Is your Android app ready for Zero-Tap sign-in?

Zero-Tap Sign-In is a feature that allows users to remain signed in to an app when moving from one Android device to another, without having to manually enter their credentials again.

Google's Restore Credentials API enables an app to securely restore a user's authenticated state when their data is transferred to a new device. For example, someone moving to a new phone could open their travel app and access their bookings without having to remember their password and sign in again.

The feature restores an existing signed-in state rather than removing authentication altogether. Users still need to register and authenticate when creating an account, and apps must continue to respect sign-outs and protect account access.

Google has confirmed that, from April 2027, apps distributed through Google Play that support user sign-in, whether login is compulsory or optional, must support Zero-Tap Sign-In restoration when users move from their previous Android device to a new one and choose to restore their data.

The requirement applies to both device-to-device transfers and cloud backups. Google has also confirmed that the Restore Credentials API is available on Android 9 and above, covering a broad range of Android devices.

The consequences of failing to meet the requirement are worth understanding. This isn't simply a recommendation for developers who want to offer a better user experience. It's an upcoming Google Play requirement, so businesses should assess how it applies to their app and plan any necessary changes ahead of the deadline.

There are some exceptions. Google currently excludes games from the requirement, with further guidance expected for gaming authentication use cases. Certain permanently private and enterprise device-management apps are also outside its scope. Apps with strict regulatory or compliance requirements, including some financial services and healthcare products, may be eligible to request an exemption through Google Play.

Google also recognises qualifying apps that were already using the Block Store API to restore sign-in states by 30 September 2026 as compliant with the requirement.

Implementation involves more than updating the login screen. Restore Credentials needs to work with the app's existing authentication system, backend and account-management processes. The work involved will depend on the product's architecture and how its current sign-in functionality is built.

Google recommends implementing Restore Credentials through Android's Credential Manager. Developers need to create a restore credential for authenticated users, make it available for transfer to a new device and use it to restore access when required.

The implementation documentation explains the technical steps. Restore Credentials can work alongside existing authentication methods, including passwords and Sign in with Google, so apps don't necessarily need to replace their current sign-in process.

The backend must validate restore credentials before granting access. Developers also need to ensure that credentials are removed when users sign out or their access is revoked, and account permissions continue to work as intended.

Google's implementation guidance notes that apps already using passkeys may be able to reuse their existing server-side authentication infrastructure. This makes the deadline a useful opportunity to review the wider authentication setup, rather than treating credential restoration as an isolated task.

Before release, developers should test account restoration across devices, including cases where credentials are unavailable, sessions have expired or access has been revoked. They should also check that relevant app data and preferences transfer as expected, as restoring a user's identity doesn't automatically restore every part of their app experience.

Google's Restore Credentials testing guide explains how to test the process using Android devices and emulators.

Android's Zero-Tap Sign-In requirement focuses on restoring access when users move to a new device, but it also presents an opportunity to review how people authenticate in your app more broadly.

Traditional passwords remain common, but they can create friction for users and additional work for support teams when people forget their credentials or struggle to regain access. Passwordless options, including passkeys, offer another approach by allowing users to authenticate using methods such as their device's biometrics or screen lock.

Passkeys can also provide stronger protection against phishing than traditional passwords when implemented correctly. They won't be the right choice for every product or every sign-in scenario, but they're worth considering as part of a wider authentication strategy.

There is a useful connection here with Restore Credentials, too. Google's implementation guidance explains that apps using passkeys may be able to reuse their existing server-side authentication infrastructure for credential restoration. The two features serve different purposes, but reviewing them together could help businesses make more informed decisions about their authentication setup.

We've explored this in more detail in our article How can Passkeys improve in-app user security for Android and iOS?, including how passkeys work and what they could mean for app security.

At The Distance, we help businesses understand how platform changes affect their apps and plan the technical work needed to respond. For Zero-Tap Sign-In, that starts with reviewing the existing authentication system, identifying any changes required across the app and backend, and planning implementation and testing ahead of the deadline.

It's also an opportunity to look at the wider product. Whether you're maintaining an established app or planning a new one, we can help you assess your authentication options, including passkeys and passwordless sign-in, and make decisions that suit your users, security requirements and long-term roadmap.

April 2027 may feel a long way off, but reviewing your authentication system now gives you more time to understand the work involved and plan it alongside other development priorities.

If you're unsure whether your Android app is ready, The Distance can help you review your current setup, assess your options and plan the next steps.