Android Keystores & Signing

Upload keys and Play App Signing interplay - the EAS-focused cookbook for Android release identity on Expo SDK 57.

Recipe

Quick-reference recipe card - copy-paste ready.

# First production build - let EAS generate the keystore
eas build --platform android --profile production
 
# Inspect remote credentials (admin)
eas credentials --platform android
 
# CI production build
eas build --platform android --profile production --non-interactive

// eas.json
{
  "build": {
    "production": {
      "distribution": "store",
      "android": {
        "buildType": "app-bundle"
      }
    },
    "preview": {
      "distribution": "internal",
      "android": {
        "buildType": "apk"
      }
    }
  }
}

// app.config.ts
export default {
  expo: {
    version: "2.4.0",
    android: {
      package: "com.example.shopapp",
      versionCode: 240001,
    },
  },
};

When to reach for this:

• First eas build --platform android prompts for keystore generation.
• Play Console rejects an AAB: "signed with the wrong key."
• App Links verification fails - fingerprint mismatch in assetlinks.json.
• Migrating from a legacy keystore on a former employee's laptop.

Working Example

Step 1 - Enable Play App Signing (new app)

1. Create the app in Google Play Console.
2. On first AAB upload, accept Google Play App Signing (mandatory for new apps).
3. Google holds the app signing key; your team keeps the upload key.

Step 2 - Generate upload credentials with EAS

eas credentials --platform android

? What do you want to do? › Set up a new keystore
? Generate a new Android Keystore? › Yes

EAS stores:

• Keystore file (encrypted)
• Keystore password, key alias, key password

Step 3 - Production AAB build

eas build --profile production --platform android
eas submit --platform android --profile production --latest

Step 4 - Register App Links with Play signing fingerprint

# Play Console → Release → App integrity → App signing key certificate
# Copy SHA-256 - NOT the upload key fingerprint

// https://shop.example.com/.well-known/assetlinks.json
[
  {
    "relation": ["delegate_permission/common.handle_all_urls"],
    "target": {
      "namespace": "android_app",
      "package_name": "com.example.shopapp",
      "sha256_cert_fingerprints": ["PLAY_APP_SIGNING_SHA256_HERE"]
    }
  }
]

See Signing & Play App Signing for the full Play Console walkthrough.

Upload Key vs App Signing Key

# Upload key fingerprint (EAS credentials download - admin only)
eas credentials --platform android
 
# Debug keystore - local development ONLY
keytool -list -v -keystore ~/.android/debug.keystore \
  -alias androiddebugkey -storepass android -keypass android | grep SHA256

• Never put the debug keystore fingerprint in production assetlinks.json
• If Play App Signing is disabled (legacy apps), the upload key is the app signing key - treat loss as catastrophic

Migrating an Existing Keystore

Brownfield apps already on Play must upload the same upload key EAS will use:

eas credentials --platform android
# Choose: Upload existing keystore
# Provide: .jks path, store password, key alias, key password

Checklist:

1. Export keystore from the previous CI system or developer machine
2. Confirm fingerprint matches Play Console → App integrity → Upload key certificate
3. Run a test eas build and eas submit to internal track before production
4. Revoke local copies after EAS upload succeeds - EAS is now source of truth

Credential Recovery

Lost upload key (Play App Signing enabled)

1. Play Console → App integrity → Request upload key reset
2. Generate a new upload key via eas credentials --platform android
3. Submit the new certificate to Google for approval
4. Rebuild and upload AAB - users unaffected (app signing key unchanged)

Lost upload key (Play App Signing disabled)

• No recovery path - you cannot publish updates to the same package name
• This is why Play App Signing is mandatory for new apps

Rotating off a teammate

# Admin downloads credentials backup (one-time export) and stores in team vault
eas credentials --platform android
 
# Remove local .jks from laptops - CI uses EAS remote credentials only

eas.json Signing Options

{
  "build": {
    "production": {
      "android": {
        "buildType": "app-bundle",
        "gradleCommand": ":app:bundleRelease"
      }
    },
    "development": {
      "android": {
        "buildType": "apk",
        "withoutCredentials": false
      }
    }
  }
}

• buildType": "app-bundle" - required for Play production
• buildType": "apk" - preview / internal sideload without Play
• withoutCredentials": true - unsigned debug-style builds only; rare for RN apps

FAQs

{
  "cli": { "appVersionSource": "remote" },
  "build": {
    "production": { "autoIncrement": true }
  }
}

Related

• EAS Build Basics - first cloud Android build
• EAS Submit - Play Console upload automation
• Internal Distribution - APK links vs Play internal track
• ../android-platform/signing-and-play-app-signing/signing-and-play-app-signing.md - Play Console app integrity deep dive
• ../android-platform/internal-testing-tracks/internal-testing-tracks.md - internal → production promotion
• ../android-platform/android-basics-for-rn-devs/android-basics-for-rn-devs.md - applicationId and Gradle basics
• ../cng-prebuild/prebuild-basics/prebuild-basics.md - package name from app.config
• ../expo-rules/release-and-ota-rules/release-and-ota-rules.md - native builds vs OTA

Stack versions: This page was written for React 19.2.3, React Native 0.86.0, and Expo SDK 57 (expo ~57.0.4).