Google Play Wrong Signing Key Error: App Signing vs Upload Key

When you upload an AAB to Google Play, you may see an error such as:

Your Android App Bundle is signed with the wrong key.

The app bundle must be signed with the same certificates as the previous version.

To understand the cause, separate the two keys used by Play App Signing.

The two keys in Play App Signing

Upload key

The developer uses the upload key to sign the AAB sent to Google Play.

Google Play checks this signature to confirm that the artifact came from an authorized developer.

App-signing key

Google Play uses the app-signing key to sign the APKs delivered to users.

An update installed on a device must be signed with the same app-signing identity as the existing app.

Developer
signs the AAB with the upload key
↓
Google Play
verifies the upload and generates optimized APKs
↓
signs delivered APKs with the app-signing key
↓
User device

Common causes of signing errors

The build used another keystore

A developer may accidentally create a new keystore after moving to another computer, setting up CI, or recreating a project.

An update to an existing Play app must use the private key corresponding to the registered upload certificate.

The build used the debug key

Android Studio normally signs debug builds with the debug keystore. Build a release AAB for Google Play.

./gradlew bundleRelease

Flutter:

flutter build appbundle --release

CI uses different signing settings

When local uploads work but CI artifacts fail, check:

• Keystore file
• Key alias
• Store password
• Key password
• Base64 decoding destination
• Build variant
• Newlines and quoting in environment variables

The key belongs to another app

If several apps are managed on the same machine, the project may point to another app’s keystore or alias.

Compare certificate fingerprints

Inspect a keystore:

keytool -list -v \
  -keystore upload-keystore.jks \
  -alias upload

Inspect an AAB:

jarsigner -verify -verbose -certs app-release.aab

In Play Console, open the app-integrity or Play App Signing page and compare the SHA-1 or SHA-256 value shown for the upload certificate.

Do not confuse SHA registration targets

Google Sign-In and some APIs require the certificate fingerprint of the installed app.

If only the Google Play build fails to sign in, add the SHA fingerprint of the app-signing certificate from Play Console to Firebase.

If the upload key is lost

For an app enrolled in Play App Signing, an authorized account may be able to request an upload-key reset by following the current Play Console process.

The general flow is:

1. Create a new upload key securely
2. Export its public certificate
3. Start the reset process in Play Console
4. Wait for approval or activation
5. Update local and CI signing settings

The screens and required steps can change, so follow the current instructions shown in Play Console.

Create a new key

keytool -genkeypair -v \
  -keystore new-upload-key.jks \
  -keyalg RSA \
  -keysize 2048 \
  -validity 10000 \
  -alias upload

Export the public certificate:

keytool -export -rfc \
  -keystore new-upload-key.jks \
  -alias upload \
  -file upload_certificate.pem

Do not commit the keystore, passwords, or private-key material to Git.

Changing the app-signing key is different

Resetting the upload key is not the same as upgrading or changing the app-signing key.

The app-signing key affects update compatibility on user devices. You cannot replace it simply by generating another local keystore. Check whether the app is eligible for the key-management options provided by Play Console.

Store keystores safely

Recommended practices:

• Keep multiple encrypted backups
• Store passwords in a password manager
• Record the alias
• Maintain an app-to-key inventory
• Use secret storage in CI
• Never print Base64 key data or passwords in logs
• Review access when a contractor or team member leaves

Example inventory:

Do not put the secret values themselves in this table.

Troubleshooting order

1. Confirm that you opened the correct Play Console app
2. Confirm the AAB’s applicationId
3. Confirm that it is a release build
4. Check the keystore and alias used
5. Inspect the certificate embedded in the AAB
6. Compare it with the upload certificate in Play Console
7. Compare local and CI signing configuration
8. Determine whether an upload-key reset is required

What not to do

• Create a new keystore every time an upload fails
• Remove signing and upload an unsigned AAB
• Store a private key in a public repository
• Assume the app-signing key and upload key are the same
• Register only the upload-key SHA for Google Sign-In and assume setup is complete

Summary

Play App Signing uses two different keys:

Upload key
= signs the AAB sent by the developer to Google Play

App-signing key
= signs the APK delivered by Google Play to users

For an upload signing error, compare the certificate in the AAB with the upload certificate shown in Play Console.

If authentication fails only in the Google Play build, see Why Google Sign-In Fails Only in the Play Version.