Activating an eSIM without the carrier's app

My carrier recently moved every self-service task into its app, and its website now shows only bills. When I took a new line as an eSIM, I wanted to know whether the app is really needed to set it up, so I decompiled it.

Two separate steps#

Activating an eSIM involves two steps. The first is obtaining the credential, an activation code that points to the profile prepared for you, and the carrier puts this step behind its app. The second is installing the profile, a cryptographic download into the SIM chip, which the phone's operating system does on its own. The app only delivers a string.

What an eSIM is#

A SIM is a smartcard, a small tamper-resistant computer that holds the ICCID (the SIM's serial number), the IMSI (your subscriber identity) and the Ki, a secret key that never leaves the card and proves your identity to the network. An eSIM keeps all three and changes only the packaging and the delivery.

The chip is an eUICC (embedded UICC), a GSMA-certified secure element soldered to the board and running a Java Card operating system. It has a permanent identity, the EID, and a certificate chain rooted in the GSMA Certificate Issuer, which lets a remote server tell a genuine chip from an emulator. It can store several profiles and keep one enabled at a time; an iPhone 16e supports dual eSIM, with two enabled at once. A profile is one digital SIM: ICCID, IMSI, Ki and operator settings, delivered as data.

Remote SIM Provisioning#

Profiles reach the chip through the GSMA's Remote SIM Provisioning standard, whose consumer variant is SGP.22. It involves three parties:

• SM-DP+: the carrier's profile server, here a Telekom server. It prepares and encrypts your profile and waits for a device to collect it.
• LPA (Local Profile Assistant): software built into iOS and Android that talks to the SM-DP+ and drives the download.
• SM-DS (Discovery Server): optional. It lets an eSIM set itself up during device setup without a QR code.

The activation code has a fixed shape, LPA:1$<SM-DP+ address>$<matching ID>, which tells the LPA to ask this server for the profile filed under this matching ID. The eUICC and the SM-DP+ then authenticate each other with their GSMA-rooted certificates. The server binds the profile to your EID and sends an encrypted Bound Profile Package that only your chip can decrypt, and the chip installs and enables it.

Decompiling the app#

The congstar app is a normal Play Store download, so no phone is needed. I fetched version 6.14.1 with apkeep and turned its Dalvik bytecode back into Java with jadx.

apkeep -a de.congstar.meincongstar .
unzip -o de.congstar.meincongstar.xapk -d xapk
jadx -d out xapk/de.congstar.meincongstar.apk
grep -rniE 'LPA:1\$|EuiccManager|smdpAddress|activationCode' out/sources

The search turns up a data model with smdpAddress and activationCode fields, a screen for typing those two values by hand, a copy-to-clipboard handler and Android's system eSIM class. All of it is SGP.22 vocabulary.

What the code shows#

The app fetches one JSON object from the carrier's backend, ESimDto, whose fields are the standard eSIM values:

// returned by GET  app.congstar.de/congstar-rest-service/app/v13/customers/{id}/contracts/{id}/esim
ESimDto {
  activationCode    // the matching ID  (the per-profile one-time secret)
  smdpAddress       // the SM-DP+ server that is holding your profile
  qrCode            // optional: a pre-rendered QR image (base64 PNG)
  activationUrl     // the LPA:1$...  universal link
  status, eSIMSupported, legitimation, cscUrl, links, ...
}

To show a QR code for another device, it builds a single string:

sb.append("LPA:1$" + smdpAddress + "$" + matchingId);

That string is the eSIM QR code. The app draws it, shows the backend's pre-rendered qrCode image, or lists the two values as copyable text, and it holds no cryptography or device binding of its own. Even installing "on this device" is handed off: on Android the app uses the system eSIM class only to ask whether the phone supports eSIM, and it never calls downloadSubscription() or forActivationCode().

Object systemService = application.getSystemService("euicc");
EuiccManager euiccManager = systemService instanceof EuiccManager
        ? (EuiccManager) systemService : null;
boolean eSIMSupported = euiccManager != null && euiccManager.isEnabled();

What the app is still needed for#

The eSIM standard does not need the app. Once you have the SM-DP+ address and the matching ID, the phone does the rest. The carrier has, however, chosen to show the code only in the app, and its old web page for activating without it looks abandoned. You need the app once, on any phone, to see the code, but not to use it.

Setting up an iPhone without the app#

1. In the carrier app on any phone, open the eSIM screen and choose "activate on another device". It shows a QR code, and behind it the SM-DP+ address and the activation code as plain text.
2. On the iPhone, open Settings → Mobile Data → Add eSIM → Use QR Code and scan it. The iOS LPA contacts the SM-DP+ and downloads the profile.
3. To skip the camera, tap Enter Details Manually and type the SM-DP+ address and the activation code instead. The result is the same.

This is the manual path that SGP.22 itself provides; the carrier app only wraps it in a login and an SMS code.

How it went in practice#

On my own new line, the eSIM installed in seconds. Getting into the app was harder. With no web path left, I had to use it, and the login sent an SMS code to my old number, which only my old phone could receive. For a moment, the new line depended on the one it was meant to replace.

An eSIM is a profile bound to one chip, sent by a certified server and installed by the phone. The carrier app is closer to a clerk who reads out a ticket number. When a carrier says its app is the only way to do something, it is worth asking which standard sits underneath. With eSIM, the standard does all the work.