How to Create an AAB File for Google Play (Android Studio)
Step by step: generate a signed Android App Bundle in Android Studio or with Gradle, then upload it to Play Console.
Read the guide →Google Play App Signing Explained: Keys to Protect
Quick answer Google Play app signing means Google holds the app signing key that signs what users download, while you keep an upload key to sign each bundle. Back up the upload keystore and passwords, and use 2-Step Verification.
Every Android app is signed with a key, and that key is what proves updates really come from you. Lose it and, in the old days, you could lose the ability to ever update your app. Google Play App Signing was built to remove that risk, but it also introduced two keys, two sets of passwords and a lot of confusing words. This guide explains Google Play app signing in plain language, shows exactly what Google keeps and what you must protect, and tells you how to recover if something goes wrong.
What is Google Play app signing?
Android requires every app to be digitally signed. The signature lets the phone check that an update comes from the same developer as the version already installed. According to Google's Play App Signing help page, Google manages and protects your app signing key on the same secure infrastructure it uses for its own keys, protected by Google's Key Management Service. Because Google signs the optimized APKs it creates from your bundle, enrolling also unlocks services such as automatic protection and automatic string translation.
What is the difference between the upload key and the app signing key?
| Upload key | App signing key | |
|---|---|---|
| Who holds it | You | Google (or your own key, imported) |
| What it signs | The app bundle you upload | The final APKs delivered to users |
| Purpose | Proves to Google that an upload is yours | Proves to phones that an update is from the same developer |
| Format | Java keystore (.jks), RSA of at least 2048 bits | Generated by Google as RSA 4096-bit |
| Can it be reset? | Yes, by request in Play Console | Held by Google. If you manage your own outside Play App Signing, no. |
Think of it this way: the upload key is your front door key to Play Console. The app signing key is the seal Google applies to every package it sends out. If someone steals your upload key, Google can issue you a new one. They still cannot publish as you without access to your Play Console account, which is why account security matters just as much.
What must you keep safe?
| Item | Why it matters | How to protect it |
|---|---|---|
| Upload keystore (.jks) | Needed to sign every bundle you upload | Back up in two places, never in a public repository |
| Keystore password and key password | Without them the keystore is useless | Use a password manager |
| Key alias | Needed when signing | Write it next to the keystore backup |
| Play Console account access | Anyone with access can upload and release | Turn on 2-Step Verification for all users, as Google recommends |
| Your Google account recovery options | Protects against lockout | Keep recovery phone and email current |
Why this matters: Google's page states that a signing key you manage yourself, without Play App Signing, cannot be reset if you lose it. That risk is the main reason to let Google hold the app signing key.
How does enrollment work for a new app?
Google says that when you upload an app bundle, your app is automatically enrolled with Google-generated keys, and that the enrollment uses quantum-ready, hybrid signing. Before a release rolls out to open testing or production you can optionally change the app signing key. When you create your first release you can choose between a Google-generated key and your own.
- Build a signed bundleSign it with your upload key. See how to create an AAB file.
- Create your first releaseIn Play Console upload the bundle to a track.
- Choose the signing optionThe default is a Google-generated app signing key.
- Finish the releasePlay stores the upload certificate and uses the app signing key for the APKs it delivers.
- Back up the upload keystoreDo it now, before you forget.
How do you reset a lost or compromised upload key?
Google describes the process like this. You will need Android Studio or keytool and access to Play Console as an account owner or admin.
- Create a new upload keyGenerate a new keystore in Android Studio.
- Export its certificateExport it in PEM format: keytool -export -rfc -keystore upload-keystore.jks -alias upload -file upload_certificate.pem
- Open the reset pageIn Play Console go to Protected with Play > Play Store protection > Manage Play app signing.
- Request the resetIn the Upload key certificate section click Request upload key reset, enter a reason, upload the PEM file and click Request.
- Wait for confirmationGoogle handles the request. Then sign future bundles with the new key.
Menu names change, so if yours differs, look for the app signing section for your app. Allow time for the reset before a planned release, because Google does not give a guaranteed time we could verify.
Should you use your own signing key?
Most new developers should accept the Google-generated key. You might import your own if you are moving an app that already has users and must keep its existing signature, or if your company policy requires it. Google says you can provide your own key when you create your first release. Remember that once an app is in production, the signing identity matters for every update.
Backup checklist
- Keystore file copied to two separate, secure locations.
- Passwords and alias stored in a password manager.
- 2-Step Verification enabled for every Play Console user.
- A written note of who owns the Play Console account and recovery email.
- Your SHA-1 and SHA-256 certificates noted in case a service (for example Firebase or an API key) asks for them. Use the values shown for your app signing key in Play Console, because that is what users' devices see.
- Keystore never committed to a public code repository.
Signing problems often surface at upload time. See how to fix AAB upload errors and, if your account itself is at risk, what to do if your developer account is terminated.
Part of a series: this article is one chapter of Google Play Closed Testing: The Complete Guide. Start there for the full roadmap from setup to production.
Sources
What do you do in common key problems?
| Problem | What to do |
|---|---|
| I lost my upload keystore | Create a new upload key and request an upload key reset in Play Console |
| I forgot the keystore password | Passwords cannot be recovered. Treat the key as lost and request a reset. |
| Someone else may have my keystore | Treat the upload key as compromised and request a reset, then review Play Console access |
| Play Console rejects my bundle because of the signature | You signed with a key that is not registered as your upload key. Use the correct keystore or request a reset. |
| I want to move the app to another developer account | Check Google's current transfer rules before you start, and keep both keys safe |
Frequently asked questions
What is the difference between the upload key and the app signing key?
The upload key is the one you keep. You sign your bundle with it before uploading, and Google uses it to verify it is you. The app signing key is the one Google holds and uses to sign the final APKs that reach users.
What happens if I lose my upload key?
With Play App Signing, Google says an upload key that is lost or compromised can be reset. You create a new key, export its certificate and send a reset request in Play Console.
Can I lose my app and its users if I lose a key?
Google says a signing key you manage yourself, outside Play App Signing, cannot be reset if you lose it. With Play App Signing the app signing key is held by Google, which is the main reason to use it.
Is Play App Signing required?
New apps are enrolled by default when you upload an app bundle. Google's page does not describe a way for new bundle-based apps to skip it, so plan to use it.
Should the two keys be the same?
Google recommends that the upload key and the app signing key be different.
What should I back up?
Your upload keystore file, its alias and both passwords, stored in at least two separate safe places, plus recovery access for your Google account and Play Console.
