apkeep

Instead of a single app ID, you can provide a CSV file containing a list of apps to download.

• If the file has one app ID per line, it can be treated as a single-field CSV.
• If the app ID is not in the first column, you must use the --field option to specify which column contains the ID.

If you have an AUTH token (typically starting with ya29.) from a token dispenser like Aurora Store, you can use it directly with the --auth-token flag. It is recommended to use the --accept-tos flag for first-time use to automatically accept Google Play's Terms of Service.

apkeep -a com.instagram.android -d google-play -e 'dispenser_email@gmail.com' --auth-token 'ya29.a0...' --accept-tos .

For personal accounts, you can use an OAuth token to obtain a persistent AAS token.

1. Obtain an OAuth token by visiting Google Embedded Setup, logging in, and extracting the oauth_token value (starting with oauth2_4/) from the Cookies tab of the last accounts.google.com request in your browser's Network tab.
2. Use the --oauth-token flag to exchange this for an AAS token: apkeep -e 'someone@gmail.com' --oauth-token oauth2_4/...
3. Use the resulting AAS token for subsequent downloads with the -t flag.

apkeep -a com.instagram.android -d google-play -e 'someone@gmail.com' -t some_aas_token .

You can install apkeep using several methods depending on your environment:

Via Cargo (Rust)

If you have Rust installed, use cargo install:

cargo install apkeep

To install from the latest commit in the repository:

cargo install --git https://github.com/EFForg/apkeep.git

Via Precompiled Binaries

Download precompiled binaries for various platforms from the GitHub Releases page.

Via Termux (Android)

If using on Android, install termux first, run pkg update, then:

pkg install apkeep

Via Docker

Use images from the GitHub Container Registry. Available tags:

• stable: Latest stable release (recommended)
• latest: Latest release, including pre-releases
• edge: Latest commit

Instead of a single app ID, you can provide a CSV file containing a list of apps.

• If the file has one app ID per line, it can be treated as a single-field CSV.
• If the app ID is not in the first column, use the --field option to specify the column index (1-based).
• If you want to specify versions, use the --version_field option to specify the column index (1-based) containing the version string.

Example command structure:

apkeep --csv apps.csv --field 1 --version_field 2 -d f-droid .

To avoid providing credentials on the command line, create an apkeep.ini file in your user config directory (e.g., ~/.config/apkeep/apkeep.ini on Linux). You can specify the path to a custom config file using the -i flag.

[google]
email = someone@gmail.com
aas_token = some_aas_token
# OR use auth_token instead of aas_token:
# auth_token = ya29.a0...

apkeep -a com.instagram.android -d google-play -i ~/path/to/some.ini .

When using GooglePlay as a download source, you must provide authentication. You can use one of the following methods:

1. OAuth Token: Provide --oauth-token to retrieve a long-lived AAS token. This requires an OUTPATH to be omitted.
2. AAS Token: Provide --aas-token (or -t) directly.
3. Auth Token: Provide --auth-token (e.g., from an Aurora dispenser).

Additionally, you may need to provide --email (-e) and use --accept-tos to accept the Google Play Terms of Service.

To download from the F-Droid open source repository, use the -d f-droid flag. apkeep verifies that these APKs are signed by F-Droid maintainers and will alert you if verification fails.

apkeep -a org.mozilla.fennec_fdroid -d f-droid .

You can run apkeep inside a Docker container. To download a single APK to a specific host directory, mount the directory as a volume.

docker run --rm -v output_path:/output ghcr.io/efforg/apkeep:stable -a com.instagram.android /output

To download from the Huawei AppGallery, use the -d huawei-app-gallery flag.

apkeep -a com.elysiumlabs.newsbytes -d huawei-app-gallery .

The simplest way to use apkeep is to download a single APK to the current directory using the default source (APKPure), which does not require credentials. Use the -a flag to specify the app ID and provide a destination path.

apkeep -a com.instagram.android .