CLEARTEXT Android Origin: On your device Last updated 11 Oct 2026

CLEARTEXT communication to host not permitted by network security policy

Android 9+ blocks plain http:// requests by default; the app tried to call a non-HTTPS URL.

Exact message you may see CLEARTEXT communicationnot permitted by network security policyCleartext HTTP traffic to
Explore the map of this error Full error map →
Seen on: Android

Meaning

Since API 28, cleartext traffic is disabled unless explicitly allowed. It typically hits local development servers (http://10.0.2.2:3000) or old APIs without TLS.

Common causes

  • API base URL uses http://
  • Local dev server accessed over HTTP from emulator/device
  • Third-party SDK calling an HTTP endpoint
  • Redirect from https to http

⚡ Quick fix

  1. Use HTTPS for production APIs
  2. For development only, allow cleartext for specific hosts via network security config
  3. Avoid android:usesCleartextTraffic="true" app-wide in release builds

Detailed fix by platform

Android

  1. res/xml/network_security_config.xml (debug hosts only):
    xml
    <network-security-config>
    <domain-config cleartextTrafficPermitted="true">
        <domain includeSubdomains="false">10.0.2.2</domain>
        <domain includeSubdomains="false">localhost</domain>
    </domain-config>
</network-security-config>
<!-- AndroidManifest: <application android:networkSecurityConfig="@xml/network_security_config" … > -->

How to diagnose

  1. URL — Which host/URL is http?
  2. Build — Debug only or also release?
  3. Redirects — Any https→http redirect?

🔧 Still not fixed?

Many errors look alike. If the steps above didn’t solve it, one of these is probably what you’re facing:

Where this error sits

Origin: On your device. Errors that are often confused with or caused by this one (click to open):

307 — HTTP 307 Temporary Redirect (HTTP)307421 — HTTP 421 Misdirected Request (HTTP)421497 — 400 Bad Request: The plain HTTP request was sent to HTTPS port (Nginx 497) (HTTP)497ATS — App Transport Security has blocked a cleartext HTTP resource load (iOS)ATSAuthentication failed — fatal: Authentication failed for 'https://github.com/x/y.git/' (Git)Authentication failedCERTIFICATE_VERIFY_FAILED — SSL: CERTIFICATE_VERIFY_FAILED / unable to get local issuer certificate (API)CERTIFICATE_VERIFY_FA…Git SSL certificate problem — fatal: unable to access 'https://…': SSL certificate problem: unable to get local issuer certificate (Git)Git SSL certificate p…Mixed Content — Mixed Content: The page was loaded over HTTPS, but requested an insecure resource (API)Mixed ContentCLEARTEXT

Explore the map of this error Full error map →

🧠 Still stuck? Analyze your error

Paste the full message, response headers or stack trace — we'll detect the platform and point to the most likely cause.

💬 What worked for others

No tips yet — did something else fix this for you?

Share what worked for you

Tips are checked by an editor before they appear. Links are removed.