On this page (8 sections)
What Google needs from you
Play Console has an App access section (under App content) where you declare whether all or some functionality is restricted, and provide instructions and credentials for reviewers. Google’s “Prepare your app for review” guidance describes it. If access is restricted and the instructions are missing, incomplete or do not work, the review stops there.
Reusable, durable reviewer credentials
- Create a dedicated reviewer account that never expires, is not single-use, and is not tied to a real customer.
- Give it access to every restricted feature: premium tiers, admin views, partner-only sections.
- Do not rotate the password without updating Play Console. Many repeat rejections are stale credentials.
- Keep test data in the account so features have something to show.
The usual blockers
OTP and 2FA
A reviewer cannot receive your SMS or email code. Provide a review account that bypasses OTP (a fixed code for that account, or a backend allow-list), and say so in the instructions. Do not disable OTP for everyone.
Social and third-party login only
If the only way in is Google, Facebook or Apple sign-in, reviewers may not be able to use it. Add an email/password path for the review account, or provide a pre-authenticated review account with instructions.
Paywalls and subscriptions
If features are behind a purchase, the review account must already be entitled, or a test payment method must work in the review environment. Do not expect the reviewer to pay.
QR codes, barcodes, PINs and hardware
Apps that need a physical code, a device, a card or a store location cannot be reviewed without an alternative. Provide a demo mode, sample codes, a video walkthrough and clear instructions on what cannot be exercised remotely and why.
Geo and network restrictions
Reviews may originate from regions and IP ranges you do not serve. If the backend blocks by country, IP, device or environment, the reviewer sees an error. Allow-list the review path or provide a review mode.
Backend and environment restrictions
Staging-only builds, expired certificates, maintenance windows and rate limits all produce “could not access” rejections. The build under review must talk to a backend that is up and reachable for the whole review window.
Write instructions a stranger can follow
Reviewer instructions should read like a test script:
- Open the app, tap Sign in, choose Email.
- Enter the provided email and password. If asked for a code, enter the fixed review code.
- To see the premium report, open Reports → Monthly; the review account already has an active subscription.
- Features that need physical hardware: see the linked video; the demo toggle under Settings → Demo mode simulates the device.
Include everything the reviewer needs to reach every restricted feature, in order, with the exact labels used in the UI.
Run a cold reviewer test
The five-minute check that prevents the second rejection
Give the release build and the written instructions to someone who has never used the app, on a clean device, ideally on a different network. If they cannot reach every restricted feature using only what you wrote, neither can the reviewer.
Security of reviewer access
Scope the review account to test data only. Do not give it access to real customer data, payments or admin tools that can change production. Do not share production API keys, signing keys or database credentials with anyone — not with Google, and not with us. Review access should be revocable without affecting real users.
Checklist before resubmitting
- App access section in Play Console is filled in and matches the current build
- Review account works, never expires, and reaches every restricted feature
- OTP / 2FA has a review bypass for that account only
- Backend accepts the review region and environment
- Instructions verified by a cold tester on a clean device
- Anything that cannot be reviewed remotely is explained and demonstrated (demo mode or video)
What we can implement
Reviewer bypass for OTP, email/password review accounts alongside social login, entitlement flags for review accounts, demo modes for hardware-dependent flows, geo allow-listing on the backend, and a verified instruction script — on Android native, Flutter, React Native and Unity builds.