2440,2441],{},"google-services.json"," needs an ",[128,2444,2445],{},"oauth_client"," entry with ",[128,2448,2449],{},"client_type: 3",". If it's missing, add a web app to the project and download the file again, or pass the web client ID to ",[128,2452,2364],{},[41,2454,2455,2458,2461],{},[62,2456,2457],{},"Sign-in reports \"canceled\" when the user didn't cancel",[62,2459,2460],{},"Sometimes a configuration error",[62,2462,2463],{},"The plugin's docs say some configuration errors come back from Credential Manager as \"canceled\", and the plugin can't tell them from a real cancel. Check the client IDs, package name and SHA fingerprints",[41,2465,2466,2469,2472],{},[62,2467,2468],{},"Works in debug, fails in release or from Play",[62,2470,2471],{},"The release signing key's SHA isn't registered",[62,2473,2474],{},"Register the signing SHA for each build configuration that fails, including the Play App Signing key shown in Play Console if you use it",[41,2476,2477,2480,2483],{},[62,2478,2479],{},"Sign-in works, but API calls fail with no token",[62,2481,2482],{},"Authentication and authorization are separate steps now",[62,2484,2485,2486,2488],{},"Request them with AuthorizationClient (",[128,2487,2403],{}," in Flutter)",[41,2490,2491,2494,2497],{},[62,2492,2493],{},"Package name mismatch",[62,2495,2496],{},"The Android client in Google Cloud has a different package name",[62,2498,2499,2500],{},"Match the package name in Google Cloud or Firebase to ",[128,2501,2502],{},"applicationId",[30,2504,341],{"id":340},[14,2506,2507,2508,2510,2511,2515,2516,112],{},"If sign-in still fails after the move, or it works on your phone but not for your users, the ",[106,2509,348],{"href":347}," covers it in two fixed-price steps. A $450 Diagnosis gives you the root cause with evidence and a fixed repair quote within 3 business days, credited toward the fix. If you go ahead, the $1,200 Fix takes 5 business days. For a related Android change, see ",[106,2512,2514],{"href":2513},"\u002Fblog\u002Fsafetynet-shut-down-play-integrity-app-check-2026\u002F","SafetyNet is gone: moving to Play Integrity and App Check",", or ",[106,2517,353],{"href":352},{"title":355,"searchDepth":356,"depth":356,"links":2519},[2520,2523,2524,2525,2526],{"id":2062,"depth":356,"text":2063,"children":2521},[2522],{"id":2156,"depth":1942,"text":2157},{"id":2197,"depth":356,"text":2198},{"id":2326,"depth":356,"text":2327},{"id":2410,"depth":356,"text":2411},{"id":340,"depth":356,"text":341},"2026-10-18T11:00:00.000Z","Google deprecated Google Sign-In for Android, One Tap and Smart Lock for Passwords, and moved Sign in with Google into Credential Manager. What changed and when, how to migrate a native Android app, and how to move a Flutter app to google_sign_in 7, from Google's docs checked October 18, 2026.",[2530,2533,2536,2539,2542,2545],{"question":2531,"answer":2532},"Is Google Sign-In for Android deprecated?","Yes. Google's migration page says legacy Google Sign-In for Android is deprecated and will be removed from the Google Play services Auth SDK (play-services-auth). Google recommends Sign in with Google through Credential Manager instead.",{"question":2534,"answer":2535},"When will GoogleSignInClient stop working?","Google's September 2024 timeline put the removal of Google Sign-In for Android in the second half of 2025. Its current migration page, last updated March 6, 2026, says the API will be removed in a future release, without a date. Google says removal comes in a future release, so migrate now.",{"question":2537,"answer":2538},"What replaced Google One Tap and Smart Lock on Android?","Credential Manager. Google's One Tap page now says One Tap for Android is deprecated and to migrate to Credential Manager, and the Smart Lock for Passwords page says the same.",{"question":2540,"answer":2541},"How do I get an access token for Google APIs after the migration?","Request them in a separate step from sign-in. Credential Manager returns an ID token that proves who the user is. To call Google APIs such as Drive, request the scopes with the AuthorizationClient API, which Google says apps should keep using for authorization.",{"question":2543,"answer":2544},"Why does Flutter say \"serverClientId must be provided on Android\"?","The google_sign_in Android plugin needs your web OAuth client ID. The plugin's documentation says google-services.json should contain a web OAuth client (an oauth_client entry with client_type 3). If it doesn't, add a web app to the project and download the file again, or pass the web client ID as serverClientId when you call initialize.",{"question":2546,"answer":2547},"Why does Google sign-in work in debug but not in release?","A common cause is that the release build's signing SHA isn't registered in your Firebase or Google Cloud project. The plugin's documentation lists a missing or wrong SHA as a common cause of sign-in working in one build configuration but not another.",{"readingTimeStats":2549},{"text":2550,"minutes":2551,"time":2552,"words":2553},"5 min read",5.005,300300,1001,"\u002Fblog\u002Fgoogle-sign-in-android-deprecated-credential-manager-2026","google sign-in android deprecated","8 min",[2558,1382,2559],"safetynet-shut-down-play-integrity-app-check-2026","how-to-debug-a-flutter-firebase-bug-2026",{"title":2027,"description":2528},[2562,2564,2566,2569,2571,2574,2577,2579,2582,2585,2588],{"title":2563,"url":2092},"Android Developers Blog, \"Streamlining Android authentication: Credential Manager replaces legacy APIs\" (September 11, 2024)",{"title":2565,"url":2149},"Android Developers, about the migration from legacy Google Sign-In",{"title":2567,"url":2568},"Android Developers, about Sign in with Google","https:\u002F\u002Fdeveloper.android.com\u002Fidentity\u002Fsign-in\u002Fcredential-manager-siwg",{"title":2570,"url":2204},"Android Developers, implement Sign in with Google",{"title":2572,"url":2573},"Android Developers, about Credential Manager","https:\u002F\u002Fdeveloper.android.com\u002Fidentity\u002Fcredential-manager",{"title":2575,"url":2576},"Android Developers, One Tap for Android (deprecated)","https:\u002F\u002Fdeveloper.android.com\u002Fidentity\u002Flegacy\u002Fone-tap\u002F",{"title":2578,"url":2228},"Android Developers, androidx.credentials releases",{"title":2580,"url":2581},"Firebase, authenticate with Google on Android","https:\u002F\u002Ffirebase.google.com\u002Fdocs\u002Fauth\u002Fandroid\u002Fgoogle-signin",{"title":2583,"url":2584},"pub.dev, google_sign_in_android (Android setup and troubleshooting)","https:\u002F\u002Fpub.dev\u002Fpackages\u002Fgoogle_sign_in_android",{"title":2586,"url":2587},"pub.dev, google_sign_in changelog","https:\u002F\u002Fpub.dev\u002Fpackages\u002Fgoogle_sign_in\u002Fchangelog",{"title":2589,"url":2590},"pub.dev, google_sign_in_android changelog","https:\u002F\u002Fpub.dev\u002Fpackages\u002Fgoogle_sign_in_android\u002Fchangelog","blog\u002Fgoogle-sign-in-android-deprecated-credential-manager-2026","google sign-in android deprecated, googlesigninclient deprecated, credential manager migration, sign in with google android, one tap android deprecated, smart lock for passwords deprecated, play-services-auth migration, google_sign_in 7 migration, flutter google sign in android, serverClientId must be provided on Android",[2594,2595,2596,2597,2598],"Google deprecated the legacy Google Sign-In for Android API and says it will be removed from the Google Play services Auth SDK. Sign in with Google now runs through Credential Manager.","Google's September 11, 2024 timeline listed Smart Lock for Passwords as shut down in Q1 2025, and One Tap and Google Sign-In for Android for removal in the second half of 2025. Its current migration page still says the removal comes in a future release.","Sign-in and access to Google APIs are now separate steps. Credential Manager signs the user in; for scopes such as Google Drive, Google says to use the AuthorizationClient API.","In Flutter, google_sign_in 7.0.0 is a breaking release: GoogleSignIn is a singleton you must initialize first, and authentication and authorization are separate. On Android, google_sign_in_android 7.0.0 switched to Credential Manager.","Several failures after the move come from configuration, not code: a missing web OAuth client (serverClientId), or a missing SHA fingerprint for one build type. Some of these surface as a \"canceled\" error.","https:\u002F\u002Fapp369.com\u002Fblog\u002Fgoogle-sign-in-android-deprecated-credential-manager-2026\u002F","8pSzUx4K9oKqBaZtsSDzuiVeqr7Le04IouFOIJQw-M0",[2602,2604,2608,2612,2615],{"keyword":5,"url":428,"title":5,"relevance":2603},67,{"keyword":2605,"url":2606,"title":2605,"relevance":2607},"How to Debug a Flutter and Firebase Bug: Find the Root Cause (2026)","https:\u002F\u002Fapp369.com\u002Fblog\u002Fhow-to-debug-a-flutter-firebase-bug-2026\u002F",8,{"keyword":2609,"url":2610,"title":2609,"relevance":2611},"Firebase ML Model Hosting Shutting Down: How to Migrate","https:\u002F\u002Fapp369.com\u002Fblog\u002Ffirebase-ml-model-hosting-shutting-down-migrate-2027\u002F",7,{"keyword":2613,"url":2614,"title":2613,"relevance":2611},"Firebase Cloud Functions Min Instances: What They Cost (2026)","https:\u002F\u002Fapp369.com\u002Fblog\u002Ffirebase-cloud-functions-min-instances-cost-2026\u002F",{"keyword":2616,"url":2617,"title":2616,"relevance":2618},"Firebase Deprecations: Every Shutdown Date, 2024 to 2027","https:\u002F\u002Fapp369.com\u002Fblog\u002Ffirebase-deprecations-shutdown-dates-2026\u002F",6,1792438977118]