On this page
The problem
Your AAB or APK upload is rejected with a signing-key error — for example, the bundle is signed with an upload key that doesn't match the one registered for your app, or the system tells you your upload key has been lost or reset.
Why it happens
Play Console records the certificate fingerprint of the upload key you first uploaded with for an app. Every later upload must be signed with a key whose fingerprint matches. If you built the bundle with a different key — a debug build, a different release keystore, or a CI job pointed at the wrong signing config — Play rejects it. A 'key lost or reset' message appears when the original upload keystore is genuinely gone and you need the reset flow to proceed.
The quick fix
Confirm the keystore and key alias you used for this build match the one in your signing config. Re-sign the bundle with the correct upload key and re-upload — or, if the key is truly lost, start the upload-key reset flow under Setup > App integrity in Play Console.
Step by step
Identify the exact error message
In Play Console, open the release's review summary and read the signing error. 'Upload key mismatch' means the fingerprint doesn't match; 'upload key lost or reset' means the original key is gone and you need the reset flow.
Rebuild and re-upload with the correct key
If the key is available, confirm the upload keystore, key alias, and passwords used the bundle. Rebuild with the correct signing config and upload again. The error clears once the fingerprint matches.
Reset the upload key (if lost or compromised)
Go to Setup > App integrity > Upload key and select Reset upload key. Paste the Base64 PEM certificate of your new upload key and submit. Once Google serves the new key, uploads signed with it are accepted.
Things to check
- The exact error wording from Play Console
- Your signing config's keystore path, key alias, and passwords
- Whether the keystore itself has ever been recreated or moved
- If any CI/build step overrides the signing config
If this didn't work
- Confirm you are using the same keystore and key alias across app and module build.gradle files, and that no CI environment override is swapping them.
- Verify the keystore password and key password are correct — a mismatched password still signs, just with the wrong key, which re-creates the mismatch.
- If you manage signing for multiple apps from one project, check you didn't promote another app's bundle.
Common mistakes
- Re-signing with a debug build's default key instead of the release upload key
- Assuming the app signing key must be present locally — it's held by Google, so a lost upload key is the only recoverable case
- Starting the reset flow while still able to use the original key — reset is destructive to the old fingerprint record
When to contact Google
If the correct key is used, the fingerprint still mismatches, and you have not previously reset or rotated the upload key, contact Play Console support through Help & feedback with the error text and your app's signing-key history.
Sources & references
Official Google documentationThese links open Google's official Play Console Help pages used to verify this guide. AppsTestLab guidance is independent and not affiliated with Google.
Last reviewed August 23, 2026 · Google Play requirements change — verify in the Play Console.