Play App Signing is Google Play’s service that keeps your app signing key on Google’s servers and uses it to sign the APKs your users install. You sign uploads with a separate upload key. If you publish an Android App Bundle (AAB) on Google Play, you have to use it, and every new Play app has needed an AAB since August 2021.
What Play App Signing does
Google-managed signing moves the most important key in your app’s life from your laptop to Google. The Android Developers Blog app signing FAQ says Google manages and protects your app’s signing key and uses it to sign your APKs for distribution.
- You build an AAB and sign it with your upload key.
- You upload it to Play Console.
- Google builds APKs for each device and signs them with the app signing key it holds.
- Users install those APKs, and every update must carry the same signing certificate.
Google’s Sign your app guide says the keys live on the same infrastructure Google uses for its own keys, protected by Google’s Key Management Service. Our post on upload key vs app signing key covers the two keys side by side.
Do you have to use Play App Signing?
Google-managed signing is mandatory for any app you publish on Google Play as an app bundle. In June 2021 Google announced on the Android Developers Blog that new apps must use the Android App Bundle starting August 2021, and called Play App Signing “required for app bundles.”
The reason is mechanical. An AAB isn’t installable by itself; Google turns it into APKs. The Android guide says app bundles defer building and signing APKs to the Google Play Store, so you need to set up Google-managed signing before you upload your app bundle.
The same June 2021 post said existing apps were exempt at the time, as were private apps published to managed Google Play users. An older app that still ships signed APKs may never have enrolled. For that app, losing the key still ends it.
Which situation are you in?
Whether you need it depends on where your app goes, not on how it was built.
| Your situation | Required? | What signs the installed APK |
|---|---|---|
| New app on Google Play, uploaded as an AAB | Required, enrolled by default | Google’s app signing key |
| Older Play app still uploading signed APKs | Not enrolled unless you opted in | Your own key |
| APK shared from your website or by email | Doesn’t apply | Your own key |
| Same app on Google Play and another store | Required on Play; plan the key first | Google’s key, or yours if you supplied it |
| Private app for managed Google Play users | Was exempt as of June 2021 | Your own key unless enrolled |
In the third row, guard your own key. Lose it there and there’s no reset path at all.
What you gain by enrolling
The biggest gain is that a lost key stops being fatal. The 2020 FAQ is blunt about the alternative: if you’re not enrolled and you lose your signing key, you’ll lose the ability to update your app. Play Console Help adds that a self-managed key cannot be reset if you lose it.
Once enrolled, losing your upload key is a support request. The Android guide says you can request an upload key reset in Play Console and keep shipping updates to the original app. Our post on what happens if you lose your Android app signing key covers both cases step by step.
You also get device-specific APKs built from your bundle, which is the point of the AAB format. Our post on why AAB replaced APK on Google Play explains what that changes.
What you give up
The trade-off is control: once Google holds the signing key, you can’t get it back. The Android guide says that after you set up Google-managed signing, with a generated key or one you supply, you cannot retrieve a copy of your app’s signing key.
Two places this bites:
- Other stores. If you want the same key on Google Play and elsewhere, the Android guide says to provide your own signing key when you enroll. The other route, per the Play App Signing help page, is to download a Google-signed universal APK from Play Console under Test and release > Latest releases and bundles.
- Trust. Google, not you, signs the code on users’ phones. Google’s answer for developers who want to check that is code transparency, an optional mechanism where you sign a list of your DEX and native code hashes with a key only you hold.
It doesn’t verify resources, assets or the Android Manifest, and the Android OS doesn’t check the file at install time. It’s for inspection by developers and users, not enforcement.
How to set it up for a new or existing app
Setting this up for a new app takes no extra work, because Google enrolls it by default. Play Console Help says that when you upload your app bundle, the app is automatically enrolled with a Google-generated key.
To supply your own key instead, change it before a release rolls out to open testing or production. Play Console offers two options:
- Use the same key as another app in your developer account.
- Provide a copy of your app signing key by following the on-screen instructions.
For an existing app that signs its own APKs, you transfer your current key with Google’s PEPK tool, which encrypts and uploads it. Either change needs admin permission in Play Console.
What this means for an AAB built in your browser
A browser-built AAB goes through the same signing step as any other bundle, and the key you created in the builder becomes your upload key. On webtoapkfree.com, signing runs in your browser and the private key isn’t uploaded to a build server. You get a signed APK for testing and an AAB for Google Play. Upload that AAB to a new app and Google generates the app signing key.
The key you keep is saved as a password-encrypted backup in the browser’s IndexedDB and isn’t synced to other devices. Download that backup. The limitation: the builder can’t import JKS or P12 keystores, so a key made in another tool can’t come with you. And an AAB is not Play approval. The listing, testing and policy review are separate, as the guide to publishing a WebView app on Google Play explains.
Should you supply your own key or let Google generate it?
For most indie developers and small businesses, letting Google generate the key is the right call. You get the reset path for the key you’re most likely to lose, and you never handle the one that can’t change.
Only provide your own app signing key if you already ship, or definitely will ship, the same app outside Google Play under one key. Otherwise, download the Google-signed universal APK and skip storing a second critical secret. Before your first upload, test the bundle with our guide to installing an AAB file on your phone.
FAQ
Is it turned on automatically?
For new apps, yes. Play Console Help says a new app is automatically enrolled with a Google-generated key when you upload your app bundle. You can switch to your own key before a release reaches open testing or production.
Can I get my app signing key back from Google?
No. Google’s docs say that once Google holds the key, with a generated key or one you supplied, you cannot retrieve a copy of the signing key. Keep your own copy first if you need one.
Do I need Play App Signing if I only share my APK outside Google Play?
No. Google-managed signing only applies to apps distributed through Google Play. An APK you share from a website or another store is signed with your own key, and you’re responsible for keeping it.
Can I use the same key on Google Play and another store?
Yes. Either provide your own app signing key when you enroll, or download a Google-signed universal APK from Play Console and distribute that elsewhere.