APK MIME Type – Free, Online, Private

What .apk is

An APK is a ZIP archive of an Android application: a manifest, compiled resources, and DEX bytecode. It starts with PK. Signing data lives in META-INF. The type Android documents, and the type Apache and nginx map to .apk, is application/vnd.android.package-archive. The current IANA application registry lists application/vnd.android.ota for an OTA package and does not list the APK type. Send the package-archive type anyway. A phone that is handed application/zip may try to unpack the file or may refuse to install it. application/vnd.android.ota is a different payload. Do not substitute it.

Android and static servers use application/vnd.android.package-archive for an APK. The current IANA application list shows application/vnd.android.ota and does not list this package type. The media type is application/vnd.android.package-archive. Extensions that use it on this page: .apk. A client compares the type, not the filename, once the response has arrived. The filename still matters on disk and in Content-Disposition, which is why a wrong extension and a wrong header are two different bugs.

What sends application/vnd.android.package-archive

What sends application/vnd.android.package-archive: Send application/vnd.android.package-archive for a .apk download, with a filename ending in .apk. Serve it over HTTPS. A phone will warn about install sources regardless of the type, and a wrong type can stop the install before that warning. Do not add a charset. Do not gzip the APK and forget Content-Encoding. The ZIP is already compressed. If you offer an Android App Bundle, that file is .aab and is not this type. Do not rename an AAB to .apk. The file on disk is still .apk. Once the response exists, a client trusts application/vnd.android.package-archive, not the filename. If you distribute both a Play Store link and a sideload APK, the store link is an HTML page, text/html. The sideload file is this type. Do not point the store button at the APK URL or the APK button at the store. The types make that mistake obvious in a log.

Content-Type for .apk

Send application/vnd.android.package-archive and do not add a charset parameter. The body is binary. A charset tells a text decoder to reinterpret bytes that are not text, which corrupts a download and does not help a browser sniff the format.

Content-TypeContent-Type: application/vnd.android.package-archive

nginx, Apache, and Express

These snippets map .apk to application/vnd.android.package-archive. nginx reads the types block when it picks a type from the URL's extension. A location that sets default_type, or an application that sets the header itself, overrides that map. Apache AddType applies in the directory context where you put it. The Express static example writes the header for files ending in .apk so a stale mime database in the framework cannot disagree with the type on this page.

nginx# /etc/nginx/mime.types, inside the types { } block
application/vnd.android.package-archive  apk;

ApacheAddType application/vnd.android.package-archive .apk

Expressimport express from "express";

const app = express();
app.use(express.static("public", {
  setHeaders(res, filePath) {
    if (filePath.endsWith(".apk")) {
      res.setHeader("Content-Type", "application/vnd.android.package-archive");
    }
  },
}));

Pitfalls for application/vnd.android.package-archive

Pitfalls that show up for application/vnd.android.package-archive, and not for a neighboring type with a similar extension: A CDN that sniffs PK and rewrites the type to application/zip breaks install intents that match the package-archive type. Disable that rewrite. A second bug is an HTML 'download' page with a 200 and text/html on the APK URL, which saves a document the package manager cannot open. The URL that serves bytes has to be the APK. A third is a truncated upload that is a valid ZIP prefix and an invalid package. Verify the signing block if you claim the artifact is releasable. A fourth is caching one version forever under a URL you reuse for every release. Put the version in the path.

• application/vnd.android.package-archive is the type to send even though the current IANA list does not show it.
• application/zip is the container and a poor install type.
• application/vnd.android.ota is not an APK.
• The file starts with PK, like JAR and DOCX. The path and the Android manifest tell you it is an APK.