How to enable Google Play App Signing

Question

I think a lot of developers are trying to learn more about the new Google Play App Signing feature presented at Google I/O 2017.

The ability to store the keystore to sign the apps inside Google Play save you the effort to safely store the keystore and can help the system to optimize the APKs served to every device, based on hardware and OS characteristics.

You can read more about this topic in the official documentation here : https://developer.android.com/studio/publish/app-signing.html#google-play-app-signing.

With the following answer, i will explain a bit better the steps you need to follow to upload your original keystore and how to create the new upload keystore, which you will need to sign your APK from this point onwards.

MatPag · Accepted Answer · 2021-04-29T13:35:52.737

205

Before proceeding watch this Android Developers video to understand the implications of your App Signing enrollment choice: https://youtu.be/odv_1fxt9BI

This guide is oriented to developers who already have an application in the Play Store. If you are starting with a new app the process it's much easier and you can follow the guidelines of paragraph "New apps" from here

Prerequisites that 99% of developers already have :

Android Studio
JDK 8 and after installation you need to setup an environment variable in your user space to simplify terminal commands. In Windows x64 you need to add this : C:\Program Files\Java\{JDK_VERSION}\bin to the Path environment variable. (If you don't know how to do this you can read my guide to add a folder to the Windows 10 Path environment variable).

Step 0: Open Google Play developer console, then go to Release Management -> App Signing.

Accept the App Signing TOS.

Step 1: Download PEPK Tool clicking the button identical to the image below

Step 2: Open a terminal and type:

java -jar PATH_TO_PEPK --keystore=PATH_TO_KEYSTORE --alias=ALIAS_YOU_USE_TO_SIGN_APK --output=PATH_TO_OUTPUT_FILE --encryptionkey=GOOGLE_ENCRYPTION_KEY

Legend:

PATH_TO_PEPK = Path to the pepk.jar you downloaded in Step 1, could be something like C:\Users\YourName\Downloads\pepk.jar for Windows users.
PATH_TO_KEYSTORE = Path to keystore which you use to sign your release APK. Could be a file of type *.keystore or *.jks or without extension. Something like C:\Android\mykeystore or C:\Android\mykeystore.keystore etc...
ALIAS_YOU_USE_TO_SIGN_APK = The name of the alias you use to sign the release APK.
PATH_TO_OUTPUT_FILE = The path of the output file with .pem extension, something like C:\Android\private_key.pem
GOOGLE_ENCRYPTION_KEY = This encryption key should be always the same. You can find it in the App Signing page, copy and paste it. Should be in this form: eb10fe8f7c7c9df715022017b00c6471f8ba8170b13049a11e6c09ffe3056a104a3bbe4ac5a955f4ba4fe93fc8cef27558a3eb9d2a529a2092761fb833b656cd48b9de6a

Example:

java -jar "C:\Users\YourName\Downloads\pepk.jar" --keystore="C:\Android\mykeystore" --alias=myalias --output="C:\Android\private_key.pem" --encryptionkey=eb10fe8f7c7c9df715022017b00c6471f8ba8170b13049a11e6c09ffe3056a104a3bbe4ac5a955f4ba4fe93fc8cef27558a3eb9d2a529a2092761fb833b656cd48b9de6a

Press Enter and you will need to provide in order:

The keystore password
The alias password

If everything has gone OK, you now will have a file in PATH_TO_OUTPUT_FILE folder called private_key.pem.

Step 3: Upload the private_key.pem file clicking the button identical to the image below

Step 4: Create a new keystore file using Android Studio.

YOU WILL NEED THIS KEYSTORE IN THE FUTURE TO SIGN THE NEXT RELEASES OF YOUR APP, DON'T FORGET THE PASSWORDS

Open one of your Android projects (choose one at random). Go to Build -> Generate Signed APK and press Create new.

Now you should fill the required fields.

Key store path represent the new keystore you will create, choose a folder and a name using the 3 dots icon on the right, i choosed C:\Android\upload_key.jks (.jks extension will be added automatically)

NOTE: I used upload as the new alias name but if you previously used the same keystore with different aliases to sign different apps, you should choose the same aliases name you had previously in the original keystore.

Press OK when finished, and now you will have a new upload_key.jks keystore. You can close Android Studio now.

Step 5: We need to extract the upload certificate from the newly created upload_key.jks keystore. Open a terminal and type:

keytool -export -rfc -keystore UPLOAD_KEYSTORE_PATH -alias UPLOAD_KEYSTORE_ALIAS -file PATH_TO_OUTPUT_FILE

Legend:

UPLOAD_KEYSTORE_PATH = The path of the upload keystore you just created. In this case was C:\Android\upload_key.jks.
UPLOAD_KEYSTORE_ALIAS = The new alias associated with the upload keystore. In this case was upload.
PATH_TO_OUTPUT_FILE = The path to the output file with .pem extension. Something like C:\Android\upload_key_public_certificate.pem.

Example:

keytool -export -rfc -keystore "C:\Android\upload_key.jks" -alias upload -file "C:\Android\upload_key_public_certificate.pem"

Press Enter and you will need to provide the keystore password.

Now if everything has gone OK, you will have a file in the folder PATH_TO_OUTPUT_FILE called upload_key_public_certificate.pem.

Step 6: Upload the upload_key_public_certificate.pem file clicking the button identical to the image below

Step 7: Click ENROLL button at the end of the App Signing page.

Now every new release APK must be signed with the upload_key.jks keystore and aliases created in Step 4, prior to be uploaded in the Google Play Developer console.

More Resources:

Q&A

Q: When i upload the APK signed with the new upload_key keystore, Google Play show an error like : You uploaded an unsigned APK. You need to create a signed APK.

A: Check to sign the APK with both signatures (V1 and V2) while building the release APK. Read here for more details.

UPDATED

The step 4,5,6 are to create upload key which is optional for existing apps

"Upload key (optional for existing apps): A new key you generate during your enrollment in the program. You will use the upload key to sign all future APKs prior to uploading them to the Play Console." https://support.google.com/googleplay/android-developer/answer/7384423

edited Apr 29 '21 at 13:35

answered May 22 '17 at 00:17

MatPag

29,651
11
74
87

3

Your walkthrough is super helpful! They should put it on the official website lol The pathnames for your examples are missing " _ " quotes which will throw an error on W10 Console – NukeouT May 27 '17 at 22:40
3

The quotes are needed only if you have at least one space inside your paths, but this is the way every console command works. So you have to use the quotes if your path is: `"C:\My Path\MyName"` but not if the path is `C:\MyPath\MyName`. Btw thank you :) – MatPag May 28 '17 at 01:20
Finally worked but you should create new jsk (you canot use the old one)or google play will refuse rolling, thank you very much – May 28 '17 at 12:09
1

@layth Creating the new keystore is the `Step 4` of the guide :D – MatPag May 28 '17 at 12:11
It was not clear from the description but in the step where youre making the new keystore you need to select the last used GooglePlay keystore and enter its password. Also the alias cant be the same as the one used by those old keystores ... so I added "app" to the end :) – NukeouT May 30 '17 at 07:07
@NukeouT No, you don't need the old keystore and the password in Step 4. You simply have to click on `Create New`, and the new keystore prompt will appear. I've updated the documentation to make this step a bit clearer even if i think it was already – MatPag May 30 '17 at 07:24
1

I did that but when I got your new keystore dialog its keystore path and password fields were blank so I pointed them at the old keystore and entered its old password - btw currently stuck on "keytool -export -rfc -keystore UPLOAD_KEYSTORE_PATH -alias UPLOAD_KEYSTORE_ALIAS -file PATH_TO_OUTPUT_FILE" keeps complaining that it does not know what keytool means. I tried adding "C:\Program Files\Java\jdk1.8.0_25\bin\keytool.exe" but that did not work, possibly because I dont know where to put it in exactly.. – NukeouT May 30 '17 at 07:38
You have to put it in the Windows `Path` environment variable (i think i will create a guide on this too, because a lot of guide on the net are outdated) – MatPag May 30 '17 at 07:42
Ok. Ty ill stay up and wait for it. Btw the new key worked once I typed in your file name + .jks and repeated the same new password 4 times – NukeouT May 30 '17 at 07:51
I've updated all the documentation, now i added some words on how to let the system create the upload_key.jks. Thank you for pointing this out, now the Step 4 should be easier for everyone. I will make the guide on how to add the JDK to Path EV for Windows 10 tonight when i go home – MatPag May 30 '17 at 07:53
@NukeouT [i've create the guide to add a folder to the Windows 10 `Path` here](https://stackoverflow.com/a/44272417/2910520) let me know if this works for you or if you encounter any problems (obviously you need to substitute the example folder with the `bin` folder of your JDK) – MatPag May 30 '17 at 21:42
I set the variable name as keytool and the variable value as C:\Program Files\Java\jdk1.8.0_25\bin\keytool.exe but it still says on execution it does not know what keytool is :( – NukeouT Jun 04 '17 at 23:12
I said in the guide on how to configure the environment variable that you should add the folder and not the specific tool. So remove keytool.exe from the path. (Keytool is a Java utility, it's extension is .jar not .exe) – MatPag Jun 05 '17 at 06:18
11

It looks like Google changed the procedure, because I can't find PEPK Tool anymore. – Andrea Motto Jun 14 '17 at 21:00
@AndreaMotto i've just re-checked the procedure now with another developer account not already subscribed to the Google App Signing and downloading the PEPK Tool it's the first Step to perform yet. I suggest you to double check everything – MatPag Jun 14 '17 at 21:36
@MatPag you're right. I have created a new app, that's why the procedure is different. I can find PEPK Tool in my old app. – Andrea Motto Jun 14 '17 at 21:48
@AndreaMotto The new apps need to follow the link i added on the first lines of the answer ;) – MatPag Jun 14 '17 at 21:49
Also you may have problem with your PATH_TO_OUTPUT_FILE I recommend you to use 1. " " example "D:\My_key.pem" 2. and also don't try do it on C:\ (where you have windows). When i try on C i always get an error(maybe need permisions). Than i tried to do it with quotes and disc E and it work fine. – Jakub S. Jun 19 '17 at 19:01
@JacktheRipper It works fine on C:\ too, Windows is inside the C:\Windows folder and not in C:\ root folder. For the quotes read the second comment – MatPag Jun 19 '17 at 19:21
I'm writting a new app, I opt for google signin, they deliver two pem certificates. I created a local jks ans signed my app and upload. Obviously, they rejected saying the fingerprints don't match. But I see no way to register or download a "upload key". What am I missing? – Adriano dos Santos Fernandes Jul 28 '17 at 12:25
@AdrianodosSantosFernandes read the first 3 lines of the guide. For new apps the steps are different – MatPag Jul 28 '17 at 12:32
I read it. Maybe I'm now figured out the key thing: the upload key of an app will be the key used to sign the first apk uploaded? Is it correct? – Adriano dos Santos Fernandes Jul 28 '17 at 12:39
Thanks for the detailed walkthrough! I have multiple apps signed with the same key. Some of the apps are in one account, and the rest in a different one. Can I enable this only for one of the app in an account? Will I still be able to update the rest of the apps as usual? – akbas Aug 17 '17 at 09:22
@akbas Yes, this is enabled per app not per account ;) – MatPag Aug 17 '17 at 09:49
@MatPag i can no longer find the link to pepk tool, has the documentation changed? All i see in in App Signing screen is bunch of certificates – Shailesh Aug 19 '17 at 23:11
@MatPag Might be a stupid question, but once Google are managing the App signing key, can I delete it? I'm guessing it's redundant as Google are now signing all future apps and I will only be signing with an upload key – sam9046 Sep 10 '17 at 14:00
@sam9046 "theorically" you could delete the signing key after you have been enrolled with the Google App signing. Practically. Practically i don't have the right answer for this :D – MatPag Sep 11 '17 at 16:26
@MatPag pepk tool is missing for new apps. Any official updates? – Sebin Benjamin Sep 29 '17 at 04:01
@SebinBenjamin You don't need the PEPK tool for new apps. Read the first 3 lines of this guide please. – MatPag Sep 29 '17 at 09:21
@MatPag sorry..missed it. – Sebin Benjamin Sep 30 '17 at 06:25
Why my "APP SIGNING PRIVATE KEY" is disabled?? – Irfandi D. Vendy Oct 08 '17 at 10:05
In case anybody gets an error saying `Error: Could not find or load main class`, that just means you forgot to add `-jar` in your command. It's an easy fix, but it wasn't until I read MattPag's thorough explanation that I noticed my error. – Jared Oct 05 '17 at 01:17
the account owner needs to accept the terms and conditions. See above step one in this answer. Once the terms and conditions are accepted APP SIGNING PRIVATE KEY will be enabled to upload. – msmukesh4 Dec 04 '17 at 08:40
after entering both passwords its show error like - error:F\foldername – Dhaval Jotaniya Apr 18 '18 at 12:33
Cant find this pepk file anywhere. – Michael Bruce May 17 '18 at 01:13
So, if Google App Signing is enabled, you don't need the keystore to update the app, right? – PrasadW Jun 20 '18 at 12:47
Great job about the Walkthrough, it's really simple and straight forward. Thank you. I've a question; "Is it still possible to sign the apk with the original keystore(Which has been used before Google App Signing) after applying to Google App Signing?" – Aydinozkan Jul 05 '18 at 12:32
@Aydinozkan thank you no you can't sign the apk with the old keystore – MatPag Jul 05 '18 at 14:42
@MatPag I was previously signing my APK with a p12 file. After activating Google App Signing I am still able to sign the APK with the previous p12 and I can upload it to Google Play Console as a release version. – Aydinozkan Jul 09 '18 at 14:40
@Aydinozkan Are you sure you completed the Google app Signing process? That's really strange – MatPag Jul 09 '18 at 14:50
@MatPag yes I did, I'm sure because I'm able to see the fingerprints of both App Signing and Upload Certificates and I can sign my apk with the newly created Upload keystore and upload it to Google Play Console. I've contacted Google Play Customer Service about this issue, I will comment again at this post if we achieve any progress. – Aydinozkan Jul 13 '18 at 10:42
@MatPag I've contacted Google about the issue. They have remarked that, there is no problem with signing the APK both with the old p12 certificate or with the newly created upload keystore. Both will be applicable to sign the APK. – Aydinozkan Jul 23 '18 at 13:21
Can someone please clarify, I read that if you lose your signingkey/keystore or forget it's password you can no longer update the app, you were signing, is this no longer true??? – petrosmm Oct 03 '18 at 16:58
This Doc should get more and more up-votes. I am not able to find GOOGLE_ENCRYPTION_KEY in App Signing Page – Pratik Saluja Oct 12 '18 at 11:38
1

I've just uploaded the old jks encrypted. And that's it. No new jks creation, and I have no idea what the upload key means now. I'm try to upload a new apk, signed like before this process and it's works fine. I'm afraid when I really need to send a new apk to the store and get blocked. – Bruno Pinto Oct 26 '18 at 17:33
It seems step 4,5,6 are optional, I can enroll after step 3 and enable to upload aab file just fine. Just use the old key store to sign app as usual. – thanhbinh84 Oct 30 '18 at 14:27
@thanhbinh84 thanks for the edit. They changed something with the latest updates. I'll try to update the tutorial accordingly when i have time :) – MatPag Oct 30 '18 at 17:06
@MatPag your tutorial is still valid, just want to add more info that the second key store is optional and called upload key. Thanks for the tutorial, it is much clearer than google guide. :D – thanhbinh84 Oct 31 '18 at 05:05
If you created the Keystore using Visual Studio Xamarin the keystore password and the alias password are the same. I just find out by trial and error. – iyepes Nov 26 '18 at 03:36
Thank you so much you saved my day – amirhesni Dec 25 '18 at 12:33
you have fantastic fully complete answer,But in my case i need to know how to generate Facebook key hash from already published App with app signing certificate having only the deployment_cert.der file ,thank you in advance. – Robotec Jan 20 '19 at 19:21
Does anyone know if it is possible to do perform the private key Opt-In/Upload with Google Developer Publisher API? Haven't found anything yet... – sonjz Apr 01 '21 at 22:31
I have followed the same steps and able to upload the app in the internal testing but problem is that PlayStore shows me updated version but instead of Update it shows me Open button. So I can't able to update my app in internal testing. – Gopal Awasthi Apr 23 '21 at 07:57

score 39 · Answer 2 · answered Nov 19 '18 at 23:32

There is a much simpler solution that will take a minute.

In google play console, select Release management -> App signing
Choose the first option, the one with Generate encrypted private key with Android Studio (or something like that; I cannot turn back to see that page anymore)
In Android Studio generate your Android App Bundle (.aap file) from Build -> Generate Signed Bundle / APK..., choose Android App Bundle option and don't forget to check Export Encrypted key (needed to enroll your app Google Play App signing) option. If you do not have a keystore generated, generate one ad-hoc.
Now the "tricky" part. After the .aap is generated, Android Studio will pop up a notification in the bottom right corner containing a path to the location where the .aap file is saved. In the same notification, if you will expand it you will find another link to the path where the private key was saved (called private_key.pepk). If you miss this notification, don't worry, just open Event Log window by clicking the Event Log button on the bottom right side and you will find the same info. Open that location.For me was C:\Users\yourUser\.android

Go back in browser and press APP SIGNING PRIVATE KEY button and browse to the private key location on your computer.

Done!

Now you are able to upload your release that you generated earlier :) Good luck!

I am not getting this option Export Encrypted key (needed to enroll your app Google Play App signing) option. — Jarvis, Feb 06 '19 at 09:14
I would really appreciate a fuller explanation of point 5 - I don't see this button, where is it, perhaps the layout has changed on recent updates? — androidneil, Aug 10 '19 at 10:11
ok nice now i want to curious about that on the next update what to do ?? like is we need .pepk key again or we have to sign the version 2 using same key or the new private .pepk key pls help — Sunil Chaudhary, Nov 06 '19 at 06:47

Ambilpura Sunil Kumar · Answer 3 · 2019-09-19T05:42:34.287

24

While Migrating Android application package file (APK) to Android App Bundle (AAB), publishing app into Play Store i faced this issue and got resolved like this below...

When building .aab file you get prompted for the location to store key export path as below:

In second image you find Encrypted key export path Location where our .pepk will store in the specific folder while generating .aab file.

Once you log in to the Google Play Console with play store credential: select your project from left side choose App Signing option Release Management>>App Signing

you will find the Google App Signing Certification window ACCEPT it.

After that you will find three radio button select **

Upload a key exported from Android Studio radio button

**, it will expand you APP SIGNING PRIVATE KEY button as below

click on the button and choose the .pepk file (We Stored while generating .aab file as above)

Read the all other option and submit.

Once Successfully you can go back to app release and browse the .aab file and complete RollOut...

@Ambilpura

edited Sep 19 '19 at 05:42

answered Jul 25 '19 at 06:39

Ambilpura Sunil Kumar

1,055
10
7

1

ok nice now i want to curious about that on the next update what to do ?? like is we need .pepk key again or we have to sign the version 2 using same key or the new private .pepk key pls help – Sunil Chaudhary Nov 06 '19 at 06:47
As per my understanding, no need to create for next time, u can use old .pepk key.... – Ambilpura Sunil Kumar Nov 06 '19 at 10:12
How do you use the .pepk for an update? I successfully used google app signing when uploading my app, but now im trying to push an update and don't know how @AmbilpuraSunilKumar – nt95 Dec 09 '19 at 14:40
Same here. I just upload the abb to the play store and completely ignore the .pepk file. It would be nice to know what exactly it is good for and what to do when updating the app. – Julian Eggers Dec 11 '19 at 12:18

score 6 · Answer 4 · edited Jun 20 '20 at 09:12

6

I had to do following:

Create an app in google play console

2.Go to App releases -> Manage production -> Create release

3.Click continue on Google Play App Signing

4.Create upload certificate by running "keytool -genkey -v -keystore c:\path\to\cert.keystore -alias uploadKey -keyalg RSA -keysize 2048 -validity 10000"

5.Sign your apk with generated certificate (c:\path\to\cert.keystore)

6.Upload signed apk in App releases -> Manage production -> Edit release

7.By uploading apk, certificate generated in step 4 has been added to App Signing certificates and became your signing cert for all future builds.

edited Jun 20 '20 at 09:12

Community

1
1

answered Nov 02 '17 at 16:21

itfake

102
1
5

1

I did exactly this but the google signin from my app does not work if I install the app via the Google Play Store. _*But*_ if I download the apk from the release management page and install it manually into my emulator / device, it works. Any idea what I'm missing? – Raghudevan Shankar Nov 07 '17 at 02:45

mtrakal · Answer 5 · 2017-11-14T09:48:20.170

3

When you use Fabric for public beta releases (signed with prod config), DON'T USE Google Play App Signing. You will must after build two signed apks!

When you distribute to more play stores (samsung, amazon, xiaomi, ...) you will must again build two signed apks.

So be really carefull with Google Play App Signing.

It's not possible to revert it :/ and Google Play did not after accept apks signed with production key. After enable Google Play App Signing only upload key is accepted...

It really complicate CI distribution...

Next issues with upgrade: https://issuetracker.google.com/issues/69285256

edited Nov 14 '17 at 09:48

answered Oct 24 '17 at 10:26

mtrakal

5,142
1
17
31

1

Bold capital `DON'T USE` type of comments is dangerous. Can you explain the issue and recommended solution in detail? Isn't there a solution at all? Is it so hard to sign an APK twice for Fabric? – Gokhan Arik Oct 29 '18 at 17:51
1

I'ts not so hard to sign APK twice, but as I describe, you must build two (or more) APKs which are not identical (so you are testing on Fabric Beta different file than which will be published to Play Store). It loose point of testing production build on beta testers... you are testing another file :). It's just a warning for people which have some complex CI/CD that they must chnage it... – mtrakal Oct 30 '18 at 23:07
2

Note that Google Play now accepts APKs signed with the production key even after enrolling in App signing. – Pierre Nov 20 '18 at 17:25

score 2 · Answer 6 · answered Nov 05 '17 at 06:49

2

Do the following :

"CREATE APPLICATION" having the same name which you want to upload before.
Click create.
After creation of the app now click on the "App releases"
Click on the "MANAGE PRODUCTION"
Click on the "CREATE RELEASE"
Here you see "Google Play App Signing" dialog.
Just click on the "OPT-OUT" button.
It will ask you to confirm it. Just click on the "confirm" button

answered Nov 05 '17 at 06:49

Sterling Diaz

3,370
2
26
34

After this can I able to test in app purchase and play services as like before? Did you get any experience regarding this? Because even I don't like to do any heavy steps. – Siddharth Jan 26 '18 at 12:19
1

Not really an appropriate answer for "How to **Enable** Google Play App Signing"... – Ben Madsen Oct 05 '18 at 22:51
2

And what do you suggest as an appropiate way to do it? – Sterling Diaz Oct 08 '18 at 12:54

score 1 · Answer 7 · answered Mar 24 '21 at 18:22

1

for Updated Google Console go to inside Setup and open App integrity. and upload your key here. you will be good to go.

answered Mar 24 '21 at 18:22

Kapil Bansal

51
6

how about incorporating this into the appropriate original answer OR is this a replacement? – Mr R Mar 24 '21 at 22:26

How to enable Google Play App Signing

7 Answers7

Q&A

UPDATED

Linked