Understand Android app bundles and signing keys

You’re ready to upload your Android app, and Play is asking for a signed bundle. For a new app, that’s an Android App Bundle, usually an .aab file. There are two keys to keep track of: you sign the upload with your upload key, and Google signs the APKs people install with your app-signing key.

Set up the app’s identity

Choose the permanent package name and confirm which developer account will publish the app. Keep the signing files and recovery details somewhere secure that the app’s owner can access. If you plan to use several stores, decide whether they need the same signing identity before you set it up.

1. Create the app record in Play Console and start a release in the testing track you intend to use.
2. Set up Play App Signing. Google offers several ways to configure the keys; use the one that works with your build service and distribution plans.
3. Sign the bundle with the app’s upload key. Google checks that signature before signing the APKs it delivers to users.
4. Upload the bundle. Check its package name and version, then fix any blocking errors.

Google needs to accept the bundle into the right app and testing release before you continue. For later builds, keep the same app identity and use a valid version code you haven’t used before.

If Play rejects the signing key

Compare the certificate Play expects with your upload certificate. If you’ve lost the upload key, Play App Signing may let you reset it without creating a new app. Losing a self-managed app-signing key is a different problem.

Keep keystores and passwords out of public support posts.