0Pricing
React Native Academy · Lección

Creación de un Keystore y firma del AAB

Genere un keystore de lanzamiento con keytool, configure gradle.properties y build.gradle con la configuración de firma y compile un Android App Bundle firmado con EAS Build.

Creación de un Keystore y firma del AAB es una lección gratuita de React Native Academy en CoddyKit. Esta es la lección 1 de 4. Puedes leer la lección completa abajo gratuitamente — luego la practicas en el navegador con un editor de código integrado y un tutor de IA 24/7. Forma parte de la ruta de aprendizaje de React Native Academy, y tu progreso se sincroniza en la web y la app de CoddyKit. El curso de React Native Academy incluye 4 lecciones en total.

Partes de esta lección aún no han sido traducidas y se muestran en inglés.

Why Android Signing Matters

Every Android app must be digitally signed with a private key before it can be installed or distributed. The signature is embedded in the APK or AAB file and verifies that all future updates to the app come from the same developer. If you lose your keystore, you can never issue an update to that app — you would have to publish an entirely new app with a different package name. Back up your keystore file securely.

What Is a Keystore File

A keystore is a binary file (typically .jks or .keystore) that stores one or more cryptographic key pairs. It is protected by two passwords: a store password (protects the file) and a key password (protects the individual key alias inside). Think of it like a password-protected vault containing your signing identity. Android uses a key inside this vault to sign your APK or AAB.

APK vs AAB: Which to Use

Google Play now requires Android App Bundles (AAB) for new apps (since August 2021). An AAB is smaller than an APK because it contains resources for all device configurations and lets Google Play build a device-specific APK for each user. This reduces download size by 15–50%. Local testing and side-loading still use APKs. Build AAB for Play Store submissions and APK only for direct installation or internal testing outside Play.

// eas.json — build AAB for production
{
  'build': {
    'production': {
      'android': {
        'buildType': 'app-bundle'  // produces .aab
      }
    },
    'preview': {
      'android': {
        'buildType': 'apk'  // produces .apk for side-loading
      }
    }
  }
}

Generating a Keystore with keytool

Java's keytool utility generates keystores. The key parameters are: -genkeypair to generate a new key pair, -keystore for the output filename, -alias for the key alias (a name for the key inside the keystore), -validity for how many days the certificate is valid (25 years = 9125 days is typical for app signing), and -keyalg RSA -keysize 2048 for the cryptographic algorithm.

# Generate a release keystore
keytool -genkeypair \
  -keystore myapp-release-key.jks \
  -alias myapp-key \
  -keyalg RSA \
  -keysize 2048 \
  -validity 9125 \
  -storepass yourStorePassword \
  -keypass yourKeyPassword

# You'll be prompted for:
# First and last name:
# Organizational unit:
# Organization:
# City or locality:
# State or province:
# Two-letter country code (e.g., US):
# Then type 'yes' to confirm

EAS Auto-Generated Keystore

EAS Build can generate and securely store a keystore for you automatically. When you first run a production Android build, EAS prompts you to generate a new keystore or upload an existing one. If you let EAS generate it, the keystore is stored encrypted in EAS's cloud — you can download it any time via eas credentials --platform android. This is the safest option for teams because no keystore lives on a single developer's laptop.

# Let EAS generate and manage the keystore
eas build --platform android --profile production

# EAS prompts:
# ? Would you like to set up an Android Keystore?
# > Generate new keystore  <- choose this
#
# EAS creates and stores it securely.

# Download your keystore for backup:
eas credentials --platform android
# Select: Download existing keystore

Configuring Manual Signing in build.gradle

If you are using a bare React Native workflow (not managed Expo) and want to sign locally rather than with EAS, configure signing in android/app/build.gradle. Add a signingConfigs block referencing your keystore file and passwords. Store keystore credentials in ~/.gradle/gradle.properties (not in the source code) to keep them out of git history.

// android/app/build.gradle
android {
    signingConfigs {
        release {
            storeFile file(MYAPP_UPLOAD_STORE_FILE)
            storePassword MYAPP_UPLOAD_STORE_PASSWORD
            keyAlias MYAPP_UPLOAD_KEY_ALIAS
            keyPassword MYAPP_UPLOAD_KEY_PASSWORD
        }
    }
    buildTypes {
        release {
            signingConfig signingConfigs.release
            minifyEnabled true
            proguardFiles getDefaultProguardFile('proguard-android.txt')
        }
    }
}

// ~/.gradle/gradle.properties (NOT in git)
// MYAPP_UPLOAD_STORE_FILE=myapp-release-key.jks
// MYAPP_UPLOAD_STORE_PASSWORD=yourStorePassword
// MYAPP_UPLOAD_KEY_ALIAS=myapp-key
// MYAPP_UPLOAD_KEY_PASSWORD=yourKeyPassword

Building the Signed AAB with EAS

Once credentials are set up, trigger the production Android build with EAS. The cloud runner checks out your code, applies config plugins, builds the AAB, signs it with your keystore, and makes it available for download or direct upload to Play Console. Monitor progress with eas build:list or the EAS dashboard. The finished AAB is typically 5–20MB depending on app size.

# Build signed AAB for Play Store
eas build --platform android --profile production

# Watch build progress (or use dashboard URL provided)
eas build:list --platform android --limit 5

# Download the .aab when complete
eas build:download --id <build-id>

# Alternatively: build AND auto-submit to Play Console
eas build --platform android --profile production --auto-submit

Play App Signing: Upgrading Security

Google Play App Signing is a program where Google holds a secondary app signing key. You upload the AAB signed with your upload key (a simpler key you generate), and Google re-signs it with the managed app signing key before delivery to users. The benefit: if your upload key is compromised or lost, Google can issue a new one. Once enrolled, you cannot unenroll, but it is strongly recommended for new apps.

// Play App Signing flow:

// You sign with:     Upload Key (your keystore)
//                          |
//                          v
//              [Upload to Play Console]
//                          |
//              Google re-signs with:
//                   App Signing Key
//                          |
//                          v
//     Device receives:  App signed by Google's key

// Enroll when creating app in Play Console:
// Setup > App Signing > Use Google-managed key

Verifying the AAB Signature

Before uploading to Play Console, verify your AAB is correctly signed using bundletool or apksigner. Inspect the signing certificate SHA-256 fingerprint — this fingerprint is what Google Play expects to match. A mismatch between your upload certificate and what Play Console has on record will cause the upload to be rejected with a signing error.

# Verify keystore details
keytool -list -v -keystore myapp-release-key.jks
# Shows: Certificate fingerprint (SHA-256):
#   AB:CD:EF:... (copy this for your records)

# Check what signed an APK/AAB
apksigner verify --verbose myapp.apk

# Bundletool (download from Google)
bundletool dump manifest --bundle=myapp.aab

Backing Up the Keystore

The keystore backup is critical — treat it like a password or private key. Store it in: a password manager that supports file attachments, an encrypted cloud storage location (not the same git repo), and optionally a hardware security device. Record the store password, key alias, and key password alongside it. Losing the keystore means you can never update the app — you would need to publish under a new package name and lose all your existing users and reviews.

# Keystore backup checklist:

# 1. Store the .jks file in encrypted storage
#    - 1Password, Bitwarden, or similar
#    - Do NOT commit to git

# 2. Record credentials alongside it:
#    Store file:     myapp-release-key.jks
#    Store password: [store securely]
#    Key alias:      myapp-key
#    Key password:   [store securely]

# 3. Test restoration:
#    - Copy backup to a new machine
#    - Run: keytool -list -keystore myapp-release-key.jks
#    - Verify you can list the key alias

# 4. Tell your team where the backup lives

Version Code and Version Name

Android uses two version identifiers: versionCode (an integer, must increment with each Play Store upload) and versionName (the string shown to users, e.g., '1.2.3'). Play Console rejects a build if versionCode is not strictly greater than the last uploaded build. In Expo, set android.versionCode in app.json and increment it for every new build uploaded to Play.

// app.json
{
  'expo': {
    'version': '1.2.3',     // versionName shown to users
    'android': {
      'versionCode': 12,     // must be higher than previous upload
      'package': 'com.yourcompany.myapp'
    }
  }
}

// After submitting to Play Console, before next build:
// Increment versionCode: 12 -> 13
// Update version if user-facing: '1.2.3' -> '1.2.4'

// EAS can auto-increment:
// eas.json: 'autoIncrement': true (in android profile)

Quick Check

Test your understanding of React Native Mobile Development concepts from this lesson.

Lesson Recap

In this lesson you learned: how to generate an Android keystore with keytool or EAS Build, the difference between APK and AAB and why Play Store requires AAB, and how to configure signing in build.gradle for bare workflow projects. You also saw Google Play App Signing and why backing up the keystore is non-negotiable. Next up we set up the Play Console listing.

Preguntas frecuentes

¿La lección «Creación de un Keystore y firma del AAB» es gratis?

Sí — el texto completo de «Creación de un Keystore y firma del AAB» es gratis para leer aquí en la web. Para practicarla de forma interactiva (editor de código integrado y tutor de IA 24/7) y desbloquear el resto del curso de React Native Academy, actualiza a CoddyKit PRO. El curso de React Native Academy incluye 4 lecciones en total.

¿Qué aprenderé en «Creación de un Keystore y firma del AAB»?

Genere un keystore de lanzamiento con keytool, configure gradle.properties y build.gradle con la configuración de firma y compile un Android App Bundle firmado con EAS Build. Practicas React Native Academy con código real que ejecutas directamente en el navegador, y un tutor de IA 24/7 responde tus preguntas mientras trabajas en la lección.

¿Necesito experiencia previa para empezar React Native Academy?

No se requiere experiencia previa. React Native Academy en CoddyKit está estructurado para principiantes hasta estudiantes avanzados, así que puedes empezar aquí o desde el inicio y avanzar a tu ritmo. Esta es la lección 1 de 4.

¿Cuánto tiempo toma la lección «Creación de un Keystore y firma del AAB»?

La mayoría de las lecciones de CoddyKit toman alrededor de 5–10 minutos. Cada una es compacta e interactiva, así que avanzas constantemente y retomas exactamente por donde dejaste en la web y la app.

¿Puedo escribir y ejecutar código en esta lección de React Native Academy?

Sí. Cada lección de React Native Academy incluye un editor de código integrado, así que escribes y ejecutas código real directamente en tu navegador y obtienes retroalimentación instantánea de IA — sin configuración local necesaria.

Todas las lecciones de este curso

  1. Creación de un Keystore y firma del AAB
  2. Configuración de la ficha en Play Console
  3. Clasificaciones de contenido, políticas y privacidad
  4. Pruebas internas, lanzamiento gradual y producción
← Volver a React Native Academy