Manifest cheat sheet

The manifest is the contract between your app and the package manager. Everything in it is read at install time, before any of your code runs.

TL;DR#

<manifest> holds the package name, version and the <application> block.
The four component types are declared as <activity>, <service>, <receiver>, <provider>.
android:exported is mandatory on any component with an intent filter when targeting API 31.
<uses-permission> requests; <uses-feature> describes hardware requirements.
targetSdkVersion opts you into behaviour changes; minSdkVersion gates installation.

Mental model#

The manifest is a form you fill in before entering a building: who you are, what you need access to, which doors you want keys for, and what equipment you will bring. The building reads it once, at the door, and remembers.

Where the analogy breaks#

Unlike a form, the manifest is compiled to binary XML and can be partly overlaid at build time by manifest merging from libraries, which is why the merged manifest is often longer than the one you wrote.

The big picture#

Loading diagram…

Text description of this diagram

The Android stack with the manifest boundary marked. The manifest is consumed by the package manager inside system_server, which is why it governs installation, component resolution and permission grants rather than runtime behaviour directly.

Deep dive#

Skeleton#

<manifest xmlns:android="http://schemas.android.com/apk/res/android"
    package="com.example.app">
 
    <uses-sdk android:minSdkVersion="23" android:targetSdkVersion="36" />
 
    <uses-permission android:name="android.permission.INTERNET" />
    <uses-permission android:name="android.permission.POST_NOTIFICATIONS" />
 
    <uses-feature android:name="android.hardware.camera.any" android:required="false" />
 
    <queries>
        <intent>
            <action android:name="android.intent.action.VIEW" />
            <data android:scheme="https" />
        </intent>
    </queries>
 
    <application
        android:label="@string/app_name"
        android:icon="@mipmap/ic_launcher"
        android:theme="@style/Theme.App"
        android:allowBackup="true"
        android:supportsRtl="true">
 
        <activity
            android:name=".MainActivity"
            android:exported="true">
            <intent-filter>
                <action android:name="android.intent.action.MAIN" />
                <category android:name="android.intent.category.LAUNCHER" />
            </intent-filter>
        </activity>
 
        <service android:name=".SyncService" android:exported="false" />
 
        <receiver android:name=".BootReceiver" android:exported="false">
            <intent-filter>
                <action android:name="android.intent.action.BOOT_COMPLETED" />
            </intent-filter>
        </receiver>
 
        <provider
            android:name="androidx.core.content.FileProvider"
            android:authorities="${applicationId}.fileprovider"
            android:exported="false"
            android:grantUriPermissions="true" />
    </application>
</manifest>

The attributes that change behaviour#

Attribute	Effect
`android:exported`	whether other apps may start the component; mandatory with an intent filter from API 31
`android:launchMode`	how the activity is placed in a task
`android:process`	run the component in another process
`android:configChanges`	handle these changes yourself instead of being recreated
`android:directBootAware`	may run before the user unlocks the device
`android:foregroundServiceType`	required from API 34, with matching permissions
`android:allowBackup`	whether the system may back up app data
`android:usesCleartextTraffic`	whether plain HTTP is permitted (default false when targeting 28+)
`android:networkSecurityConfig`	per-domain TLS and cleartext rules
`android:enableOnBackInvokedCallback`	opt into predictive back

How it evolved#

2008 →Single manifestEverything declared by hand.API 1

2013 →Manifest mergingLibraries contribute entries; conflicts must be resolved.API 18

2020 →QueriesPackage visibility requires declaring what you look for.API 30

2021 →Explicit exportedEvery filtered component must state exported.API 31

2023 →FGS typesEvery foreground service must declare a type.API 34

Curiosity corner#

package in the manifest is legacy; the build overrides it with applicationId, which is what identifies the app in the store.
<queries> is not a permission request, but without it your getInstalledPackages returns a filtered list.

Why does the build compile resources before dexing?Because resources and code are separate inputs: AAPT2 produces the compiled resource table and the R class, then the compiler uses…Open card →Why do Android icons have two layers?Adaptive icons separate a foreground and a background so launchers can mask them into different shapes without the developer drawi…Open card →

Try it#

Read the merged manifest on a device

$ adb shell dumpsys package com.example | head -60
adb shell cmd package dump com.example | grep -A20 "declared permissions"