Skip to content
Tech News
← Back to articles

Goodbye, OTPs and magic links: Signing up for new Android apps just got a lot easier

read original get Android App Sign-In Kit → more articles
Why This Matters

Google's updated Credential Manager API introduces Verified Email, streamlining app sign-up and authentication on Android by eliminating the need for magic links and OTPs. This enhancement offers a more seamless user experience and improved security for consumer Google accounts, with potential uses in account recovery and re-authentication. However, it currently applies only to consumer accounts, with additional verification recommended for non-Google email addresses.

Key Takeaways

Signing up for new Android apps via email is a familiar task for many people. These apps typically send a magic link or one-time PIN (OTP) to your email address to ensure it’s actually your address. But Google has now made things even more seamless on Android with Verified Email.

Google just updated Android’s Credential Manager API with a Verified Email feature. In short, this means you can sign up for an app without switching to your email app to retrieve a magic link or OTP. In fact, you don’t have to deal with a magic link or OTP at all. Instead, Google says the app refers to the new “cryptographically verified email credential” which is sourced from your Google account and stored on your device. App developers can also subsequently prompt users to create a passkey following this new signup process.

In addition to enabling more convenient app signups, Google says the Verified Email feature can also be used for account recovery and re-authentication for sensitive actions (e.g., changing key settings). So this should be handy for your current apps too.

There are a couple of caveats with Verified Email, though. For one, this is currently restricted to consumer Google accounts. That means you’ll need to stick with the legacy email verification methods for now if you have a Workspace or managed account.

What about Google accounts that are created with non-Google email accounts? The company issued an explanation:

Google is not the authoritative source for these email addresses in the long term. While Google verifies the email when the account is created, the ownership of that email address might change over time. Therefore, for [email protected] addresses, you [app developers – ed] should consider an additional verification step, such as sending an OTP, to ensure that the user still has access to the email account.

The good news is that you don’t need the latest Android phone or tablet to get this functionality. Google notes that the feature supports devices running Android 9 or newer, as well as Google Play Services 25.49.xx or newer. So even your five-year-old phone should get this option.