Play App Signing explained for first-time publishers

Play App Signing means Google holds the key that signs the APKs delivered to users' devices, while you sign your uploads with a separate upload key that you keep. For new apps it isn't optional: Google says that when you publish to Google Play for the first time, "you must also configure Play App Signing." The practical upside is that a lost upload key can be reset, instead of locking you out of your own app.

This article explains the two keys, the choices you make on your first upload, and what to keep safe.

Two keys, two jobs

Google's app signing documentation describes two keys.

The app signing key

• Signs the APKs that are actually installed on users' devices.
• Never changes for the lifetime of the app. Android uses it to check that an update comes from the same developer as the installed version.
• With Play App Signing, Google stores it and uses it to sign the APKs it generates from your bundle.

The upload key

• The key you use to sign your app bundle before uploading it to Play Console.
• You keep it, and you must keep it secret.
• Google checks your upload against it, then re-signs the delivered APKs with the app signing key.

In short: the app signing key is about users' devices; the upload key is about you proving to Google that an upload is yours.

Why it's required for new apps

Two changes go together. Google says: "From August 2021, new apps are required to publish with the Android App Bundle" (About Android App Bundles). Because Google Play builds optimized APKs for each device from your bundle, it needs to sign those APKs itself. Play App Signing is required for apps created since August 2021. Only apps created before August 2021 may still distribute self-signed APKs.

So if you're publishing your first app now, you'll set up Play App Signing as part of your first upload. Our walkthrough of uploading your first AAB shows where it fits in that flow.

Your choices on the first upload

When you create your first release, Play Console asks how to handle the app signing key. According to Google's documentation, the options are:

1. Let Google generate the app signing key. No extra action needed. The key you signed your bundle with becomes your upload key. This is the simplest choice for most new developers.
2. Use the same key as another of your apps. Useful if you publish several apps that need to share a signing identity.
3. Export and upload your own app signing key. For developers who already have a key they must keep, for example because the app was distributed elsewhere before.

If you supply your own app signing key, Google recommends generating a separate upload key for future updates, so the app signing key itself never has to leave safe storage again.

If you have no special reason, choose option 1.

Creating the upload key

In Android Studio, Build > Generate Signed Bundle / APK, choose Android App Bundle, and create a new keystore. Google's advice on keys:

• Use strong passwords for both the keystore and the key.
• Set a validity of at least 25 years. Google Play requires the validity to end after 22 October 2033.
• Keep the keystore file somewhere safe and never share the private key.
• If you work in a team or share code, keep signing information out of your build files and store it separately.

What to back up

Your upload keystore is the one signing asset you're responsible for. Back up:

• the keystore file (.jks or .keystore)
• the keystore password
• the key alias
• the key password

Keep at least two copies in different places, such as an encrypted password manager plus an offline backup. Don't commit the keystore or its passwords to a public repository.

If you lose your upload key

This is where Play App Signing pays off. If your upload key is lost or compromised, you can request an upload key reset in Play Console. Google keeps the app signing key, so your app's identity on users' devices doesn't change, and you can continue uploading updates with a new upload key.

Without Play App Signing, losing the app signing key would mean you could no longer update the app. With it, a lost upload key is an inconvenience, not a dead end.

Certificate fingerprints for Firebase and Google Sign-In

A common surprise after the first upload: Google Sign-In, Firebase or a maps API works in your local build but fails in the version testers install from Google Play.

The reason is that the installed app is now signed with the app signing key, not your upload key. APIs that check your app's certificate need the app signing key's fingerprint as well.

1. In Play Console, open your app's App signing page (in the release setup section; Google's documentation lists it under Release > Setup > App signing, though menu names change over time).
2. Copy the SHA-1 or SHA-256 fingerprint of the app signing key certificate.
3. Add it to your Firebase project or API console, alongside your package name.

Your upload key's fingerprint can stay there too, for local and internal builds.

This is worth checking before your closed test starts. A login button that fails for every tester on day one costs you engagement you can't easily get back. More on that in giving testers and reviewers access.

Quick checklist

• Signed release AAB, not a debug build
• Play App Signing configured on the first upload (Google-generated key is fine for most apps)
• Upload keystore, alias and passwords backed up in two places
• App signing certificate fingerprint added to Firebase and other APIs
• Sign-in tested from the Play-installed build, not just a local build

These fit alongside the other day-zero items in our closed testing checklist. Once your first release is uploaded, the next step is the track itself; see creating a closed testing track.

Key takeaways

• Play App Signing is required for new apps; Google holds the app signing key.
• You keep the upload key and sign every bundle with it.
• A lost upload key can be reset in Play Console.
• APIs that check certificates need the app signing key's fingerprint from Play Console.

When your signed build is on the closed track, you'll need 12 or more testers opted in for 14 continuous days. GoPlayTester provides real testers on real devices; see our setup guide or order here.