APK Referer Injection Without Re-Signing
Channel links are only useful when the installed app can read the channel that sent the user. For APKs distributed outside Google Play, that usually means attaching a value to the download itself.
referer is a query parameter used by APK Ref Injector. It is not the HTTP Referer header.
The re-signing problem
Section titled “The re-signing problem”The common workaround is to build a separate APK for every channel, or to modify and re-sign one APK after the download request. Both approaches create operational risk:
- every channel needs another build and another signature;
- a new signing key can break upgrades for existing users;
- re-signing adds a release step that must be repeated for every campaign;
- the original signature is no longer the one users installed.
For teams that distribute through their own website, CDN, enterprise channel, or partner, that overhead grows quickly.
What server-side injection changes
Section titled “What server-side injection changes”APK Ref Injector keeps one signed base APK. When a user requests a download, the service attaches the requested channel value to the download response without re-signing the APK.
The app still receives the same APK package and the same V2/V3 signature. The channel value travels with the download and can be read by the app after installation.
This gives you:
- one base APK per app instead of one per channel;
- the same signature before and after the download;
- channel links that can be created and changed without a new release;
- a self-hosted service that you control.
When this approach fits
Section titled “When this approach fits”Server-side injection is a good fit when:
- users download APKs from your own domain, a partner site, or an enterprise distribution page;
- you need channel or campaign attribution outside Google Play;
- you cannot or do not want to re-sign the APK;
- you want one signed artifact and many download links.
It is not a replacement for Google Play Install Referrer when your app is installed from Google Play. The two mechanisms solve different distribution problems.
Verify the result
Section titled “Verify the result”After downloading through a tagged link, compare the APK signature with the original:
apksigner verify --verbose downloaded.apkThe V2/V3 signature should remain valid. If your app reads the value at runtime, test the complete flow with a real download link rather than a local file.