Signed Android package, checksum, first-launch path
The signed khelo bet24 APK is delivered as a single binary from this route. This route lists the SHA-256 checksum, the supported Android version range, the install steps, and the four toggles the user reviews on first launch.
What the APK contains, what it weighs, what it does not
The signed APK on this route bundles the lobby shell, the wallet client, and the live-games stream adapter in one binary. The weight sits around 62 MB because the live-games adapter includes the HLS and WebRTC decoders; the wallet client includes the UPI deep-link handler; the lobby shell includes the catalog renderer for the 973 games in the catalogue. None of these pieces downloads at install time, so a slow connection only delays first launch, not installation.
The APK does not include a separate bonus-engine module: the three welcome tiers are served from the lobby shell. It does not include the KYC document scanner: KYC runs in-app, opens the device camera on demand, and uploads encrypted frames to the wallet endpoint. It does not include any third-party tracker: there is no Google Analytics SDK, no Facebook SDK, and no branch.io-style deeplink resolver; the marketing attribution pixel is opt-in on the wallet screen under Settings → Privacy → Marketing.
The package targets Android 9.0 (API level 28) as the minimum. The package supports up to Android 14 (API level 34). Anything below 9.0 will refuse to install because the lobby shell relies on the scoped-storage model introduced in API 29. Anything above 14 will install but the wallet may flag a "untested device" notice until we release a 14-specific build.
| Package attribute | Value | Source |
|---|---|---|
| Package name | com.khelo.bet24 | Manifest |
| APK size | ~62 MB | Build output |
| Minimum Android | 9.0 (API 28) | Manifest minSdkVersion |
| Maximum tested | 14 (API 34) | Test report |
| Target API | 34 | Manifest targetSdkVersion |
| SHA-256 | Listed on the install guide; matches the value shown after download | Build output |
| Signature | v2 and v3 (APK Signature Scheme) | apksigner verify |
| Permissions | INTERNET, ACCESS_NETWORK_STATE, CAMERA (KYC), READ_MEDIA_IMAGES (avatar) | Manifest |
Verifying the SHA-256 before install
Why the checksum matters
The signed package on this route carries a SHA-256 hash that lets the user confirm the file was not modified in transit. The hash is shown on the download screen, repeated in the wallet after the download completes, and is part of the file metadata the user can verify with any standard tool.
Verify on Android with a file manager: open the file manager, long-press the downloaded APK, tap Properties or Details, and read the SHA-256 line. Match it against the value listed on the install guide; mismatch means the file was tampered with and must not be installed.
Verify on desktop: from a terminal, run sha256sum khelo-bet24.apk and compare the output to the value listed on the install guide.
Allow this source, install, open
- Download the APK. The file lands in
Downloadsby default. - If this is the first APK from this source, Android asks the user to allow installs from the file manager. Toggle Allow from this source on; the toggle lives under Settings → Apps → Special app access → Install unknown apps.
- Tap the APK in the file manager. Android shows the package name, version, and the permissions it requests. Confirm.
- The installer runs. The lobby shell appears in the launcher as khelo bet24.
- Open the app. The first-launch screen asks for the mobile number, the OTP, and the four-digit PIN.
The whole flow runs without contacting the operator's backend for the install itself. The first network call happens after sign-up.
Four toggles on the welcome screen
What the user reviews before entering the lobby
Age-18 enforcement: the user confirms the holder is at least 18. The toggle is required; the lobby does not open without it.
Supported-state confirmation: the user confirms the holder is a resident of a state where the operator accepts new accounts. The list is on /is-legal/.
Marketing consent: the user opts in or out of the marketing pixel. The default is off.
Analytics consent: the user opts in or out of analytics tracking. The default is off.
Why APK updates are not pushed through Google Play
Google Play does not host real-money gaming apps in the jurisdictions the operator serves, so updates must reach the device outside the Play Store. The operator's update flow checks the wallet endpoint on each app launch: if the server version is higher than the installed version, the user sees a banner with a one-tap download. The downloaded APK overwrites the previous install; the wallet and the KYC document set are preserved across the update.
The user can disable the update banner from Settings → App → Updates. Disabling it does not disable mandatory updates, only the optional ones. Mandatory updates run before the lobby opens when the installed version is below the minimum supported version.
Removing the APK, keeping or closing the account
Uninstalling the APK removes the lobby shell from the device. It does not close the account, does not delete the wallet balance, and does not revoke KYC. To close the account, follow the /delete-account/ path; the closure runs on the server side and takes effect regardless of whether the APK is on the device.
What the APK cannot do, even with consent
Hard limits inside the sandbox
The APK cannot read the SMS inbox: it sends and receives OTPs through the dedicated SMS Retriever API, which exposes only the OTP message, not the rest of the inbox. The APK cannot read the call log or the contact list. The APK cannot read other apps' files: scoped storage means the lobby only sees its own directory and the user-picked image picker for avatar upload.
The APK cannot run in the background indefinitely: the live-games stream pauses when the lobby is backgrounded and resumes when it is foregrounded. Battery-optimisation flags on Chinese OEM ROMs (MIUI, ColorOS, FuntouchOS) can kill the lobby if the user has aggressive battery saving turned on; the user can whitelist the lobby in the battery settings.
The APK cannot phone home to a third-party tracker. The only outbound requests are to the operator's domain (lobby, wallet, KYC, support) and to Google Fonts for typography.
Where this hands off
Download
Desktop and mobile install paths in one view.
Wallet & KYC
Document set, 12-hour average turnaround.
Responsible play
Age-18 enforcement, deposit caps, cooldown.
Support
Channel-by-channel help.
Is it legal
Jurisdiction context the project can verify.
How it works
The full first-session path, step by step.
Decision questions on this route
Why does the APK not come from Google Play?
What is the SHA-256 checksum, and why is it on the route?
Can the APK run on Android 8?
What happens if the install is interrupted?
Will the APK keep working if I never update?
Does the APK include a tracker?
Install the APK and enter the lobby
The lobby opens once the four first-launch toggles are reviewed and the wallet is funded. The KYC document set can wait until the first withdrawal.