Play App Signing in 2026: A Step-by-Step Guide to Upload Keys, Key Upgrades, and Resets

Play App Signing splits app signing into two jobs: you keep a key, Google keeps a key. In 2026 a third key joined them — the post-quantum half of the new hybrid signature — which is why the fingerprints you register with Google Maps, OAuth or Facebook Login are no longer a single value. Here is the full key model from Google's own Play Console documentation, the exact console paths, and the two operations that matter most in practice: the annual app signing key upgrade and the upload key reset.

What you are solving today: know which key does what, set up Play App Signing for a new or existing app, register the right fingerprints (up to three), upgrade an app signing key, and reset a lost upload key without losing the app or the listing.

Two keys, three with quantum-ready signing

Per Use Play App Signing, every app under Play App Signing deals with distinct keys, each with its own holder, format and recovery rules.

Upload key — yours. Format: a Java keystore (.jks or .keystore). Requirement: RSA of 2048 bits or more. You use it to sign your app bundle before uploading it to Play Console, and Google uses it to verify your identity. If it is compromised or lost, Google can reset it for you — that is the whole point of the split.
App signing key — Google Play's. Format: a public certificate (.der or .pem). Google-generated keys are RSA 4096-bit; a custom key you supply must be RSA 2048-bit or higher. Google uses this key to sign the final APKs delivered to users' devices. Manage it yourself, outside Play App Signing, and lose it, and it cannot be reset.
Quantum-ready keys — Google Play's, added for Android 17. Hybrid signing pairs a classical RSA 4096-bit key with a post-quantum ML-DSA-65 key. Google generates a new classical key for the hybrid signature that is different from the classical key it uses for pre-Android 17 devices, so the app ends up using three distinct keys. Android 17 and above verify the app with APK signature scheme v3.2, which carries exactly two signers in a hybrid block; older Android versions keep verifying the app with the classical signature blocks.

For maximum security your upload key and your app signing key should be different keys. And when Google signs your APKs with the app signing key it uses apksigner to add two stamps to the manifest, com.android.stamp.source and com.android.stamp.type, so the APKs stay traceable to the original signer.

New app: quantum-ready signing is now the default

Create the app. It is automatically enrolled in quantum-ready, hybrid signing with Google-generated keys. Google also generates a separate classical key for the signature blocks recognised on Android 16 and below.
Create an upload key — generate a keystore in Android Studio, or use the Java keytool utility from the command line.
Upload your app bundle. Enrollment happens at upload; there is no separate opt-in step.
Optional: change the app signing key if you would rather manage it yourself. Go to Protected with Play → Play Store distribution → Go to Play app signing and click Change the app signing key. This is only possible before there is a release rolled out on the open testing track or the production track, and you can either use the app signing key of another app in the same developer account or provide a copy of your own key.

Existing app: enroll through the PEPK tool

If you still sign and upload your own APKs, you can migrate to Play App Signing to get app bundles and the Play enhancements that come with them.

In Play Console, go to Protected with Play → Play Store distribution → Go to Play app signing and accept the terms of service if you have not already.
Transfer a copy of your original key. Download the PEPK tool and follow the unified step-by-step instructions to encrypt and upload your existing app signing key from any repository.
Create a new upload key (recommended). Generate a new key in Android Studio and register its certificate in Play Console.

Register up to three fingerprints with your API providers

Maps, OAuth and Facebook Login authenticate your app by the fingerprint of the app signing key. Because Google signs the final APK, you must register the Google-held app signing key fingerprint with those providers — registering only your local upload key is the classic post-migration break.

Go to Protected with Play → Play Store distribution → Go to Play app signing.
Scroll to the App signing key section and copy the SHA-1 or SHA-256 fingerprints.
If your app uses quantum-ready hybrid signing, copy the fingerprints of three keys and register every one of them: the new classical key and the PQC key used on newer devices, plus the classical key used on older devices.
Paste them into each provider's console (for example Google Cloud Console). If you use Android App Links, update assetlinks.json with the same fingerprints.

Upgrade the app signing key — once a year, when you need it

If the app signing key is compromised, or you want a cryptographically stronger key, you can request an annual key upgrade. The upgrade applies to all installs on Android 17 (API level 37) and above, and enforcement differs by platform version:

Android 17 (API level 37) and above — the platform strictly enforces the upgraded quantum-ready hybrid key (APK signature scheme v3.2).
Android 13 to 16 (API levels 33–36) — the platform strictly enforces your latest classical key (APK signature scheme v3.1).
Android 7 to 12 (API levels 24–32) — the platform does not enforce the upgraded key and still recognises the latest classical key; Play Protect adds validation that updates are signed with your latest classical key, unless the user has turned that off.

Shared-data caveat: because the upgraded key is not enforced on API 32 and below, if you use the same key across several apps to share data, those older Android versions will only recognise the legacy key for features such as custom permission sharing.

How to upgrade:

Go to Protected with Play → Play Store distribution → Go to Play app signing.
Under the App signing key section, click Upgrade key.
Choose your path: let Google Play generate a new app signing key (recommended), use the same app signing key as another app in this developer account, or provide a copy of your app signing key.
Click Save.
Register the new fingerprints with your API providers — with quantum-ready signing that means two new keys, the new classical key and the new PQC key.

Reset a lost upload key

A lost or suspected-compromised upload key does not lock you out of your app.

Create a new upload key in Android Studio.
Export the certificate to PEM format:

keytool -export -rfc -keystore upload-keystore.jks -alias upload -file upload_certificate.pem

In Play Console, go to Protected with Play → Play Store protection → Manage Play app signing.
In the Upload key certificate section, click Request upload key reset, enter the reason for the reset, upload your upload_certificate.pem file and click Request.

What this means when an account or an app changes hands

The app signing key is held by Google and travels with the app, so handover work concentrates on the upload keystore and on the services that trust your fingerprints.

Get the upload keystore (.jks) together with its alias and password, or plan for an upload key reset on the receiving side.
Re-check every fingerprint-dependent integration after any upgrade or reset: Maps API keys restricted by SHA-1, Facebook Login, OAuth clients, and assetlinks.json for App Links. These fail quietly, not loudly.
A handover checklist that still asks for one SHA-1 is out of date: with quantum-ready signing the provider sees three fingerprints.

Two related walkthroughs on this blog: the Google Play account and app transfer checklist and the Play Console access control tutorial.

Distributing outside Google Play, and testing what users actually get

Same key everywhere: you can let Google generate the app signing key and then download a signed universal APK from Play Console or the Play Developer API to distribute on other stores — go to Test & release → Latest releases and bundles, select your app bundle and open the Downloads tab. Alternatively, generate the app signing key yourself and transfer a copy of it to Google when you configure Play App Signing.
Test the real artifact: use Internal App Sharing to test exactly what Play will deliver, or download device-specific APKs from the app bundle explorer and install them locally with adb install-multiple *.apk.
APK Signature Scheme v4 is applied automatically for eligible apps to support optimised distribution on Android 11+ devices. No action needed — except that apps using quantum-ready hybrid signing are excluded, because v4 is not yet compatible with it.
Protect console access: enforce 2-Step Verification for all users on the account. Losing the keystore is recoverable; losing the account is not.

Pre-flight checklist

Upload key stored in a keystore with a backup outside the build machine, alias and password recorded in your password manager.
Upload key and app signing key are different keys.
App enrolled in Play App Signing (new apps are enrolled automatically at bundle upload).
All app signing key fingerprints copied from Play Console into every API provider console — all three keys when hybrid signing is in use.
assetlinks.json updated with the same fingerprints if you use App Links.
Key upgrade done before a release is in open testing or production if you want your own app signing key.
Post-upgrade or post-reset: fingerprints re-registered and integrations re-tested on a real device.
2-Step Verification enforced for every Play Console user.

The one-line version

You sign with the upload key, Google signs with the app signing key, and Android 17 adds post-quantum keys into the mix — so keep the upload keystore backed up, register every app signing key fingerprint with your API providers, use the annual upgrade path when you need a stronger key, and reset the upload key in Play Console if it is ever lost.