Guide · Agent skill
How to use the Restore Credentials for Android agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
The restore-credentials skill is a set of instructions and reference files that teaches an AI coding agent how to add Android's Restore Credentials feature to an app built with the androidx.credentials library. After reading this guide you will know what the skill does, how to install it, how to ask the agent for help with natural requests, and what you must still build yourself, especially the server-side validation.
Restore Credentials for Androidandroid/skills · Apache-2.0 Download the skill Quick start
- 1Download and unzip the skill. Download the ZIP from this page and unzip it into ~/.claude/skills/ or your project's .claude/skills/ folder, or upload it under Settings → Capabilities → Skills in the Claude apps.
- 2Confirm project requirements. Check that your app uses androidx.credentials 1.5.0 or higher, targets Android 9 (API 28) or higher, and that you have a relying party server ready.
- 3Check allowBackup. Ask the agent to read allowBackup in AndroidManifest.xml so it knows whether to implement tier 1 as well as tier 2. Do not let it change this value.
- 4Ask for the implementation. Describe what you want in plain language, such as creating restore keys at sign-up and retrieving them on first launch.
- 5Review the sign-out handling. Make sure clearCredentialState() is called on sign-out with a restore credential clear request, and that existing calls are kept.
- 6Build the backend. Follow the backend guidelines the agent presents. The skill does not implement server-side cryptographic validation.
What the restore-credentials skill makes the agent do
Restore Credentials lets an app silently log users back in when they restore the app on a new device. The skill gives the agent the knowledge and workflows to create, retrieve and clear restore keys using the Android Credential Manager API. Restore Credentials works independently of your app's main sign-in method, such as passwords, passkeys or federated sign-in, and the skill states that it requires no UI changes to existing sign-in flows.
The skill covers only the Android client-side code. It does not implement server-side cryptographic validation, so the agent will remind you to build the backend separately.
Install the restore-credentials skill
Download the ZIP file for the skill from this page and unzip it. You can install it in one of two ways. For a personal setup, unzip it into ~/.claude/skills/. For a single project, unzip it into the project's .claude/skills/ folder.
You can also upload the skill in the Claude apps under Settings → Capabilities → Skills.
- Personal: ~/.claude/skills/
- Project: .claude/skills/ inside your project
- Claude apps: Settings → Capabilities → Skills
Check that your app meets the requirements
Before asking the agent to implement anything, confirm that your project matches the skill's requirements. The skill needs an Android app that uses the androidx.credentials library at version 1.5.0 or higher, target devices running Android 9 (API 28) or higher, and Google Play services core version 24220000 or higher. You also need a relying party server for passkeys or restore keys, which you implement yourself.
The skill's dependency example uses androidx.credentials version 1.7.0-alpha03, and the source recommends using that version. Your app's build.gradle file is where those dependencies are added.
- androidx.credentials 1.5.0 or higher
- Android 9 (API 28) or higher on target devices
- Google Play services core 24220000 or higher
- A relying party server (built by you)
implementation("androidx.credentials:credentials:1.7.0-alpha03")
implementation("androidx.credentials:credentials-play-services-auth:1.7.0-alpha03")Trigger the skill with natural requests
You do not need special syntax. Describe the task in plain language and mention Restore Credentials or restore keys so the agent loads the skill. The skill is designed for apps that already use Credential Manager or are adopting it.
The agent follows the skill's guidance: it reads the two-tier architecture and DOs and DON'Ts before implementing, and it presents the backend guidelines once the client code is done.
- "Add Restore Credentials to my Android app using androidx.credentials."
- "Create and retrieve restore keys in my sign-up and sign-in flows."
- "Clear the restore key when the user signs out."
- "Check my AndroidManifest allowBackup setting and tell me which restore tiers I need."
Understand what the agent will set up
The skill describes a two-tier architecture. Tier 1 runs in the background during device setup through the BackupAgent.onRestoreFinished() callback. Tier 2 runs in the Launcher Activity.onCreate() and catches cases where background restoration did not finish, for example after a dropped network or delayed restoration, or when allowBackup is disabled.
The agent checks allowBackup in your manifest. If it is true, both tiers are implemented. Otherwise only tier 2 is implemented. The skill tells the agent not to change the value of allowBackup.
- allowBackup true: implement tier 1 and tier 2
- allowBackup false: implement tier 2 only
- Do not change allowBackup in AndroidManifest.xml
Safety notes: scripts, network and backend
The skill does not run scripts and does not use the network. It works by giving the agent knowledge and workflows, and the code it writes is for you to review and run.
Restore keys depend on your server. A wrong backend could weaken login security, so have your server-side validation reviewed before shipping. Also, the skill says that clearCredentialState() must be called on sign-out, and that restore keys are not deleted automatically when a user signs out.
- Runs scripts: no
- Uses network: no
- Server-side validation must be built and reviewed by you
- Call clearCredentialState() on sign-out
What people use it for
- Silently log returning users back in after they restore an Android app on a new phone.
- Add restore-key creation to sign-up and sign-in flows in an app that already uses Credential Manager.
- Review an existing app's BackupAgent and Launcher Activity code to check it follows the two-tier approach.
- Add clear-on-sign-out logic so a restore key is removed when a user logs out.
Frequently asked questions
Is the restore-credentials skill free to use?
The skill is published under the Apache-2.0 licence. The source states that the complete terms are in a LICENSE.txt file, so check that file for the full terms before reuse.
What do I need before installing restore-credentials?
You need an Android app using androidx.credentials 1.5.0 or higher, target devices on Android 9 (API 28) or higher, and Google Play services core 24220000 or higher. You also need a relying party server, which you build yourself.
Where do I install the restore-credentials skill?
Unzip the downloaded ZIP into ~/.claude/skills/ for personal use or into a project's .claude/skills/ folder. You can also upload it in the Claude apps under Settings → Capabilities → Skills.
Does the skill write the backend for restore keys?
No. The skill covers only the Android client code and does not implement server-side cryptographic validation. The agent will remind you to build the backend yourself.
Does Restore Credentials require passkeys?
No. The source says your client app can support restore keys without supporting passkeys, because restore keys work independently of your authentication method. The server implementation for passkeys can be reused for restore keys.
Why are my restore keys still present after sign-out?
The system does not delete a restore key automatically on sign-out. You must call clearCredentialState with a ClearCredentialStateRequest of TYPE_CLEAR_RESTORE_CREDENTIAL. Calling clearCredentialState without a type clears only non-restore credentials.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
This skill suits Android developers who already use Credential Manager or passkeys and want silent sign-in after a device restore, especially if they have a relying party server. It is not a complete sign-in system and does not build your backend, so teams without server-side expertise or without Credential Manager should choose another approach.
Download the skill