Android App Signing and Upload Keys Explained

Android uses signatures to verify that an update comes from the same developer as the installed app. Before Play App Signing, losing your one keystore meant you could never update your app again. Today the model separates responsibilities between two keys, and that makes it much safer.

Two keys, two jobs

Creating an upload key

In Android Studio, use Build → Generate Signed Bundle / APK and create a new keystore, or use keytool:

keytool -genkeypair -v -keystore upload-keystore.jks -alias upload \
  -keyalg RSA -keysize 4096 -validity 10000
# Store the .jks and passwords in a password manager / secrets vault, NOT in Git.

Signing in Gradle without committing secrets

android {
    signingConfigs {
        create("release") {
            val props = rootProject.file("keystore.properties")
            if (props.exists()) {
                val p = java.util.Properties().apply { load(props.inputStream()) }
                storeFile = file(p.getProperty("storeFile"))
                storePassword = p.getProperty("storePassword")
                keyAlias = p.getProperty("keyAlias")
                keyPassword = p.getProperty("keyPassword")
            }
        }
    }
    buildTypes { release { signingConfig = signingConfigs.getByName("release") } }
}
// keystore.properties is listed in .gitignore. CI uses environment variables instead.

For CI, see CI/CD with GitHub Actions.

SHA fingerprints: the classic sign-in bug

Many APIs (Google Sign-In / Credential Manager, Firebase, Maps key restrictions, App Links) need your certificate's SHA-1 or SHA-256 fingerprint. With Play App Signing, production installs are signed by Google's app signing key, so register that fingerprint (found in Play Console → App integrity), plus your upload key and debug key fingerprints for other builds.

./gradlew signingReport          # debug and configured release fingerprints
keytool -list -v -keystore upload-keystore.jks -alias upload

If you lose the upload key

1. Generate a new upload key and export its certificate.
2. Request an upload key reset in the Play Console. The account owner submits it.
3. After approval, sign uploads with the new key, and update CI secrets.

Key rotation

Play supports upgrading the app signing key for new installs and updates on supported Android versions, using APK Signature Scheme v3 rotation. This is an advanced operation. Read Google's guidance carefully, and update every fingerprint-dependent integration afterwards.

Scenarios

Frequently asked questions

Conclusion

With Play App Signing, Google protects the app signing key, and you manage a replaceable upload key. Keep keystores and passwords out of Git, register the right SHA fingerprints, and store signing material in a shared vault and CI.

Next step: finish your release checklist with How to Prepare an Android App for Production.