Certificate map

Play App Signing developer verification guide

Play App Signing commonly separates the app signing key used for delivered APKs from the upload key used by your release pipeline. Registration checks must use the identity relevant to the distributed build.

Guide summary

Find the Google Play app-signing certificate for the delivered app, distinguish it from the upload certificate and troubleshoot key-upgrade cases.

For: Play Console users investigating a certificate mismatch or documenting signing ownership.

Release sequence

  1. Open Play Console for the app and select Release > Setup > App signing.
  2. Record the app signing certificate and upload certificate SHA-256 fingerprints with their roles.
  3. For a Play-delivered APK, compare the app signing certificate; the upload certificate identifies the artifact submitted to Play.
  4. If an app signing key upgrade is shown, check the console's certificate details for the Android version and delivered artifact you are investigating.

Quick facts

Delivered appSigned with the app signing key
Bundle uploadMay use a separate upload key
Mismatch symptomRegistered with another certificate
Field note

Do not reset an upload key or change the app signing key solely because a registration check reports a mismatch. First confirm which certificate applies to the artifact and Android version users receive.

Detailed guidance

Map upload and delivery identities

Your CI usually signs an Android App Bundle with the upload key. Google Play verifies that upload, then signs APKs delivered to users with the app signing key. A check against the upload certificate can therefore report a mismatch even when the Play-delivered identity is registered.

In Play Console, open the app's Release > Setup > App signing page and record both public SHA-256 certificates with their roles. If the app-signing key has been upgraded, Android's signing guidance says the upgraded key is used on Android 13 and higher while the previous app-signing key continues to sign updates for earlier Android versions. Check the console's current certificate details and the artifact for the device you are investigating.

  • Play-delivered APK: app signing certificate for the applicable Android version.
  • Bundle or APK upload: upload certificate.
  • Non-Play channel: inspect that channel's production artifact.
  • A key upgrade can leave more than one app-signing certificate relevant to installed users.

Have the production package name and signing certificate ready? Query the official registration state, then use the result to choose your next step.

Run status check →

Frequently asked questions

Should I rotate the upload key after a mismatch?

Not until you confirm which certificate was queried. A mismatch can mean the upload certificate was supplied where the Play app-signing certificate was needed; an upload-key reset does not change Play's app-signing certificate.

Can a non-Play build use the same key?

It can, but the channel's production artifact is the reliable check. Record the certificate that users receive from that store instead of assuming its key matches Google Play.

What if Play shows an upgraded app-signing key?

Keep the old and upgraded app-signing certificates distinct from the upload certificate. Android documents that the upgraded key is used on Android 13 and higher while the earlier app-signing key remains relevant on older Android versions; use Play Console's current details for the artifact you are checking.

Sources and review

Last reviewed: