App install fails with HTTP 403 on specific devices while same APK installs successfully on others

Android

When an enterprise app fails to install on specific devices but installs successfully on others, the affected devices display an HTTP 403 error during the download phase, and the installation does not complete.

Why this happens

Each device receives a unique authorization token when Esper generates a download URL for an app. If that token becomes stale, mismatched, or was never correctly issued — due to a transient error at enrollment time or a interrupted prior install attempt — the device is rejected when it tries to fetch the APK, even though the app itself and your account permissions are valid.

Steps to resolve

1. Confirm the app is fully published in the Esper Console. Navigate to Apps & Configuration → Enterprise Apps and locate the app. Confirm its status is not stuck in a Processing or Pending state before attempting any reinstall, as an incomplete upload will produce a 403 on every device.
2. Remove and re-add the app assignment on each affected device. Go to Devices & Groups → [Device Name] → Apps, remove the app assignment, then re-add and publish it. This forces the Esper Console to generate a fresh download URL and authorization token specifically for that device.
3. Publish directly to the affected device rather than via a group. Go to Devices & Groups → [Device Name] → Apps, select Install App, and choose the app. Publishing at the device level bypasses any group-scoping logic and confirms whether the failure is tied to the device token or to a group-level assignment issue.
4. Re-upload the APK as a new version if the error persists. Go to Apps & Configuration → Enterprise Apps, select the app, and upload the same APK file again as a new version. This creates a new storage record and new download endpoints, which eliminates any corruption in the original upload. Republish the new version to the affected devices.
5. Check for proxy or firewall interception on affected devices. If your devices operate behind a corporate proxy or firewall, verify that Esper's app storage and CDN domains are allowlisted and not being intercepted. A proxy that terminates HTTPS connections can strip or replace authorization headers, causing device-specific 403 errors that do not affect devices on a different network path.

Verify: Navigate to Devices & Groups → [Device Name] → Apps and confirm the app status shows Installed with the expected version number. Cross-check against a device where the install succeeded to confirm the versions match. The status should update within 5 minutes of a successful install.

If this doesn't resolve it

If the 403 error continues after completing all steps above, collect the following before contacting Esper Support:

• A bug report captured immediately after reproducing the failure. Generate it from Devices & Groups → [Device Name] → Bug Report → Generate. The logs will show whether the 403 originates from Esper's backend or from a network layer between the device and the storage endpoint.
• The device name, Esper device ID, and the exact app name and version from the Esper Console.
• A note on whether affected devices share a common network, hardware model, or enrollment method that differs from devices where the install succeeds.

Contact Esper Support with the above information so the correct backend token state can be investigated for the affected devices.

Still need help?

If the issue persists, submit a support ticket and include the specific device models or serial numbers experiencing the HTTP 403 error, the APK name and version, and a comparison with devices where the installation succeeds.