Home / Certificate map
Certificate map

Play App Signing developer verification guide

Understand which certificate fingerprint matters when Google Play manages the app signing key and your CI uses a separate upload key.

Operational summary

Play App Signing commonly separates the app signing key used for delivered APKs from the upload key used by your release pipeline. Registration checks must use the identity relevant to the distributed build.

Built for: Play Console users investigating a certificate mismatch or documenting signing ownership.
Delivered appSigned with the app signing key
Bundle uploadMay use a separate upload key
Mismatch symptomRegistered with another certificate

Recommended sequence

  1. Open the app integrity or signing section in Play Console.
  2. Record both the app signing certificate and upload certificate fingerprints.
  3. Use the production app signing certificate for the delivered package identity.
  4. Keep the upload certificate in release documentation for CI troubleshooting.
Field note: Do not rotate or reset a key solely because a checker reports a mismatch. First confirm which certificate signed the distributed artifact.

Map upload and delivery identities

Your CI normally signs an Android App Bundle with the upload key. Google Play verifies that upload, then signs APKs delivered to users with the app signing key. A status check against the upload certificate can therefore report a mismatch even when the delivered app is registered correctly.

Document both fingerprints and label them explicitly. When diagnosing an existing install, compare against the app signing certificate shown in Play Console and the certificate on the delivered APK.

  • App signing key: identity of Play-delivered APKs.
  • Upload key: authenticates uploads to Play.
  • Legacy key: may still matter for older or non-Play builds.

Frequently asked questions

Should I rotate the upload key after a mismatch?

Not until you confirm which certificate was queried. A mismatch can simply mean the app signing certificate should have been used.

Can a non-Play build use the same key?

It can, but many teams use a separate channel workflow. Inspect each distributed artifact rather than assuming.

Sources and review

PkgReady summarizes operational implications but does not replace an official console or Android documentation. Reviewed 2026-08-14.