Every APK is signed with a cryptographic key before Android will install it, and an update installs only if it is signed with the same key as the version already on the phone. Free builds here are signed with a key the service manages; Pro lets you supply your own so the app stays updatable from anywhere, including Google Play. Installing an APK outside the store means enabling installs from that source once and dismissing a warning that is about the source, not the app. Sharing is then a matter of getting the file to the phone: a download link, a QR code, a message, or USB.
What the signature does
Two things. It proves the APK has not been altered since it was signed — a modified byte breaks the signature and Android refuses it. And it identifies the publisher: two APKs with the same package name and the same signature are versions of one app; with different signatures they are, to Android, impostors of each other, and the second will not install over the first. That second property is why the key matters for the app's whole life: whoever holds it can update the app, and nobody else can.
On the free tier the key is managed for you and reused for your projects, so updates you build here install over each other. If you will publish on Google Play and want to build releases elsewhere later, generate your own key and upload it on Pro.
Installing on a phone
- Get the file onto the phone. Download it in the phone's browser from the builder, or send it to yourself by email, chat or Drive, or copy it by USB.
- Open it. Tap the download notification or find it in Files → Downloads.
- Allow the source, once. Android 8 and later ask per app: "Chrome is not allowed to install unknown apps" → Settings → toggle on. This is a per-source setting; you will not be asked again for that browser.
- Install. The app appears in the drawer and on the home screen.
The warnings, decoded
| Message | What it means | What to do |
|---|---|---|
| "For your security, your phone is not allowed to install unknown apps from this source" | Sideloading from this app is off. It says nothing about your APK. | Settings → allow from this source. |
| Play Protect: "Unsafe app blocked" / "App scan recommended" | Google has not seen this APK before. Common for any new, unpublished app. | "Install anyway" (may be under More details). Publishing on Play, or wide distribution, makes it go away. |
| "App not installed" | Nearly always a signature or version conflict with an installed copy of the same package name. | Uninstall the old version first, or rebuild with a higher version code and the same key. |
| "There was a problem parsing the package" | Corrupt or incomplete download, or an APK for a newer Android than the phone runs. | Re-download; check the phone is on Android 7+. |
Sharing with a group
- A download link. Put the APK on any file host — Google Drive (set to anyone with the link), Dropbox, your own site, GitHub Releases — and share the URL. On the phone the link downloads and the steps above apply.
- A QR code pointing at that link, for a classroom, a poster or a meeting. Any QR generator will do.
- Direct share. The builder's companion Android app can share an APK to WhatsApp, Nearby Share or any app on the phone; so can the Files app once it is downloaded.
- A private listing. Google Play's internal testing track (up to 100 testers by email) and closed testing give store-quality distribution without a public listing. Needs Pro for the AAB.
Tell recipients three things: the file is an app, they will need to allow installs from the browser once, and Play Protect may warn because the app is new. That sentence prevents most support messages.
Distribution outside Google Play, longer term
Sideloading is legitimate and permanent — Android has always allowed it — and is the right route for internal tools, classroom apps, client demos and anything that should not be public. The costs are that users must repeat the download for each update (no automatic updates), and that Play Protect's unfamiliarity warning persists until the app has been seen widely. For anything meant for the public, the store's automatic updates and trust signals are worth the listing work; the Play checklist covers it.