iAdmin Android App

iAdmin is the Android client for the ISPbills Admin panel. It provides a native sign-in and navigation shell around the current web Admin workspace, so Laravel roles, policies, subscription checks, tenant scope, and the role-specific menu remain authoritative.

Download and requirements

iAdmin requires Android 8.0 or later. Download iadmin.apk from either:

• Get iAdmin for Android on the ISPbills operator sign-in page.

Both links serve the signed production build at https://app.ispbills.com/downloads/iadmin.apk?v=3.1.0. If Android blocks the APK, permit installs for the browser or file manager used to open it, then retry. Do not use an APK copied from an unknown source.

Sign in

Use one of these methods:

• enter an Admin ID, email, or mobile and password; or
• select Continue with Google to choose a Google account in Android;
• select Sign in with a passkey to use a passkey saved for app.ispbills.com; or
• select Continue with Facebook to use the secure browser flow.

Select Continue with phone to verify the mobile number already saved on the Admin account. Enter the full number with country code (for example, +8801712345678), then enter the one-time SMS code. Firebase verifies the number and ISPbills exchanges the short-lived identity token for the same single-use Admin web session used by the other native methods. Phone verification never creates a new Admin account.

Google and passkey sign-in use Android Credential Manager. If a device cannot start native Google selection, iAdmin automatically continues with the verified browser flow. Facebook also uses that browser flow and returns through the verified https://app.ispbills.com/iadmin/auth/callback app link, with iadmin://auth/callback as a fallback. These methods only connect to an existing active Admin account. The selected method must be enabled in ISPbills, and a passkey must first be registered on the web sign-in page. Card-distributor and reseller-partner accounts cannot enter the Admin workspace; reseller partners should use iPartner.

The password flow sends credentials to POST /api/v1/admin/auth/login. On success, the server returns a random, single-use signed session URL that expires after three minutes. The app does not store the password or session URL. The web session itself uses the normal secure portal cookie, while the app stores only signed-in state, display name, installation ID, and Firebase token.

If two-factor authentication is enabled, the normal ISPbills TOTP challenge appears inside the app before Admin pages become available. Enter the current code from the authenticator configured for that account. iAdmin does not bypass 2FA.

Workspace and permissions

The bottom bar opens Overview, Subscribers, Invoices, Support, and More. The Group Admin workspace under More is searchable and groups direct links to dashboards, the full team hierarchy, subscriber operations, network and NOC tools, billing and accounts, communications, maps, reports, logs, settings, security, subscription, changelog, and help. The full permission-aware web Admin menu remains available inside every page.

What a user can see or change is determined by the signed-in role and server-side permissions. A shortcut can still return 403 Forbidden when the account lacks that permission. Business-event push alerts are intentionally delivered only to active Group Admin owner accounts, even though other authorized staff can use iAdmin.

Select Sign out under More to submit the portal logout form. If the web session expires or the app reaches the operator login page, iAdmin clears its signed-in state and returns to native sign-in.

Push alerts and deep links

Allow notifications when Android asks. After an authenticated Admin page loads, iAdmin registers the installation with ISPbills. Current business alerts are:

Tapping an alert opens its Admin record. Only relative paths under /admin or /portal/admin are accepted. HTTPS Admin links for app.ispbills.com can also open in iAdmin; other destinations open in the system browser. Internal support notes are not customer-reply alerts.

Device access and privacy

iAdmin requests internet/network access and Android notification access. A portal file picker can access only the file the user selects. Authenticated downloads are saved through Android Download Manager in the app’s external Downloads area. Cleartext HTTP is disabled, third-party cookies are rejected, and Android backup is disabled.

The app can expose every Admin page the account is permitted to use. Protect the phone with a screen lock, do not share downloaded customer or financial files, and sign out before transferring the device.

Troubleshooting