On this page
When you publish with Google Play, two signing keys are in play and mixing them up is the most common cause of upload rejections. Play App Signing holds your app signing key, while your upload key signs each bundle before it reaches Google. This guide keeps the two straight, explains when and how each key can be rotated, and what to do if a key is lost or compromised.
The two keys, in plain terms
Google Play App Signing splits app signing into two separate keys with distinct jobs.
| Key | Who holds it | When it changes | What breaks if lost |
|---|---|---|---|
| Upload key | You (in your keystore) | You can reset it via Play Console | Can't upload new bundles until reset; existing users keep the app signing key so no user impact |
| App signing key | Google Play (or you, if self-signed) | Only via app-signing-key upgrade | No upgrade possible; would require a new app with new package name |
Registering the right fingerprint
Services that authenticate your app by certificate — Google Maps, Firebase, OAuth, assetlinks — must use the fingerprint Google holds, not your upload-key fingerprint. The Google-held fingerprint lives in Play Console under Setup > App integrity.
Rotating or resetting your upload key
You control the upload key, so you can also reset it yourself. Google provides a dedicated flow for this — it does not touch the app signing key and does not affect users.
Open App integrity
In Play Console, go to Setup > App integrity. Under the Upload key section, find and select Reset upload key.
Generate a new upload key
Create a new keystore and key pair (or reuse a fresh one). You'll upload the new public certificate, not the keystore itself.
Upload the new PEM certificate
On the reset screen, paste the Base64-encoded PEM certificate of your new upload key and submit. Google begins serving the new key within minutes.
Sign future uploads with the new key
Update your signing config to use the new keystore. The next bundle you upload must be signed with the new upload key.
App-signing-key upgrade
For apps already on Google Play, Play may offer an app-signing-key upgrade — a way to rotate the Google-held app signing key for Android 17+ devices without shipping a new app or losing user data.
Sources & references
Official Google documentationThese links open Google's official Play Console Help pages used to verify this guide. AppsTestLab guidance is independent and not affiliated with Google.
Get help doing this