AndroidManifest

The AndroidManifest.xml

Every Android app must have an AndroidManifest.xml in the root directory. It declares:

• App components (Activity, Service, Receiver, Provider)
• Permissions the app needs
• Minimum and target SDK versions
• Hardware/software features required
• Application metadata

Component Declarations

<?xml version="1.0" encoding="utf-8"?>
<manifest xmlns:android="http://schemas.android.com/apk/res/android"
    xmlns:tools="http://schemas.android.com/tools">

    <uses-permission android:name="android.permission.INTERNET" />
    <uses-permission android:name="android.permission.CAMERA" />
    <uses-permission android:name="android.permission.READ_EXTERNAL_STORAGE"
        android:maxSdkVersion="32" />

    <uses-feature android:name="android.hardware.camera" android:required="false" />

    <application
        android:name=".MyApplication"
        android:allowBackup="true"
        android:dataExtractionRules="@xml/data_extraction_rules"
        android:fullBackupContent="@xml/backup_rules"
        android:icon="@mipmap/ic_launcher"
        android:label="@string/app_name"
        android:roundIcon="@mipmap/ic_launcher_round"
        android:supportsRtl="true"
        android:theme="@style/Theme.MyApp">

        <activity
            android:name=".ui.MainActivity"
            android:exported="true"
            android:theme="@style/Theme.MyApp">
            <intent-filter>
                <action android:name="android.intent.action.MAIN" />
                <category android:name="android.intent.category.LAUNCHER" />
            </intent-filter>
        </activity>

        <activity
            android:name=".ui.WebActivity"
            android:exported="false" />

        <service
            android:name=".service.SyncService"
            android:exported="false"
            android:foregroundServiceType="dataSync" />

        <receiver
            android:name=".receiver.DownloadReceiver"
            android:exported="false">
            <intent-filter>
                <action android:name="com.example.DOWNLOAD_COMPLETE" />
            </intent-filter>
        </receiver>

        <provider
            android:name=".data.FileProvider"
            android:authorities="${applicationId}.fileprovider"
            android:exported="false"
            android:grantUriPermissions="true">
            <meta-data
                android:name="android.support.FILE_PROVIDER_PATHS"
                android:resource="@xml/file_paths" />
        </provider>
    </application>
</manifest>

Exported Components

Since Android 12 (API 31), any component with an intent filter must explicitly declare android:exported. Components without intent filters default to exported="false".

• exported="true": Accessible by other apps (launcher activity, deep link handler, content provider)
• exported="false": Private to your app only

Application Tag Attributes

Android Permissions

Android uses a permission model to protect user privacy. Permissions are categorized by risk level.

Permission Categories

Declaring Permissions

<!-- In manifest -->
<uses-permission android:name="android.permission.INTERNET" />
<uses-permission android:name="android.permission.CAMERA" />
<uses-permission android:name="android.permission.ACCESS_FINE_LOCATION" />
<uses-permission android:name="android.permission.ACCESS_COARSE_LOCATION" />
<uses-permission android:name="android.permission.READ_MEDIA_IMAGES" />

Requesting Runtime Permissions

Dangerous permissions must be requested at runtime:

class CameraActivity : AppCompatActivity() {
    private val requestPermission = registerForActivityResult(
        ActivityResultContracts.RequestPermission()
    ) { granted ->
        if (granted) {
            openCamera()
        } else {
            showPermissionRationale()
        }
    }

    override fun onCreate(savedInstanceState: Bundle?) {
        super.onCreate(savedInstanceState)
        setContentView(R.layout.activity_camera)

        findViewById<Button>(R.id.btnCamera).setOnClickListener {
            when {
                ContextCompat.checkSelfPermission(this, Manifest.permission.CAMERA)
                    == PackageManager.PERMISSION_GRANTED -> {
                    openCamera()
                }
                shouldShowRequestPermissionRationale(Manifest.permission.CAMERA) -> {
                    showPermissionRationale()
                }
                else -> {
                    requestPermission.launch(Manifest.permission.CAMERA)
                }
            }
        }
    }
}

Permission Groups

Related permissions are grouped. If one permission in a group is granted, related ones may be auto-granted:

• CONTACTS: READ_CONTACTS, WRITE_CONTACTS, GET_ACCOUNTS
• LOCATION: ACCESS_FINE_LOCATION, ACCESS_COARSE_LOCATION
• CAMERA: CAMERA
• STORAGE: READ_MEDIA_IMAGES, READ_MEDIA_VIDEO, READ_MEDIA_AUDIO

Multi-Permission Requests

val requestMultiplePermissions = registerForActivityResult(
    ActivityResultContracts.RequestMultiplePermissions()
) { permissions ->
    val cameraGranted = permissions[Manifest.permission.CAMERA] ?: false
    val locationGranted = permissions[Manifest.permission.ACCESS_FINE_LOCATION] ?: false
    if (cameraGranted && locationGranted) {
        startFeature()
    }
}

requestMultiplePermissions.launch(arrayOf(
    Manifest.permission.CAMERA,
    Manifest.permission.ACCESS_FINE_LOCATION
))

Declaring Custom Permissions

Apps can define their own permissions:

<permission
    android:name="com.example.MY_PERMISSION"
    android:protectionLevel="normal"
    android:label="Custom Permission"
    android:description="Required to access custom features" />

Use protectionLevel carefully — dangerous forces other apps to request it at runtime.