0Pricing
React Native Academy · Lesson

Creating a Keystore and Signing the AAB

Generate a release keystore with keytool, configure gradle.properties and build.gradle with the signing config, and build a signed Android App Bundle with EAS Build.

Creating a Keystore and Signing the AAB is a free React Native Academy lesson on CoddyKit — lesson 1 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the React Native Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

Why Android Signing Matters

Every Android app must be digitally signed with a private key before it can be installed or distributed. The signature is embedded in the APK or AAB file and verifies that all future updates to the app come from the same developer. If you lose your keystore, you can never issue an update to that app — you would have to publish an entirely new app with a different package name. Back up your keystore file securely.

What Is a Keystore File

A keystore is a binary file (typically .jks or .keystore) that stores one or more cryptographic key pairs. It is protected by two passwords: a store password (protects the file) and a key password (protects the individual key alias inside). Think of it like a password-protected vault containing your signing identity. Android uses a key inside this vault to sign your APK or AAB.

APK vs AAB: Which to Use

Google Play now requires Android App Bundles (AAB) for new apps (since August 2021). An AAB is smaller than an APK because it contains resources for all device configurations and lets Google Play build a device-specific APK for each user. This reduces download size by 15–50%. Local testing and side-loading still use APKs. Build AAB for Play Store submissions and APK only for direct installation or internal testing outside Play.

// eas.json — build AAB for production
{
  'build': {
    'production': {
      'android': {
        'buildType': 'app-bundle'  // produces .aab
      }
    },
    'preview': {
      'android': {
        'buildType': 'apk'  // produces .apk for side-loading
      }
    }
  }
}

Generating a Keystore with keytool

Java's keytool utility generates keystores. The key parameters are: -genkeypair to generate a new key pair, -keystore for the output filename, -alias for the key alias (a name for the key inside the keystore), -validity for how many days the certificate is valid (25 years = 9125 days is typical for app signing), and -keyalg RSA -keysize 2048 for the cryptographic algorithm.

# Generate a release keystore
keytool -genkeypair \
  -keystore myapp-release-key.jks \
  -alias myapp-key \
  -keyalg RSA \
  -keysize 2048 \
  -validity 9125 \
  -storepass yourStorePassword \
  -keypass yourKeyPassword

# You'll be prompted for:
# First and last name:
# Organizational unit:
# Organization:
# City or locality:
# State or province:
# Two-letter country code (e.g., US):
# Then type 'yes' to confirm

EAS Auto-Generated Keystore

EAS Build can generate and securely store a keystore for you automatically. When you first run a production Android build, EAS prompts you to generate a new keystore or upload an existing one. If you let EAS generate it, the keystore is stored encrypted in EAS's cloud — you can download it any time via eas credentials --platform android. This is the safest option for teams because no keystore lives on a single developer's laptop.

# Let EAS generate and manage the keystore
eas build --platform android --profile production

# EAS prompts:
# ? Would you like to set up an Android Keystore?
# > Generate new keystore  <- choose this
#
# EAS creates and stores it securely.

# Download your keystore for backup:
eas credentials --platform android
# Select: Download existing keystore

Configuring Manual Signing in build.gradle

If you are using a bare React Native workflow (not managed Expo) and want to sign locally rather than with EAS, configure signing in android/app/build.gradle. Add a signingConfigs block referencing your keystore file and passwords. Store keystore credentials in ~/.gradle/gradle.properties (not in the source code) to keep them out of git history.

// android/app/build.gradle
android {
    signingConfigs {
        release {
            storeFile file(MYAPP_UPLOAD_STORE_FILE)
            storePassword MYAPP_UPLOAD_STORE_PASSWORD
            keyAlias MYAPP_UPLOAD_KEY_ALIAS
            keyPassword MYAPP_UPLOAD_KEY_PASSWORD
        }
    }
    buildTypes {
        release {
            signingConfig signingConfigs.release
            minifyEnabled true
            proguardFiles getDefaultProguardFile('proguard-android.txt')
        }
    }
}

// ~/.gradle/gradle.properties (NOT in git)
// MYAPP_UPLOAD_STORE_FILE=myapp-release-key.jks
// MYAPP_UPLOAD_STORE_PASSWORD=yourStorePassword
// MYAPP_UPLOAD_KEY_ALIAS=myapp-key
// MYAPP_UPLOAD_KEY_PASSWORD=yourKeyPassword

Building the Signed AAB with EAS

Once credentials are set up, trigger the production Android build with EAS. The cloud runner checks out your code, applies config plugins, builds the AAB, signs it with your keystore, and makes it available for download or direct upload to Play Console. Monitor progress with eas build:list or the EAS dashboard. The finished AAB is typically 5–20MB depending on app size.

# Build signed AAB for Play Store
eas build --platform android --profile production

# Watch build progress (or use dashboard URL provided)
eas build:list --platform android --limit 5

# Download the .aab when complete
eas build:download --id <build-id>

# Alternatively: build AND auto-submit to Play Console
eas build --platform android --profile production --auto-submit

Play App Signing: Upgrading Security

Google Play App Signing is a program where Google holds a secondary app signing key. You upload the AAB signed with your upload key (a simpler key you generate), and Google re-signs it with the managed app signing key before delivery to users. The benefit: if your upload key is compromised or lost, Google can issue a new one. Once enrolled, you cannot unenroll, but it is strongly recommended for new apps.

// Play App Signing flow:

// You sign with:     Upload Key (your keystore)
//                          |
//                          v
//              [Upload to Play Console]
//                          |
//              Google re-signs with:
//                   App Signing Key
//                          |
//                          v
//     Device receives:  App signed by Google's key

// Enroll when creating app in Play Console:
// Setup > App Signing > Use Google-managed key

Verifying the AAB Signature

Before uploading to Play Console, verify your AAB is correctly signed using bundletool or apksigner. Inspect the signing certificate SHA-256 fingerprint — this fingerprint is what Google Play expects to match. A mismatch between your upload certificate and what Play Console has on record will cause the upload to be rejected with a signing error.

# Verify keystore details
keytool -list -v -keystore myapp-release-key.jks
# Shows: Certificate fingerprint (SHA-256):
#   AB:CD:EF:... (copy this for your records)

# Check what signed an APK/AAB
apksigner verify --verbose myapp.apk

# Bundletool (download from Google)
bundletool dump manifest --bundle=myapp.aab

Backing Up the Keystore

The keystore backup is critical — treat it like a password or private key. Store it in: a password manager that supports file attachments, an encrypted cloud storage location (not the same git repo), and optionally a hardware security device. Record the store password, key alias, and key password alongside it. Losing the keystore means you can never update the app — you would need to publish under a new package name and lose all your existing users and reviews.

# Keystore backup checklist:

# 1. Store the .jks file in encrypted storage
#    - 1Password, Bitwarden, or similar
#    - Do NOT commit to git

# 2. Record credentials alongside it:
#    Store file:     myapp-release-key.jks
#    Store password: [store securely]
#    Key alias:      myapp-key
#    Key password:   [store securely]

# 3. Test restoration:
#    - Copy backup to a new machine
#    - Run: keytool -list -keystore myapp-release-key.jks
#    - Verify you can list the key alias

# 4. Tell your team where the backup lives

Version Code and Version Name

Android uses two version identifiers: versionCode (an integer, must increment with each Play Store upload) and versionName (the string shown to users, e.g., '1.2.3'). Play Console rejects a build if versionCode is not strictly greater than the last uploaded build. In Expo, set android.versionCode in app.json and increment it for every new build uploaded to Play.

// app.json
{
  'expo': {
    'version': '1.2.3',     // versionName shown to users
    'android': {
      'versionCode': 12,     // must be higher than previous upload
      'package': 'com.yourcompany.myapp'
    }
  }
}

// After submitting to Play Console, before next build:
// Increment versionCode: 12 -> 13
// Update version if user-facing: '1.2.3' -> '1.2.4'

// EAS can auto-increment:
// eas.json: 'autoIncrement': true (in android profile)

Quick Check

Test your understanding of React Native Mobile Development concepts from this lesson.

Lesson Recap

In this lesson you learned: how to generate an Android keystore with keytool or EAS Build, the difference between APK and AAB and why Play Store requires AAB, and how to configure signing in build.gradle for bare workflow projects. You also saw Google Play App Signing and why backing up the keystore is non-negotiable. Next up we set up the Play Console listing.

Frequently asked questions

Is the “Creating a Keystore and Signing the AAB” lesson free?

Yes — the full text of “Creating a Keystore and Signing the AAB” is free to read here on the web, and the React Native Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the React Native Academy course, upgrade to CoddyKit PRO.

What will I learn in “Creating a Keystore and Signing the AAB”?

Generate a release keystore with keytool, configure gradle.properties and build.gradle with the signing config, and build a signed Android App Bundle with EAS Build. You practise React Native Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start React Native Academy?

No prior experience is required. React Native Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 1 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “Creating a Keystore and Signing the AAB” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this React Native Academy lesson?

Yes. Every React Native Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

  1. Creating a Keystore and Signing the AAB
  2. Setting Up the Play Console Listing
  3. Content Ratings, Policies, and Privacy
  4. Internal Testing, Staged Rollout, and Production
← Back to React Native Academy