How to install a private API repo for Android TV sideloading

Updated 2026-10-21

Setting up a private API repo for Android TV app sideloading

Why sideloading Android TV needs a private API repo

If you are building an Android TV app that calls a custom backend—say for a smart home hub, a telemetry dashboard, or a companion service that does not exist on F-Droid—you can’t rely on the Play Store. You need sideloading: installing APKs directly on your Fire TV device from a file browser or network share.

The problem is that most generic instructions only show how to run adb install. That works on phones, but on Android TV the system is stricter, and a random public APK often fails to install because of signature verification. A private API repo solves both questions at once: it hosts only the APK versions you generate, signed with a key you control, so you never download an unverified package from a third-party site.

In practice, developers and IT teams use this pattern for private dashboards, device config tools, or experimental features that you want to ship before they become a public app. The following guide walks through setting up a private Git repository, generating a signing key, signing and publishing APKs, and sideloading them safely on an actual Fire TV.

Creating and protecting the signing key

The foundation of a private API repo is a strong signing key. On your Linux workstation, create a new RSA key with at least 4096 bits so it resists brute force. Do not reuse an existing Play Store-signed key.

keytool -genseckey -v -keystore signing.key -alias tv-api-key -keyalg RSA -keysize 4096 -validity 3650

When prompted, put in your real name and a company name—this shows up in the APK’s signature info and helps with future revocation workflows.

Export the private key to the key tool of choice:

keytool -exportcert -alias tv-api-key -in signing.key -file signing.p12

Store signing.p12 encrypted on disk. If you lose it, you cannot re-sign a new build without starting from scratch. Treat it like a root certificate: back it up in multiple secure locations and rotate it when a team member leaves.

Hosting the private repo and publishing APKs

Use a self-hosted Git service you trust. For English-speaking teams in North America, GitHub Enterprise, GitLab Self-Hosted on a corporate Azure VMs, or an even simpler Git server like Gitea works. The exact host does not matter for the procedure—what matters is that it is private, accessible via HTTPS, and that you control who can push.

Create a repository called android-tv-api (or something similar). Add a README.md explaining that only signed builds from your team may be installed on Fire TV devices.

For each new build:

Build the APK with ./gradlew assembleDebug and then re-sign with jarsigner using your private key.

Optionally verify the signature locally with:

jarsigner -verify build/app/tv-api-1.0-debug.apk -keystore signing.p12

Push only the signed APK to the private repo. Tag each release (v1.0, v1.1-patch), and keep a short changelog in the commit message so you can trace which build went to which device.

Do not publish previews or private builds to a public fork of the repo. A public mirror means anyone can inspect and potentially tamper with metadata. Keep the main branch clean and controlled.

Sideloading APKs from the private repo on Fire TV

On your Fire TV, open Settings > Apps & Channel Stores, then go to Apps and find the “My Apps” list. Select “My Devices” and enable Install from Unknown Sources. Fire TV also lets you install .apk files directly from a USB drive plugged into the USB-C port, or from a file shared over your local network (SMB, AFP, or even a simple HTTP server on your home router).

Steps on the device:

Download the signed APK from the private repo (HTTPS link, not a sketchy third-party site).
Open the file with the Settings app or a trusted file viewer.
Tap the file and choose “Install”.
After installation, open the app, sign in with your private dashboard credentials, and confirm that everything works.

Because you signed the APK yourself, the installation succeeds even though the file came from your own network share. If you need to update the app later, repeat the process with the new tagged build from the private repo.

Trade-offs and things to watch out for

Size vs. transparency. Private repos keep the APK out of the store, so you avoid Google’s content review and your own brand faces fewer automated takedowns. The cost is that you must manage the manual upload cycle and verify every file before it reaches a device.
Signature verification is your only safety net. If someone gains write access to your private repo, they could push a modified APK with a valid signature. Rotating the signing key periodically limits the blast radius.
Fire TV updates and side loading. Amazon pushes OS updates that can strip sideloaded apps if the device is factory reset. Always keep a backup of the signed APKs on a separate machine or cloud storage. Also note that some OEM firmware bundles hide unknown app installation behind a separate toggle—check that “Unknown sources” is enabled in Settings > System > Developer options on your specific model.

A minimal checklist for your first private API release

Generate a 4096-bit RSA key and store it encrypted on a protected machine.
Set up a private Git repo you control and add only your team members.
Sign every APK with the workflow above, then tag the release.
Push the signed build to the repo and pull it onto the device over HTTPS.
Install on Fire TV via the Settings > Apps > Install unknown source path.
Verify the app runs and signs in correctly before retiring the test build.

Following these steps gives you a controlled, auditable pipeline from code to your Fire TV without relying on a public store or a shady side-loading site.

GitLab CI/CD for Android - GitHub Enterprise - Android TV API Reference