In an Android build, google() points to Google's Maven repository, which hosts AndroidX, Architecture Components, Play services, Play Billing, Firebase and related libraries. mavenCentral() points to Maven Central for the wider open source ecosystem. New Android Studio projects declare both in the settings file, in that order.
What each one is for
Android's documentation says new Android Studio projects specify Google's Maven repository and Maven Central as the repository locations in the settings file. It lists libraries available from Google's Maven repository, including:
- AndroidX libraries and Architecture Components
- Constraint Layout and Databinding
- AndroidX Test
- Wear OS and the Instant App library
- Google Play services and Play Billing
- Firebase
Everything else, such as most third party libraries, comes from Maven Central or another repository you add.
A short history note
The docs state that JCenter, which was included by default in the past, became read-only on March 31st, 2021. If an older project still lists it, remove it and confirm every dependency resolves elsewhere. A repository that no longer accepts new releases cannot ship fixes.
The default block
The docs show this block in the settings file:
dependencyResolutionManagement {
repositoriesMode.set(RepositoriesMode.FAIL_ON_PROJECT_REPOS)
repositories {
google()
mavenCentral()
}
}
The FAIL_ON_PROJECT_REPOS mode fails the build if a project declares its own repository, so only the settings level list is used. That is the property you want when you care where code comes from.
Order and trust
The docs state that the order of listing determines the search order, so if both repositories have a dependency, the first one listed supplies it. The docs we read do not mention content filtering. You can add it yourself, so Google's repository answers only for its groups and the public one is not asked for them. The technique is in keeping private groups off public repos.
Checklist
| Check | Pass condition |
|---|---|
| Repositories declared in settings | One list, reviewed |
| Project level repositories | None, enforced by FAIL_ON_PROJECT_REPOS |
| JCenter | Absent |
| Custom repositories | Each has an owner and a filter |
| mavenLocal | Absent from release builds |
| Order | Intentional and documented |
Steps
- Open the settings file and the root build file.
- Compare their repository lists to the table.
- Set FAIL_ON_PROJECT_REPOS if it is not set.
- Add filters for any custom repository.
- Run a clean build and review where artifacts resolved.
For the longer treatment of Android repositories, see how to control where Gradle downloads Android dependencies from.
Try it yourself
Click through it at your own pace, or open it full screen.
Open a few components and note which ecosystem each belongs to.
Safeguard's dependency scanning and SBOM generation cover Android Gradle projects, and the free scan at gold.safeguard.sh/scan lets you try it on yours.
Quick check
Do I need both repositories?
Most Android apps do, since AndroidX and Play services come from Google's repository and many other libraries from Maven Central.
Is JCenter still used?
The Android docs say it became read-only on March 31st, 2021, so it should not appear in current builds.
Sources
Last reviewed: 19 October 2026.
