API 23: The Android Milestone That Changed How We Trust Our Phones

In the fast-paced world of software development, certain version numbers carry legendary status. For Android developers and mobile tech enthusiasts alike, API Level 23—better known as Android 6.0 Marshmallow, released in late 2015—is precisely that.

While subsequent versions of Android have brought flashier visual overhauls, deeper AI integrations, and folding-screen optimizations, API 23 fundamentally re-architected the relationship between users, their operating systems, and third-party apps. It wasn’t just an incremental update; it was a paradigm shift in mobile security and resource management.

1. The Crown Jewel: Runtime Permissions

Before API 23, the Android permission model was an “all-or-nothing” gamble. When users went to the Google Play Store to install an app, a sprawling list of requested permissions (accessing the camera, reading contacts, tracking location) was displayed up front. If you wanted the app, you had to accept every single term. Once installed, the app had carte blanche to use those permissions indefinitely.

API 23 changed everything by introducing Runtime Permissions.

• Just-in-Time Prompts: Instead of asking for access at installation, apps now had to request dangerous permissions (like storage, location, or microphone access) dynamically at the exact moment the feature was needed.
• Granular Control: Users could finally deny a specific permission and still use the rest of the app, or revoke permissions later via system settings.

For developers, this meant rewriting how code handled asynchronous callbacks and user rejections. For users, it marked the dawn of true mobile privacy control.

2. Taming the Battery: Doze Mode and App Standby

Battery anxiety has always been a companion to smartphone ownership. API 23 introduced systemic measures to curb background power drain:

• Doze Mode: When a device was left unattended, screen-off, and stationary, the system entered “Doze” state. It periodically deferred background CPU and network activities for apps, waking up only in designated maintenance windows.
• App Standby: If an app hadn’t been actively used for a while and had no visible notifications or foreground processes running, Android put it into “Standby,” cutting off its network access and stopping background syncs until the user opened it again.

3. Core Architectural Upgrades at a Glance

Beyond permissions and power management, API 23 packed a robust suite of native additions that modern mobile development still relies on today:

| Feature / Change | What It Did | Why It Mattered |
| :— | :— | :— |
| Native Fingerprint API | Standardized biometric login integration for developers. | Eliminated fragmented OEM fingerprint implementations, making biometric security uniform. |
| Apache HTTP Client Removal | Completely removed the deprecated Apache HTTP client from the Android classpath. | Forced developers to transition to modern, secure networking standards like HttpURLConnection and OkHttp. |
| Auto Backup for Apps | Automatically backed up app data (up to 25MB per user) to Google Drive. | Ensured seamless user transitions when upgrading or switching devices without losing app states. |
| Direct Share | Enabled apps to target specific contacts or content targets directly within the system share sheet. | Shortened user workflows when sharing media or text to friends. |

The Enduring Legacy of API 23

Years after its introduction, API 23 serves as a historical baseline in Android’s ecosystem. It established the modern blueprint for how permissions and background tasks are handled, teaching an entire generation of developers to code defensively against revoked access and restricted battery states.

Ultimately, API 23 proved that the most impactful updates aren’t always the ones you can see on the surface. By prioritizing user consent and device efficiency, Marshmallow laid the groundwork for the secure, privacy-conscious mobile ecosystem we rely on today.