Understanding Android 6.0 Marshmallow and API Level 23

Android API 23: The Milestone Update That Rewrote Mobile Security

When developers talk about watershed moments in mobile operating system history, few versions match the profound structural impact of Android API Level 23, famously released alongside Android 6.0 Marshmallow in late 2015.

While it brought plenty of user-facing visual polishes and under-the-hood performance tweaks, API 23 is universally remembered for a single, revolutionary shift: runtime permissions. It permanently changed how applications interact with user privacy and set a new standard for mobile security that Google’s ecosystem relies on to this day.

The Pre-Marshmallow Wild West: Install-Time Permissions

To truly understand why API 23 was such a seismic shift, you have to look at how Android handled permissions before it.

In the era of API Level 22 (Android 5.1 Lollipop) and earlier, the permission model was built on an “all-or-nothing” approach at the moment of installation. When a user browsed the Google Play Store and hit “Install” on an app, a sprawling list of requested permissions—accessing the camera, reading contacts, tracking location, reading storage—would pop up on a static screen.

If a user wanted the app, they had to accept every condition blindly. Once installed, the app had permanent, unchecked access to those resources until it was uninstalled. This created major security vulnerabilities:

• The “All-or-Nothing” Dilemma: Users frequently abandoned safe apps simply because a flashlight utility demanded access to their contacts and phone state.
• Malicious Exploits: Shady apps could quietly harvest sensitive data in the background because the user had granted sweeping privileges months prior without a second thought.

The Crown Jewel of API 23: Runtime Permissions

Android 6.0 and API 23 flipped this paradigm on its head by introducing runtime permissions.

Instead of demanding everything upfront during installation, apps targeting API 23 had to ask the user for permission dynamically—at the exact moment the feature requiring that permission was actually used.

• Contextual Prompts: If a photo-editing app wanted to snap a picture, it could no longer assume it had camera access. It had to trigger a system dialog asking: “Allow [App Name] to take pictures and record video?”
• Granular Control: Users could finally say “Deny” to specific requests and still use the core features of the app.
• Revocation Power: Users could revoke permissions at any time via the device settings without having to uninstall the app entirely.

This single feature forced developers to rethink software architecture. Apps suddenly needed to gracefully handle scenarios where a user clicked “Deny,” preventing crashes and explaining why a certain feature required access to a specific piece of hardware.

Beyond Permissions: Other Defining Features of API 23

While runtime permissions stole the spotlight, API 23 introduced several other foundational tools that shaped modern Android development:

1. Doze Mode and App Standby: Battery life became a primary target in Marshmallow. API 23 introduced Doze Mode, which intelligently puts the device into a deep sleep state when left idle (like sitting on a desk), heavily restricting CPU and network background activity. App Standby similarly throttled apps that hadn’t been actively used in a while.
2. Native Fingerprint Authentication: Before API 23, fingerprint sensor support was entirely fragmented because manufacturers implemented their own proprietary hardware APIs. Marshmallow standardized this by introducing a unified FingerprintManager API, letting developers safely integrate biometric security for logins and mobile payments.
3. Direct Share: Sharing content became vastly faster with APIs that allowed developers to surface specific direct-share targets (like a specific chat thread inside a messaging app) directly within the system share sheet.

The Legacy of API 23 Today

Looking back from the vantage point of modern Android development, API 23 represents the awkward yet vital adolescent phase where Android matured into a privacy-first operating system.

It laid the groundwork for advanced modern features like Scoped Storage, One-Time Permissions, and granular location tracking. Furthermore, as time marched on, Google gradually raised the minimum API requirements for apps submitted to the Google Play Store, forcing laggard developers to abandon legacy codebases and embrace dynamic security models.

Ultimately, API Level 23 wasn’t just a routine software upgrade. It was a cultural reset for mobile development—proving that user trust, data privacy, and powerful functionality could successfully coexist on an open-source platform.