Runtime permissions

Why permissions?

A phone holds very personal things: photos, location history, contacts, messages, the microphone. Android does not let apps touch these freely. A permission is a declared right to use a protected feature. Since Android 6.0 (API 23), sensitive permissions are granted by the user while the app runs, not silently at install, so users understand why each one is needed.

Step 1: declare in the manifest

<uses-permission android:name="android.permission.CAMERA" />
<uses-permission android:name="android.permission.POST_NOTIFICATIONS" />

Step 2: request at the moment of use

@Composable
fun ScanQrButton(onScan: () -> Unit) {
    val context = LocalContext.current
    var showRationale by remember { mutableStateOf(false) }

    val launcher = rememberLauncherForActivityResult(
        ActivityResultContracts.RequestPermission()
    ) { granted ->
        if (granted) onScan() else showRationale = true
    }

    Button(onClick = {
        val alreadyGranted = ContextCompat.checkSelfPermission(
            context, Manifest.permission.CAMERA
        ) == PackageManager.PERMISSION_GRANTED
        if (alreadyGranted) onScan() else launcher.launch(Manifest.permission.CAMERA)
    }) { Text("Scan QR to pay") }

    if (showRationale) {
        Text("Camera access is needed to scan QR codes. You can still pay by entering a UPI ID.")
    }
}

Ask in context: request the camera when the user taps "Scan QR", not on the first launch. People say yes much more often when the reason is obvious. If the user says no, explain why the feature needs it and offer another way (enter the UPI ID by hand).

When the user says no twice

If the user denies a permission repeatedly, Android stops showing the dialog (the user chose "don't ask again", or the system decided so). launch then returns denied immediately. The polite response is to explain the benefit and offer a button that opens the app's page in system Settings, where the user can enable it if they change their mind.

Notifications on Android 13+

Since Android 13 (API 33), apps that target it must request POST_NOTIFICATIONS at run time before showing notifications. Ask after the user has seen value, for example after their first order ("Get updates when your order is out for delivery?").

Ask for less

Every permission is a privacy cost and a review risk. Google Play restricts some permissions (SMS, call log, background location) to apps whose core feature truly needs them, and asks you to declare why. Often an alternative avoids a permission entirely: the system photo picker needs no storage permission, and approximate location (ACCESS_COARSE_LOCATION) is enough for "nearby stores".

Common mistakes

• Asking for all permissions on the first screen: users deny, and some uninstall.
• Forgetting the manifest declaration: the request is denied silently.
• Crashing or showing a blank screen when the user says no. Always have a fallback.
• Requesting permissions the app does not really need, which can get the app rejected on Play.