A Diawi alternative with versioning built in

Yes. Any CI that can run Node 18 or newer needs one step — npx appdropper upload build/app.apk — with an API token stored as the APPDROPPER_TOKEN secret. There's also a GitHub Action, appdropper-io/upload-action@v1, which posts the install link and QR code onto the pull request, and a Fastlane plugin you add with fastlane add_plugin app_dropper and call as a one-line lane action. A build uploaded from CI lands exactly where a dashboard upload would, and emails and push-notifies the app's testers the same way.

Uploads made without an account are kept 3 days, free-plan uploads 7 days, Pro uploads 30 days, and Studio uploads 90 days. On Pro or Studio you can push a build's expiry back before it lapses, or pin it so it never expires at all. Once the window runs out the binary is deleted and the install link stops resolving, though the build stays listed in your dashboard as expired. The free plan also keeps only the 5 most recent builds per app — a 6th upload deletes the oldest, file and all.

.ipa and .apk both, in the same project. Builds are matched to an app by bundle ID, so when your iOS and Android builds share one they land in the same project behind a single share link, with the latest version tracked separately per platform. iOS installs over the air from that page — no App Store, no TestFlight invite. Ad-hoc iOS builds still only install on devices listed in the provisioning profile, so App Dropper reads that UDID list out of the binary and shows how many devices are allowed.

Both — and the CLI, GitHub Action and Fastlane plugin are all clients of the same REST API at appdropper.io/api/v1, so anything they do you can do directly. Authentication is a bearer token generated in the dashboard, carrying a single scope, upload:builds, limited to the apps you tick: a leaked CI token cannot delete a build, manage testers, reach another app or read your billing. An upload is three calls — reserve, PUT the binary straight to storage, then poll for the parse result — because binaries never travel through the API itself. The limit is 300 requests an hour per token, alongside your plan's upload cap of 5 an hour on free, 30 on Pro, and 60 on Studio.

Nothing breaks the moment a payment fails: a subscription still counts as Pro or Studio while it is trialing or past due, which covers the roughly two weeks Stripe spends retrying a dead card. If it ends for good, any build you had pinned to never expire is given a normal expiry 30 days out rather than being deleted, and you get an email about it. The account then follows free-plan limits, so history trims back to the 5 most recent builds per app, and uploads pause if you are above the free plan's 2 GB of storage until you free some up. The share URLs themselves never change, so a link already pasted into a doc keeps pointing at the right app.