Signing & Play App Signing

Upload keys, Play App Signing, and EAS credential sync - how Android release identity works for Expo SDK 57 teams. Signing proves updates come from you; Play App Signing adds Google's key custody so lost laptops do not end your app.

Recipe

Quick-reference recipe card - copy-paste ready.

# First Android production build - let EAS generate credentials
eas build --platform android --profile production
 
# Inspect and download credentials (admin)
eas credentials --platform android
 
# Build with existing remote keystore
eas build --platform android --profile production --non-interactive

// eas.json
{
  "build": {
    "production": {
      "android": {
        "buildType": "app-bundle"
      }
    }
  },
  "submit": {
    "production": {
      "android": {
        "serviceAccountKeyPath": "./play-service-account.json",
        "track": "internal"
      }
    }
  }
}

# Local debug fingerprint (development / adb App Links testing only)
keytool -list -v -keystore ~/.android/debug.keystore \
  -alias androiddebugkey -storepass android -keypass android | grep SHA256
 
# Play Console → App integrity → App signing key certificate → SHA-256
# Use THAT fingerprint in assetlinks.json for production App Links

When to reach for this:

• First eas build for Android production asks about keystore generation.
• App Links verification fails - fingerprint mismatch between upload and Play signing cert.
• A teammate rotated off and only they had the .jks file on a laptop.
• Play Console rejects an AAB with "signed with wrong key."

Working Example

Step 1 - Enable Play App Signing (new app)

1. Create app in Play Console.
2. On first AAB upload, accept Google Play App Signing (recommended - mandatory for new apps).
3. Google holds the app signing key; you keep an upload key.

Step 2 - Generate upload credentials with EAS

eas credentials --platform android
# Choose: Set up a new keystore (or upload existing if migrating)
# EAS stores keystore + passwords encrypted on Expo servers

Step 3 - Production build and submit

eas build --platform android --profile production
eas submit --platform android --profile production --latest

Step 4 - Register App Links fingerprint

# Play Console → Release → App integrity → App signing
# Copy SHA-256 certificate fingerprint

// https://shop.example.com/.well-known/assetlinks.json
[
  {
    "relation": ["delegate_permission/common.handle_all_urls"],
    "target": {
      "namespace": "android_app",
      "package_name": "com.example.shopapp",
      "sha256_cert_fingerprints": ["PLAY_APP_SIGNING_SHA256_HERE"]
    }
  }
]

See Android App Links for full verification setup.

Step 5 - Rotate upload key (lost laptop scenario)

1. Play Console → App integrity → Upload key → Request upload key reset.
2. Generate new upload keystore locally or via eas credentials.
3. Submit PEM certificate to Google; wait for approval.
4. Future EAS builds use new upload key; user-facing app signing key unchanged.

What this demonstrates:

• Upload vs app signing - two keys, two purposes.
• EAS remote credentials - team builds without passing .jks in Slack.
• assetlinks.json - must use Play App Signing cert for production links.
• Upload key rotation - supported; app signing key stays stable.

Deep Dive

How It Works

• APK/AAB signing - Gradle signs the release artifact with your upload private key before upload to Play.
• Play App Signing - Google strips your signature, re-signs with the app signing key, and serves that binary to users.
• Certificate fingerprints - SHA-256 of the public cert identifies your app for App Links, Firebase, Google Sign-In, and API key restrictions.
• EAS Build - pulls credentials from Expo's credential service at build time; injects keystore, key alias, and passwords into Gradle signing config.
• Version code - monotonic integer per applicationId; Play rejects duplicates. EAS can auto-increment via eas.json.

Key Types

EAS Credentials Commands

# Non-interactive CI - credentials already configured on Expo account
eas build --platform android --profile production --non-interactive

Gradle Signing (Bare Reference)

Expo prebuild generates signing config; bare teams may see:

// android/app/build.gradle (release) - EAS injects via env in cloud builds
signingConfigs {
    release {
        storeFile file(MYAPP_UPLOAD_STORE_FILE)
        storePassword MYAPP_UPLOAD_STORE_PASSWORD
        keyAlias MYAPP_UPLOAD_KEY_ALIAS
        keyPassword MYAPP_UPLOAD_KEY_PASSWORD
    }
}

Do not commit passwords - EAS uses encrypted secrets; local gradle.properties entries belong in .gitignore.

Fingerprint Cheat Sheet

Gotchas

• assetlinks.json uses upload key fingerprint - Production links fail verification. Fix: Play Console app signing SHA-256.
• Committing *.jks to git - Key compromise; Play may force rotation. Fix: EAS remote credentials + vault backup only.
• Reusing debug keystore for release - Play rejects; security disaster. Fix: Separate upload keystore via EAS.
• Version code not incremented - eas submit fails "version code already used." Fix: autoIncrement: true in eas.json or bump android.versionCode in app.config.
• Package name mismatch - com.example.shopapp in config vs keystore registered to old package. Fix: New Play listing or correct applicationId before first publish.
• Opting out of Play App Signing - Loses upload key recovery path. Fix: Accept Play App Signing on new listings.

WTI5a1pXZDFhV1JsY3k1cGIzeGpaMmx2T1RFNGZESXdNall3Tnc9PQ==

Alternatives

FAQs

Related

• Android App Links - SHA-256 fingerprint in assetlinks.json
• Internal Testing Tracks - ship signed AABs to testers before production
• Permissions & Play Policy - Play Console compliance (separate from signing)
• ../eas-build/android-keystores-and-signing/android-keystores-and-signing.md - EAS-focused signing deep dive
• ../eas-build/eas-submit/eas-submit.md - automated Play uploads

Stack versions: This page was written for React 19.2.3, React Native 0.86.0, and Expo SDK 57 (expo ~57.0.4).