turnosxpress/tx-android

TurnosXpress Android TWA

Minimal Android Trusted Web Activity app for https://turnosxpress.com.ar.

Project

• Package/application id: com.hdrdevs.turnosxpress
• Launch URL: https://turnosxpress.com.ar
• TWA library: com.google.androidbrowserhelper:androidbrowserhelper:2.7.2
• Launcher activity: com.google.androidbrowserhelper.trusted.LauncherActivity

Build

This folder intentionally does not include a Gradle wrapper. Open tx-android in Android Studio, or use an installed Gradle distribution:

cd tx-android
gradle tasks
gradle assembleDebug

If Android Studio creates local.properties, keep it local. It is ignored by Git.

Signing

For local debug builds Android uses the debug keystore. For Play Store releases, sign with the release keystore or Play App Signing certificate configured for this package.

Example local release keystore creation:

keytool -genkeypair -v -keystore turnosxpress-release.jks -alias turnosxpress -keyalg RSA -keysize 2048 -validity 10000

Do not commit keystores or signing passwords. Put local signing values in keystore.properties if you later wire release signing into Gradle.

SHA-256 Fingerprint

Digital Asset Links must use the SHA-256 fingerprint of the certificate that signs the installed APK.

Debug keystore example:

keytool -list -v -alias androiddebugkey -keystore "$env:USERPROFILE\.android\debug.keystore" -storepass android -keypass android

Release keystore example:

keytool -list -v -alias turnosxpress -keystore .\turnosxpress-release.jks

If Play App Signing is enabled, use the SHA-256 fingerprint from Play Console's app signing certificate, not only the upload key.

Digital Asset Links

Publish this file publicly at:

https://turnosxpress.com.ar/.well-known/assetlinks.json

Example:

[
  {
    "relation": ["delegate_permission/common.handle_all_urls"],
    "target": {
      "namespace": "android_app",
      "package_name": "com.hdrdevs.turnosxpress",
      "sha256_cert_fingerprints": [
        "AA:BB:CC:DD:EE:FF:00:11:22:33:44:55:66:77:88:99:AA:BB:CC:DD:EE:FF:00:11:22:33:44:55:66:77:88:99"
      ]
    }
  }
]

The JSON must be served over HTTPS with Content-Type: application/json and no redirects that break access to /.well-known/assetlinks.json.

Play Protect And Local APK Notes

Local APK installs can show Play Protect warnings because the APK is not installed from Google Play and may be signed by a new or unknown certificate. This is expected during sideload testing and does not prove the TWA or Digital Asset Links setup is wrong.

The full-screen trusted experience only works when Android can verify the website-to-app relationship through Digital Asset Links for the certificate used to sign that APK. Until that is valid, Chrome may open the site with browser UI or behave like a Custom Tab.