0Pricing
React Native Academy · Leçon

Créer un keystore et signer l'AAB

Générez un keystore de publication avec keytool, configurez gradle.properties et build.gradle avec la configuration de signature, puis créez un Android App Bundle signé avec EAS Build.

Créer un keystore et signer l'AAB est une leçon React Native Academy gratuite sur CoddyKit. Ceci est la leçon 1 sur 4. Tu peux lire la leçon complète ci-dessous gratuitement — puis la pratiquer en direct dans le navigateur avec un éditeur de code intégré et un tuteur IA 24/7. Elle fait partie du parcours d'apprentissage React Native Academy, et ta progression se synchronise sur le web et l'application CoddyKit. Le cours React Native Academy comprend 4 leçons au total.

Certaines parties de cette leçon n'ont pas encore été traduites et s'affichent en anglais.

Why Android Signing Matters

Every Android app must be digitally signed with a private key before it can be installed or distributed. The signature is embedded in the APK or AAB file and verifies that all future updates to the app come from the same developer. If you lose your keystore, you can never issue an update to that app — you would have to publish an entirely new app with a different package name. Back up your keystore file securely.

What Is a Keystore File

A keystore is a binary file (typically .jks or .keystore) that stores one or more cryptographic key pairs. It is protected by two passwords: a store password (protects the file) and a key password (protects the individual key alias inside). Think of it like a password-protected vault containing your signing identity. Android uses a key inside this vault to sign your APK or AAB.

APK vs AAB: Which to Use

Google Play now requires Android App Bundles (AAB) for new apps (since August 2021). An AAB is smaller than an APK because it contains resources for all device configurations and lets Google Play build a device-specific APK for each user. This reduces download size by 15–50%. Local testing and side-loading still use APKs. Build AAB for Play Store submissions and APK only for direct installation or internal testing outside Play.

// eas.json — build AAB for production
{
  'build': {
    'production': {
      'android': {
        'buildType': 'app-bundle'  // produces .aab
      }
    },
    'preview': {
      'android': {
        'buildType': 'apk'  // produces .apk for side-loading
      }
    }
  }
}

Generating a Keystore with keytool

Java's keytool utility generates keystores. The key parameters are: -genkeypair to generate a new key pair, -keystore for the output filename, -alias for the key alias (a name for the key inside the keystore), -validity for how many days the certificate is valid (25 years = 9125 days is typical for app signing), and -keyalg RSA -keysize 2048 for the cryptographic algorithm.

# Generate a release keystore
keytool -genkeypair \
  -keystore myapp-release-key.jks \
  -alias myapp-key \
  -keyalg RSA \
  -keysize 2048 \
  -validity 9125 \
  -storepass yourStorePassword \
  -keypass yourKeyPassword

# You'll be prompted for:
# First and last name:
# Organizational unit:
# Organization:
# City or locality:
# State or province:
# Two-letter country code (e.g., US):
# Then type 'yes' to confirm

EAS Auto-Generated Keystore

EAS Build can generate and securely store a keystore for you automatically. When you first run a production Android build, EAS prompts you to generate a new keystore or upload an existing one. If you let EAS generate it, the keystore is stored encrypted in EAS's cloud — you can download it any time via eas credentials --platform android. This is the safest option for teams because no keystore lives on a single developer's laptop.

# Let EAS generate and manage the keystore
eas build --platform android --profile production

# EAS prompts:
# ? Would you like to set up an Android Keystore?
# > Generate new keystore  <- choose this
#
# EAS creates and stores it securely.

# Download your keystore for backup:
eas credentials --platform android
# Select: Download existing keystore

Configuring Manual Signing in build.gradle

If you are using a bare React Native workflow (not managed Expo) and want to sign locally rather than with EAS, configure signing in android/app/build.gradle. Add a signingConfigs block referencing your keystore file and passwords. Store keystore credentials in ~/.gradle/gradle.properties (not in the source code) to keep them out of git history.

// android/app/build.gradle
android {
    signingConfigs {
        release {
            storeFile file(MYAPP_UPLOAD_STORE_FILE)
            storePassword MYAPP_UPLOAD_STORE_PASSWORD
            keyAlias MYAPP_UPLOAD_KEY_ALIAS
            keyPassword MYAPP_UPLOAD_KEY_PASSWORD
        }
    }
    buildTypes {
        release {
            signingConfig signingConfigs.release
            minifyEnabled true
            proguardFiles getDefaultProguardFile('proguard-android.txt')
        }
    }
}

// ~/.gradle/gradle.properties (NOT in git)
// MYAPP_UPLOAD_STORE_FILE=myapp-release-key.jks
// MYAPP_UPLOAD_STORE_PASSWORD=yourStorePassword
// MYAPP_UPLOAD_KEY_ALIAS=myapp-key
// MYAPP_UPLOAD_KEY_PASSWORD=yourKeyPassword

Building the Signed AAB with EAS

Once credentials are set up, trigger the production Android build with EAS. The cloud runner checks out your code, applies config plugins, builds the AAB, signs it with your keystore, and makes it available for download or direct upload to Play Console. Monitor progress with eas build:list or the EAS dashboard. The finished AAB is typically 5–20MB depending on app size.

# Build signed AAB for Play Store
eas build --platform android --profile production

# Watch build progress (or use dashboard URL provided)
eas build:list --platform android --limit 5

# Download the .aab when complete
eas build:download --id <build-id>

# Alternatively: build AND auto-submit to Play Console
eas build --platform android --profile production --auto-submit

Play App Signing: Upgrading Security

Google Play App Signing is a program where Google holds a secondary app signing key. You upload the AAB signed with your upload key (a simpler key you generate), and Google re-signs it with the managed app signing key before delivery to users. The benefit: if your upload key is compromised or lost, Google can issue a new one. Once enrolled, you cannot unenroll, but it is strongly recommended for new apps.

// Play App Signing flow:

// You sign with:     Upload Key (your keystore)
//                          |
//                          v
//              [Upload to Play Console]
//                          |
//              Google re-signs with:
//                   App Signing Key
//                          |
//                          v
//     Device receives:  App signed by Google's key

// Enroll when creating app in Play Console:
// Setup > App Signing > Use Google-managed key

Verifying the AAB Signature

Before uploading to Play Console, verify your AAB is correctly signed using bundletool or apksigner. Inspect the signing certificate SHA-256 fingerprint — this fingerprint is what Google Play expects to match. A mismatch between your upload certificate and what Play Console has on record will cause the upload to be rejected with a signing error.

# Verify keystore details
keytool -list -v -keystore myapp-release-key.jks
# Shows: Certificate fingerprint (SHA-256):
#   AB:CD:EF:... (copy this for your records)

# Check what signed an APK/AAB
apksigner verify --verbose myapp.apk

# Bundletool (download from Google)
bundletool dump manifest --bundle=myapp.aab

Backing Up the Keystore

The keystore backup is critical — treat it like a password or private key. Store it in: a password manager that supports file attachments, an encrypted cloud storage location (not the same git repo), and optionally a hardware security device. Record the store password, key alias, and key password alongside it. Losing the keystore means you can never update the app — you would need to publish under a new package name and lose all your existing users and reviews.

# Keystore backup checklist:

# 1. Store the .jks file in encrypted storage
#    - 1Password, Bitwarden, or similar
#    - Do NOT commit to git

# 2. Record credentials alongside it:
#    Store file:     myapp-release-key.jks
#    Store password: [store securely]
#    Key alias:      myapp-key
#    Key password:   [store securely]

# 3. Test restoration:
#    - Copy backup to a new machine
#    - Run: keytool -list -keystore myapp-release-key.jks
#    - Verify you can list the key alias

# 4. Tell your team where the backup lives

Version Code and Version Name

Android uses two version identifiers: versionCode (an integer, must increment with each Play Store upload) and versionName (the string shown to users, e.g., '1.2.3'). Play Console rejects a build if versionCode is not strictly greater than the last uploaded build. In Expo, set android.versionCode in app.json and increment it for every new build uploaded to Play.

// app.json
{
  'expo': {
    'version': '1.2.3',     // versionName shown to users
    'android': {
      'versionCode': 12,     // must be higher than previous upload
      'package': 'com.yourcompany.myapp'
    }
  }
}

// After submitting to Play Console, before next build:
// Increment versionCode: 12 -> 13
// Update version if user-facing: '1.2.3' -> '1.2.4'

// EAS can auto-increment:
// eas.json: 'autoIncrement': true (in android profile)

Quick Check

Test your understanding of React Native Mobile Development concepts from this lesson.

Lesson Recap

In this lesson you learned: how to generate an Android keystore with keytool or EAS Build, the difference between APK and AAB and why Play Store requires AAB, and how to configure signing in build.gradle for bare workflow projects. You also saw Google Play App Signing and why backing up the keystore is non-negotiable. Next up we set up the Play Console listing.

Questions Fréquemment Posées

La leçon « Créer un keystore et signer l'AAB » est-elle gratuite ?

Oui — le texte complet de « Créer un keystore et signer l'AAB » est gratuit à lire ici sur le web. Pour la pratiquer de manière interactive (un éditeur de code intégré et un tuteur IA 24/7) et déverrouiller le reste du cours React Native Academy, passe à CoddyKit PRO. Le cours React Native Academy comprend 4 leçons au total.

Qu'est-ce que j'apprendrai dans « Créer un keystore et signer l'AAB » ?

Générez un keystore de publication avec keytool, configurez gradle.properties et build.gradle avec la configuration de signature, puis créez un Android App Bundle signé avec EAS Build. Tu pratiques React Native Academy avec du code pratique que tu exécutes directement dans le navigateur, et un tuteur IA 24/7 répond à tes questions au fur et à mesure que tu avances dans la leçon.

Dois-je avoir de l'expérience pour commencer React Native Academy ?

Aucune expérience préalable n'est requise. React Native Academy sur CoddyKit est structuré pour les débutants jusqu'aux apprenants avancés, donc tu peux commencer ici ou depuis le début et avancer à ton rythme. Ceci est la leçon 1 sur 4.

Combien de temps prend la leçon « Créer un keystore et signer l'AAB » ?

La plupart des leçons CoddyKit prennent environ 5–10 minutes. Chacune est courte et interactive, tu progresses régulièrement et tu repiques exactement où tu t'es arrêté sur le web et l'app.

Peux-tu écrire et exécuter du code dans cette leçon React Native Academy ?

Oui. Chaque leçon React Native Academy inclut un éditeur de code intégré, tu écris et exécutes du vrai code directement dans ton navigateur et tu reçois des retours IA instantanés — aucune configuration locale requise.

Toutes les leçons de ce cours

  1. Créer un keystore et signer l'AAB
  2. Configurer la fiche dans la Play Console
  3. Classification du contenu, règles et confidentialité
  4. Tests internes, déploiement progressif et production
← Retour à React Native Academy