Installing an APK takes four taps, and the one that confuses people is a permission Android grants per app rather than per device. There is no master Unknown Sources switch any more. You allow one browser, or one file manager, to install apps, and that grant covers only that app.
This guide covers the current flow, where the setting actually lives, the specific reasons a modern Android version refuses an install, and the developer verification timeline that changes who is allowed to ship a sideloadable build at all.
What an APK is
APK stands for Android Package. It is the archive Android installs an app from, the same file the Play Store downloads behind the scenes. Installing one yourself is called sideloading, and it is a supported part of the platform rather than a workaround.
One thing an APK is not is an Android App Bundle. A .aab is an upload format for the Play Store and cannot be installed on a device. If a developer sent you one, ask for an APK. The difference is covered in testing Android App Bundles.
The permission model, and why the old instructions are wrong
Almost every guide older than a few years tells you to open Settings, Security, Unknown sources and flip one switch. That switch was removed in Android 8.0 in 2017.
Android says so directly. The Android 8.0 behaviour changes state that the Allow unknown sources system setting has been removed; in its place, the Install unknown apps permission manages unknown app installs from unknown sources
, and that the legacy INSTALL_NON_MARKET_APPS setting is now always 1
, so an app has to check canRequestPackageInstalls() instead of reading it (developer.android.com/about/versions/oreo/android-8.0-changes, checked on 2026-09-03).
The practical consequences are worth stating, because they are what people trip over:
- Granting the permission to Chrome does nothing for the Files app, or for Telegram, or for your email client. Each installer app is separate.
- The grant persists. You do it once per app, not once per APK.
- A phone with no permission granted anywhere is the normal state of a new device. Nothing is broken.
- The setting screen Android opens is specific to the app that asked. Android documents the model the same way: users must enable this setting for a particular source within the Install unknown apps system settings screen.
Install an APK, step by step
- Download the APK to the phone.
Open the download link in Chrome or another browser on the Android device itself. The file lands in the Downloads folder.
- Open the file.
Tap the download notification, or open the Files app and tap the .apk there. Android hands it to the package installer.
- Allow that one app to install unknown apps.
If this is the first install from that browser or file manager, Android says it is not allowed to install unknown apps from this source. Tap Settings and turn on Allow from this source. The permission applies only to the app you granted it to.
- Confirm the install.
Go back and tap Install. Google Play Protect may offer to scan the app first. Wait for the progress bar, then tap Open or Done.
To grant the permission ahead of time instead of mid-install, the path is Settings, Apps, Special app access, Install unknown apps. Pick the app you will install from, usually Chrome or Files, and turn on Allow from this source. Manufacturers rename the middle levels: Samsung, Xiaomi and others each word it slightly differently, which is why letting Android open the screen for you from the install prompt is the more reliable route.
Where the toggle is missing entirely
On a work phone the setting may not be there at all. Android automatically applies the DISALLOW_INSTALL_UNKNOWN_SOURCES restriction to managed profiles created on Android 8.0 and later, and an administrator can apply it to the whole device. If the option is greyed out or absent, it is policy rather than a fault, and the only fix is through whoever manages the device.
If you are the developer and your testers are on managed devices, sideloading is not the route. Turn on Managed Google Play in the app's Advanced settings and have the organisation's admin assign the testers to the track: a managed user cannot join a closed or internal test themselves (Play Console Help, "Set up an open, closed, or internal test", checked on 2026-09-03). For the ordinary unmanaged case, APK sharing against Play Store internal testing compares the two.
Restricted settings after a sideloaded install
Install an app this way and you may find you cannot grant it accessibility access or notification access: the toggle refuses and mentions a restricted setting. This is not a fault in the build. The Android Compatibility Definition Document requires a device to ask for separate confirmation before granting those two permissions, plus device admin, display over other apps and usage access, to any app it identifies as installed from a local file rather than an app store (Android CDD section 9.8, checked on 2026-09-03).
The app is installed and working. To lift the restriction, open its entry in Settings, Apps, use the overflow menu, and choose Allow restricted settings. Only do that for a build you actually trust, because the restriction exists precisely for the case where you do not.
Why an install fails
| What you see | Cause | Fix |
|---|---|---|
| App not installed, immediately | Truncated or corrupted download | Delete the file and download it again, ideally on Wi-Fi |
| App not installed, with an older copy present | Signature conflict: the new build is signed with a different key than the installed one | Uninstall the existing app first, accepting that its data is lost |
| App not installed, package appears invalid | On Android 14 and later, a build whose targetSdkVersion is below 23 is refused outright | Ask for a rebuild with a current target API level |
| Your device is not compatible with this version | The build sets a minimum Android version above what the phone runs, or targets an ABI the device lacks | Check the manifest values before installing |
| Play Protect blocks or warns about the app | An app Play Protect has not seen before, which every fresh beta build is: it is checked against Google's catalogue of known-harmful samples and by on-device machine learning, and Play Protect offers a code-level scan when it does not recognise the app | Continue only for a build from a developer you know; the warning is doing its job otherwise |
The Android 14 rule is worth spelling out because the message does not explain itself. Android documents it as a minimum installable target API level: apps with a targetSdkVersion lower than 23 cannot be installed, and the failure logs as INSTALL_FAILED_DEPRECATED_SDK_VERSION (Android 14 behaviour changes, checked on 2026-09-03). A developer testing a deliberately old build can bypass it with adb install --bypass-low-target-sdk-block, which is the documented escape hatch and needs a cable.
If none of the rows match, fixing "app not installed" on Android works through the rarer causes. To see what is actually inside the file, the APK inspector reads the package name, version code, and minimum and target API levels in your browser, which settles the compatibility arguments; for the certificate itself, the APK signature checker returns the subject, issuer and SHA-256 fingerprint.
Android developer verification, checked on 2026-09-03
The largest change to the sideloading model since Android 8.0 is not in the flow above, and its first deadline is close. Google publishes a timeline for developer verification: September 30, 2026 - Regional deadline in Brazil, Indonesia, Singapore, and Thailand for participating app stores.
The scope on that date is narrower than the headlines suggest. Google's wording: These protections begin for users installing apps from participating stores (Google Play, HONOR App Market, OPPO App Market, Galaxy Store, Palm Store, V-Appstore, GetApps) in Brazil, Indonesia, Singapore, and Thailand, on certified devices running Android 7+. In 2027, we'll expand this globally to all apps on certified devices.
So sideloading is not blocked outright in September 2026: the September date covers participating app stores in four countries, with all apps on certified devices following in 2027.
Two provisions matter for the people reading this page. Testers keep a route: Google says it will Preview our advanced flow to ensure power users can sideload apps from unverified developers.
And developers who are not shipping commercially have a lighter path: limited distribution accounts let students, teachers, and hobbyists
share apps with up to 20 devices without a government-issued ID or registration fee
. If you distribute builds to testers, register for verification or take a limited distribution account before the window for your region closes.
Before you install a file you did not build
An APK carries whatever code its author put in it, and the signing certificate is the only thing that ties a build to its developer. Two habits cover most of the risk:
- Prefer a link the developer sent you over a mirror site. A repackaged copy of a real app is indistinguishable by name and icon.
- Compare the signing certificate against a build you already trust before installing an update from anywhere else. The APK signature checker prints the subject, issuer and SHA-256 fingerprint to compare.
The safe Android sideloading guide covers how to vet a file properly.
If you are the one sending the build
Everything above is per tester, per device, every time. Asking a QA contractor or a client to find Special app access and reason about signing keys is the part of beta testing that loses days.
BetaDrop collapses it: upload the .apk and it returns an over-the-air install link and a QR code. Testers open it in the phone browser and hit the one permission prompt described above, in context, on the screen that already has the answer. Builds up to 500 MB are supported on the free plan. The full sharing workflow is in how to share Android APK files for testing.
Turn your APK file into an install link and send testers a link instead of instructions.
Frequently asked questions
Is it safe to install APK files?
It depends entirely on where the file came from. An APK from the developer who built it, or from a distribution link they sent you, is as safe as their build. A file from a random mirror site is unverifiable: it may be a repackaged copy signed with a key that does not belong to the developer. Check the signing certificate before you install anything you did not receive directly.
What does "unknown sources" mean on modern Android?
It means any installer other than a preinstalled first-party app store, which on most phones means anything other than Google Play and, on some, the manufacturer's own store. Since Android 8.0 there is no single device-wide switch for it. The permission is granted per app, so Chrome, Files and your messaging app each need their own toggle under Settings, Apps, Special app access, Install unknown apps. Android documents the legacy INSTALL_NON_MARKET_APPS setting as always reading 1 from 8.0 onward, which is why the old global toggle no longer exists to find.
Where is the Install unknown apps setting?
Settings, then Apps, then Special app access, then Install unknown apps, then pick the app you will install from and turn on Allow from this source. Manufacturers move the middle steps around, so the reliable route is to tap the APK and let Android offer you the exact screen for the app that is asking.
Can I install an APK without a computer or USB cable?
Yes. Download the file in the phone browser, tap it, allow that browser to install unknown apps, then tap Install. Nothing about the flow needs a desktop. Tools like BetaDrop turn a build into an over-the-air link and QR code so testers install straight from the phone browser.
Why do I get "App not installed" when I try to install an APK?
The four common causes are an incomplete download, a signature that differs from the copy already installed, a build whose minSdkVersion is higher than the Android version the phone runs, and on Android 14 or later a build whose targetSdkVersion is below 23, which the system refuses outright. Android documents minSdkVersion as the one that blocks: the system prevents the user from installing the application if the system API level is lower than that value, while targetSdkVersion leaves the app able to run on lower versions. Re-download the file, uninstall any earlier copy signed with a different key, and check the build minimum and target API levels.
Why can I not turn on accessibility or notification access for a sideloaded app?
That is Android restricted settings. After an install from outside an app store, Google restricts the settings that harmful apps most often ask for until you explicitly allow restricted settings for that app from its entry in Settings, Apps. It is a deliberate guard, not a failed install, and the app is already installed when you see it.
How big can an APK file be to install this way?
Android has no small fixed ceiling, so large games install fine from an APK as long as the device has room for the file and the unpacked app at the same time. If you are distributing a build through BetaDrop, uploads are capped at 500 MB per file on the free plan (1 GB on Studio), which covers the vast majority of debug and release APKs.
How do I update an app that was installed from an APK?
Install the newer APK over the top. It keeps the app data, provided it is signed with the same key and its version code is not lower than the installed one. A build signed with a different key will not update the existing app at all: Android treats it as a different app and refuses.
