Google Play App Signing Explained: Keys to Protect
Upload key vs app signing key in plain language, what to keep safe and how to recover from a lost key.
Read the guide →
Google Play no longer takes APK files for new apps. It wants an Android App Bundle, a file ending in .aab. If you have only ever built APKs, the switch can feel confusing: where do you click, what is a keystore, and why does Play Console say your file is not signed correctly? This guide walks you through creating an AAB file for Google Play from start to finish, with the checks that prevent the most common upload errors.
An Android App Bundle is a publishing format. It contains all your compiled code and resources, but Google Play builds and signs the optimized APKs that reach each user's phone. Google's app bundle documentation explains the benefit: only the code and resources a device needs are downloaded, so users get smaller downloads and you do not manage many APKs yourself.
| AAB (app bundle) | APK | |
|---|---|---|
| Purpose | Upload to Google Play | Install directly on a device |
| Who builds the final APKs | Google Play | You |
| Required for new apps on Google Play | Yes (since August 2021) | No |
| Installable on a phone by itself | No. Use bundletool or Google Play. | Yes |
| Typical download size for users | Smaller, device-specific | Larger if one universal APK |
Google's versioning documentation is clear on the rule: you cannot upload with a versionCode you have already used, and the greatest value Google Play allows is 2100000000. A simple habit is to add 1 for every upload, even for test builds.
android {
defaultConfig {
applicationId = "com.yourname.myapp"
versionCode = 1
versionName = "1.0"
}
}
Menu names change between Android Studio versions, so if yours looks different, search the Build menu for the signed bundle option.
From a terminal in the project folder you can build the bundle without opening the signing wizard, once signing is configured. Google's command-line build page describes the pattern: bundle followed by the variant name. For a release build in a standard single-module app:
./gradlew bundleRelease
On Windows use gradlew instead of ./gradlew. To sign the release build automatically, define a signingConfigs block and assign it to the release build type. Keep the passwords out of the file you commit: read them from a local properties file or environment variables instead. Google's page also warns that passwords written into a build file are visible to anyone who can read it.
| Command or tool | Use it for |
|---|---|
| ./gradlew bundleRelease | Build a release app bundle |
| ./gradlew bundleDebug | Build a debug bundle for your own testing, never for Play |
| keytool -genkey ... -keyalg RSA -keysize 2048 | Create an upload keystore (RSA, at least 2048 bits) |
| jarsigner | Sign a bundle manually. Google says apksigner cannot sign app bundles. |
| bundletool | Generate APKs from a bundle to install on a device |
The notification after the build includes a locate link. In a standard project, release bundles are normally written under app/build/outputs/bundle/release/. Google's page does not document that path, so trust the locate link if yours is different.
Because a bundle cannot be installed on its own, test it one of two ways:
If this is your first app, your next step is the closed test. Read how to get 12 testers and how to add testers in Play Console.
| Message or symptom | Likely cause | Fix |
|---|---|---|
| Version code already used | You reused a versionCode | Increase versionCode and rebuild |
| Version code too high | Value above 2100000000 | Use a smaller number |
| Signed with the wrong key | A different keystore than the one registered as your upload key | Use the original keystore, or request an upload key reset. See Play App Signing |
| Upload a bundle, not an APK | You uploaded an .apk | Build with Generate Signed App Bundle or bundleRelease |
| Bundle is not signed or debuggable | A debug variant was built | Build the release variant |
| Target API level warning | Your targetSdk is below Google's current requirement | Raise targetSdk to the level Play Console names |
| Bundle too large | Compressed download exceeds the limit | Use Play Feature Delivery or Play Asset Delivery, remove unused resources |
Not for new apps. The Android Developers documentation says that since August 2021 new apps must be published with an Android App Bundle on Google Play. An APK is still useful for sharing a build directly with a device.
Android Studio shows a notification with a locate link when the build finishes. In a standard project the release bundle is normally under app/build/outputs/bundle/release/. Google's page does not state this path, so use the locate link if yours differs.
Not directly. Google says an app bundle cannot be installed on a device on its own. Use bundletool to generate APKs from it, or upload it to an internal test and install from Google Play.
Android Studio signs it for you. If you sign manually, Google says to use jarsigner for bundles, because apksigner works only for APKs.
Google says the compressed APKs that must be downloaded to install your app (base plus configuration APKs) must total no more than 4 GB. New apps over 200 MB are supported through Play Feature Delivery or Play Asset Delivery.
Each upload needs a higher versionCode than any you have used. The highest value Google Play allows is 2100000000.