How to Declare Permissions in AndroidManifest.xml

This guide explains how to declare application permissions within the AndroidManifest.xml file for Android development. You will learn the exact XML syntax required, the proper tag placement within the manifest hierarchy, how to specify hardware-dependent permissions, and the relationship between manifest declarations and modern Android runtime permissions.

The <uses-permission> Element

In Android, permissions are declared using the <uses-permission> element. This tag informs the Android operating system and the Google Play Store about the system features, user data, and APIs your application needs to access (such as the camera, internet, or contacts).

Syntax and Placement

The <uses-permission> tag must be placed as a direct child of the root <manifest> element and must reside outside the <application> element.

Here is the standard syntax:

<manifest xmlns:android="http://schemas.android.com/apk/res/android"
    package="com.example.myapp">

    <!-- Declaring permissions -->
    <uses-permission android:name="android.permission.INTERNET" />
    <uses-permission android:name="android.permission.CAMERA" />
    <uses-permission android:name="android.permission.ACCESS_FINE_LOCATION" />

    <application
        android:allowBackup="true"
        android:icon="@mipmap/ic_launcher"
        android:label="@string/app_name"
        android:theme="@style/AppTheme">
        
        <!-- Application components (activities, services, etc.) -->

    </application>
</manifest>

Conditional and Version-Specific Declarations

You can restrict a permission to specific Android API levels using the android:maxSdkVersion attribute. This is useful when newer Android versions no longer require a permission for certain actions (such as reading external storage in modern scoped storage environments).

<uses-permission 
    android:name="android.permission.WRITE_EXTERNAL_STORAGE"
    android:maxSdkVersion="28" />

Declaring Hardware Requirements with <uses-feature>

When you declare permissions that correspond to device hardware (such as CAMERA or ACCESS_FINE_LOCATION), Google Play assumes your app requires that hardware by default. If your app can function without the hardware, pair the permission with a <uses-feature> tag set to android:required="false":

<uses-permission android:name="android.permission.CAMERA" />

<uses-feature 
    android:name="android.hardware.camera" 
    android:required="false" />

Normal vs. Dangerous (Runtime) Permissions

Declaring a permission in AndroidManifest.xml is mandatory for all permission types, but how they are granted depends on the protection level:

• Normal Permissions (Install-time): Permissions that do not pose a direct risk to user privacy (e.g., android.permission.INTERNET). The system grants these automatically at install time once declared in the manifest.
• Dangerous Permissions (Runtime): Permissions that access private data or critical hardware (e.g., android.permission.READ_CONTACTS, android.permission.CAMERA). These must still be declared in the AndroidManifest.xml file, but your application must also explicitly request them at runtime from the user within your Kotlin or Java code before executing the protected actions.

Declaring Custom Permissions

If you are exposing your own app components to other apps securely, you can define custom permissions using the <permission> element:

<permission 
    android:name="com.example.myapp.CUSTOM_PERMISSION"
    android:protectionLevel="dangerous"
    android:label="@string/permission_label"
    android:description="@string/permission_description" />

Other applications wishing to interact with your secured components must then include a <uses-permission android:name="com.example.myapp.CUSTOM_PERMISSION" /> tag inside their own manifest files.