Code Signing (Android)
Keystore management.
Credential and external action gate
An Android keystore and its password are private signing credentials. Do not generate, import, download, replace, or expose a keystore; run eas credentials; or alter Play App Signing without explicit owner confirmation of the exact developer account, app, and recovery plan. Keep keystores and passwords out of the repository, prompts, screenshots, and logs.
Two keys with Play App Signing
| Key | Holder | Use |
|---|---|---|
| Upload key | You (EAS) | Sign AAB before upload |
| Signing key | Sign APKs delivered to users |
Lose upload key → Google reissues (Play App Signing benefit). Lose signing key → not possible (Google has it).
EAS-managed keystore after confirmation
basheas credentials # → Android → set up new keystore
EAS generates keystore (.jks), stores on their servers. Download anytime.
DIY keystore (if migrating, after confirmation)
bashkeytool -genkey -v -keystore upload-key.jks \ -keyalg RSA -keysize 2048 -validity 25000 \ -alias upload-key
Upload to EAS only after the owner has approved the account and credential-storage plan:
basheas credentials # → Android → use existing keystore
Extract SHA-1/SHA-256 (for Firebase)
bash# From keystore (upload key) keytool -list -v -keystore upload-key.jks -alias upload-key # From Play Console (signing key) # Play Console → Setup → App integrity → copy SHA values
Add to Firebase
Firebase Console → Project Settings → Your apps → Android app → Add fingerprint:
- Both upload key SHA-1 + signing key SHA-1
- Both upload key SHA-256 + signing key SHA-256
This makes Google Sign-In and Dynamic Links work in dev + production.
Common gotchas
- "DEVELOPER_ERROR" on Google Sign-In → SHA-1 not in Firebase
- Different SHA in dev (your keystore) vs production (Play's) → add BOTH
- Keystore password lost → can't recover unless using Play App Signing reissue
- ".jks vs .keystore" → same format, just naming
Pair with
set-up-play-app-signingadd-google-signin-credential-manager


