Copy and re-sign overhead
Every new channel means another copy, signature and upload. More packages, longer pipelines, more storage.
SELF-HOSTED APK REFERER INJECTION
APK channel parameters.
Without re-signing.
Attach a channel parameter to APK downloads without re-signing, decompiling, or changing the original APK. One deployment gives you the Console, download statistics, offline licensing, and an Android AAR SDK.
$ curl -I "https://apk.example.com/d/demo/base.apk?referer=channel-a"
200 OK content-length: 4821930
x-signature-preserved: true
// APK metadata
channel-marker = "channel-a"
package contents unchanged
ZIP entriesunchanged
Channel marker+ referer
Original signaturepreserved
Package metadataunchanged
Original signature stays validNo re-signing or APK edits
Zero re-signingNo decompiling or Manifest edits
One executableConsole and download service together
Streaming downloadsLarge APKs return reliably
WHY IT EXISTS
Channel packages should not cost a re-signature.
The usual approach copies and re-signs an APK for every channel. APK Ref Injector attaches the channel value to the download so one base APK serves every source.
Signature and identity risk
Re-signing changes the certificate and install identity. When scripts fail, it is hard to tell which package is wrong.
Attribution gap
The channel value stops at the download link. The installed app cannot read it, so attribution becomes indirect.
REQUEST PATH
One download. Four steps.
From download request to APK response, the original package stays untouched.
01
Receive request
Read the channel parameter from the download URL.
02
Inject safely
Attach the channel marker during the download response.
03
Keep the package intact
No re-signing and no APK content changes.
04
Stream response
Return the marked APK without buffering the whole file.
CORE CAPABILITIES
One self-hosted stack from injection to operations.
Every component lives in one binary and one operational boundary.
Injection core
Strict APK structure and signature validation; unsupported packages are rejected explicitly.
Console
Upload base APKs, manage apps, copy download links, and inspect statistics.
Download stats
Aggregate by channel, time, and status without slowing downloads.
Offline licensing
Validate licenses offline; renewal only needs a new license file.
Lifecycle CLI
install / start / stop / status / license update / uninstall.
Auditable delivery
One executable, systemd unit, config sample, and license.zip.
OPERATIONS
One machine. One binary.
Production runs on systemd. Data stays on your machine, with clear upgrade and renewal paths.
- One-file deployment — No external runtime dependencies.
- Proxy friendly — Nginx or Caddy terminates TLS and forwards the original host and scheme.
- Data stays local — Database, uploaded APKs, and icons live in the local data directory.
- No Docker — No containers, orchestration, or external database required.
terminalsystemd
sudo ./apk-ref-injector install \ --license /path/to/license.zip \ --public-url https://apk.example.com sudo apk-ref-injector status sudo systemctl restart apk-ref-injector
ANDROID SDK
Let the app read its own channel value.
The AAR packages the reader behind one synchronous Kotlin API. Customers do not integrate parsing logic and do not need storage permission.
- Coordinates — lib.apkreferer:reader:1.0.0
- Device support — Mainstream ARM and x86_64 devices
- Result states — Found / NotFound / Error
- Read scope — Only the current app APK
Kotlinlib.apkreferer.reader
val result = RefererReader.read(context)
when (result) {
is RefererResult.Found -> use(result.referer)
RefererResult.NotFound -> { /* no channel value */ }
is RefererResult.Error -> handle(result.code)
}SECURITY & LIMITS
Clear boundaries. Predictable failures.
No guessing at uncertain APK structures, no sensitive values in logs, and no trust in the channel value itself.
Does it re-sign the APK?
No. The channel marker is attached during the download response; the original signature and APK content stay unchanged.
What happens with unsupported APKs?
They are rejected explicitly. Only structurally valid APKs with a supported signature format are accepted; the server never guesses.
Is the referer logged?
Full values are not logged. Stats aggregate by the original value; logs keep only the context they need. License contents, passwords, and session secrets are never logged.
Is Docker required?
No, and there is no container delivery. You get the executable, systemd unit, config sample, and license.zip.
Carry the channel value beyond install.
Tell us about your app scale, deployment environment and current channel pipeline. We will prepare a focused demo and deployment recommendation.
This opens your default mail client. The v1 site does not collect form data online.