App Signing
Keys and Play App Signing.
App Signing is a free Android Academy lesson on CoddyKit — lesson 2 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Android Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
Why Apps Must Be Signed
Android will not install an app unless it is digitally signed. The signature proves two things: who published the app, and that the APK has not been tampered with since.
Crucially, signatures tie updates to the original app. An update is only accepted if it is signed with the same key as the installed version. Lose that key and you can no longer update your app — ever.
This lesson covers keystores, signing config, and Google's safer modern approach: Play App Signing.
Keystores and Keys
Your signing identity lives in a keystore file (.jks or .keystore). A keystore can hold multiple keys; each key has an alias and its own password.
- Keystore password — unlocks the file.
- Key alias — names the key inside it.
- Key password — unlocks that specific key.
The debug builds you run daily are signed automatically with a throwaway debug keystore. For release you need your own.
Creating a Keystore
You can create a keystore from the Android Studio dialog, or with the keytool command that ships with the JDK.
Use a long validity (25+ years) — if the key expires you cannot publish updates. RSA 2048 is the standard.
keytool -genkeypair \
-v \
-keystore release.jks \
-alias upload \
-keyalg RSA \
-keysize 2048 \
-validity 10000The signingConfigs Block
To sign automatically during a Gradle build, declare a signingConfigs entry and attach it to the release build type.
This works, but notice the passwords are right there in the build file — we will fix that next.
android {
signingConfigs {
create("release") {
storeFile = file("release.jks")
storePassword = "superSecret"
keyAlias = "upload"
keyPassword = "superSecret"
}
}
buildTypes {
release {
signingConfig = signingConfigs.getByName("release")
isMinifyEnabled = true
}
}
}Keep Secrets Out of Git
Never commit passwords or the keystore to version control. Read them from a local, git-ignored keystore.properties file instead.
Add keystore.properties and *.jks to .gitignore.
// top of app/build.gradle.kts
val keystoreProps = Properties().apply {
val f = rootProject.file("keystore.properties")
if (f.exists()) load(f.inputStream())
}
android {
signingConfigs {
create("release") {
storeFile = file(keystoreProps["storeFile"] as String)
storePassword = keystoreProps["storePassword"] as String
keyAlias = keystoreProps["keyAlias"] as String
keyPassword = keystoreProps["keyPassword"] as String
}
}
}The keystore.properties File
The matching properties file is a plain key=value list, kept out of git and stored safely (a password manager or CI secret store).
On a CI server you would inject these as environment-backed secrets rather than a checked-in file.
# keystore.properties (git-ignored!)
storeFile=release.jks
storePassword=superSecret
keyAlias=upload
keyPassword=superSecretPlay App Signing
Modern Play uses Play App Signing. Here Google holds the real app signing key in its secure infrastructure and uses it to sign the APKs delivered to users.
You only manage an upload key: you sign your bundle with it and upload. Play verifies your upload key, strips it, and re-signs with the app signing key.
The big win: if you ever lose your upload key, you can request a reset — but the app signing key (the one users trust) stays safe with Google.
Upload Key vs App Signing Key
Two keys, two jobs — do not confuse them:
- Upload key — yours. Signs the AAB you upload. Resettable if lost.
- App signing key — Google's (or one you uploaded once). Signs the final APKs users install. Permanent.
When you enroll a new app, the simplest path is to let Google generate the app signing key, and you sign uploads with your upload key.
Verifying a Signature
To confirm how an artifact is signed, use apksigner from the Android SDK build-tools. It reports the signing certificate and which signature schemes (v1/v2/v3) are present.
Comparing the certificate's SHA-256 fingerprint is also how you register your app with services like Firebase or Google Sign-In.
# Verify and print signer certificates of an APK
apksigner verify --print-certs app-release.apk
# Show the SHA-256 fingerprint of a keystore key
keytool -list -v -keystore release.jks -alias uploadProtecting Your Keys
Your upload key is hard to replace and your app signing key (if self-managed) is irreplaceable. Treat them like crown jewels:
- Back up the keystore in at least two secure locations.
- Store passwords in a password manager, never in source.
- Use Play App Signing so a lost upload key is recoverable.
- Limit who on the team can access the keystore.
Many published apps have been abandoned simply because the developer lost the key and could no longer ship updates.
Putting It Together
The full release-signing flow looks like this:
- Create an upload keystore with
keytool. - Wire it into
signingConfigs, reading secrets fromkeystore.properties. - Build a signed
.aabwith./gradlew bundleRelease. - Upload to Play, which re-signs with the app signing key before delivering to users.
From now on, every update must be signed with that same upload key.
Quick Check
With Play App Signing enabled, which key do you use to sign the bundle you upload, and what happens if you lose it?
Recap: App Signing
Signing is what makes an Android app installable and updatable:
- A keystore holds keys; each key has an alias and passwords.
- Create a long-validity key with
keytooland wire it intosigningConfigs. - Keep passwords out of git via
keystore.propertiesand.gitignore. - Play App Signing splits keys into your resettable upload key and Google's permanent app signing key.
- Back up keys carefully — a lost key can end an app's life.
Next: setting up the Play Console and your store listing.
Frequently asked questions
Is the “App Signing” lesson free?
Yes — the full text of “App Signing” is free to read here on the web, and the Android Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Android Academy course, upgrade to CoddyKit PRO.
What will I learn in “App Signing”?
Keys and Play App Signing. You practise Android Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start Android Academy?
No prior experience is required. Android Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 2 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “App Signing” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this Android Academy lesson?
Yes. Every Android Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.