Installation

Install @hotcodepush/cordova-code-push in one of three ways: let an AI agent do it, run npx hotcodepush init, or follow the steps by hand. You need a Cordova app on cordova-ios 8 and cordova-android 14 or 15 (Supported versions), Node on every build machine and an app in the console.

AI-assisted setup (recommended)Copy Anchor Link

Install the HotCodePush skills:

npx skills add hotcodepush-team/skills

Then paste the prompt into your coding agent:

Set up HotCodePush in this project: install the skills with `npx skills add hotcodepush-team/skills`, then run the hotcodepush-init skill and the hotcodepush-release skill, following https://hotcodepush.com/docs/ai.

The agent installs the SDK, creates the app and ships a first update. Agent skills explains what the agent does.

Set up with the CLICopy Anchor Link

npx hotcodepush init

init runs cordova plugin add, writes hotcodepush.json and signs you in. There is nothing to wire, since the plugin brings its own build step. init lists every step. Run it again after a manual step: it finishes only what is missing.

Manual setupCopy Anchor Link

If init already ran, skip to step 3.

1. Install the packageCopy Anchor Link

npm install --save-dev hotcodepush
npx cordova plugin add @hotcodepush/cordova-code-push

cordova plugin add records the plugin in package.json and adds it to every platform the project has, and a platform added later gets it from that list. The CLI is a dev dependency: the plugin's Xcode phase and Gradle task run npx hotcodepush inside every native build. The bridge and the core are Kotlin, so the plugin sets GradlePluginKotlinEnabled and GradlePluginKotlinVersion in the platform's config.xml. A preference of either name in your own config.xml wins.

A TypeScript project gets the global HotCodePush and the result types with an import type:

import type { SyncResult } from '@hotcodepush/cordova-code-push';

document.addEventListener('deviceready', async () => {
  const result: SyncResult = await HotCodePush.sync();
  console.log(result.status);
});

2. Add hotcodepush.jsonCopy Anchor Link

{
  "appId": "4f2b7c9e-8d31-4a6e-9b0f-2c5d7e8a1b34",
  "channel": "production"
}

The file sits in the project root, next to package.json and config.xml. appId is on the app's page in the console, and channel is the channel this build follows. Every other key has a default. Configuration lists them.

3. Build onceCopy Anchor Link

npm run build
npx cordova prepare
npx cordova build android
npx cordova build ios

cordova prepare copies www into each platform and runs the plugin's hook, which adds the Xcode phase, and the plugin's Gradle file registers the Android task. Every build then writes hotcodepush.json into the built app and a store build creates the binary. binary says what the step writes and needs. Log in first with npx hotcodepush login, or export HOTCODEPUSH_TOKEN, so the file names your channel.

4. Verify with doctorCopy Anchor Link

npx hotcodepush doctor

doctor reports each check as ok, skipped or failed, with the step that repairs a failure. doctor lists the checks.

5. Release a first updateCopy Anchor Link

Change something visible in www, build it and release it to the channel:

npm run build
npx hotcodepush release create

The device applies the release at its next start. release has every option. If nothing happens, see Troubleshooting.

Platform notesCopy Anchor Link

• AndroidInsecureFileModeEnabled loads the app from file://, where no update can be served: the plugin stays off and rejects every method, as Errors shows. Leave the preference out of config.xml. doctor flags it.
• Builds: an archive, Product › Archive or cordova build ios --device, and an Android build of a type other than debug create the binary. A simulator build, an emulator run and every debug build write the file and create nothing, so their first update is the full pack. Debug builds embed www and take updates by default. Set isEnabledInDebugBuilds to false once the setup is verified.
• Node for Xcode: Xcode's PATH has no Node. The phase takes the node of a build started from a shell, reads NODE_BINARY from platforms/ios/.xcode.env, or searches nvm, fnm, Volta, asdf and Homebrew. A build that finds none fails with the line to add.
• Android: the SDK's manifest declares INTERNET and ACCESS_NETWORK_STATE, nothing to add. An app that sets android:fullBackupContent or android:dataExtractionRules itself hits a manifest merger conflict. Add tools:replace for the attribute on <application> through an <edit-config> in config.xml, and exclude hotcodepush/ under domain="file" in both <cloud-backup> and <device-transfer>.
• The native glue: cordova.js, cordova_plugins.js and everything under plugins/ always come from the installed binary, never from a release, and location.reload() and a dev server's live reload apply nothing. The SDK ships its privacy manifest. Privacy and device data has the App Privacy answers.

Next stepsCopy Anchor Link

• Configuration lists every key of hotcodepush.json and the strategies that decide when an update is checked, downloaded and applied.
• API documents the methods, events and types on window.HotCodePush, with every status and reason.
• Sign your bundles sets up a key pair whose public key goes into hotcodepush.json, so a device applies only what you signed.