Android: Import the upload key

When the platform sets up an Android app, it generates its own upload key, with which the pipeline signs every app bundle before upload. If the app is already published on Google Play, Google rejects bundles signed with a different key; the pipeline then reports Android App Bundle was signed with the wrong key. You then import the original key.

For the import you only need the upload key as a .jks file, not the app signing key, which Google manages itself with Play App Signing.

Look up the fingerprint in the Play Console

1. Open the Google Play Console and select the app.
2. Go to Release → Setup → App integrity (or App signing).
3. Under Upload key certificate, note the SHA-1 fingerprint.

Obtain the keystore file

Export the upload keystore from the previous build environment, such as Android Studio or the former CI system, or from the team’s password manager. The file is often called upload-keystore.jks. You also need the keystore password, a key password if it differs, and the alias of the key, often upload.

Import in the platform

1. Open the project for editing.
2. Next to the Android bundle ID, click the key icon (advanced).
3. Choose Import existing upload key.
4. Upload the .jks file and enter the passwords and the alias.
5. Click Import. The platform stores the values encrypted and shows the SHA-1 of the imported key.

The displayed SHA-1 must match the fingerprint from the Play Console; if it differs, you have most likely chosen the wrong .jks file or alias. After the import, the platform updates the variables for Terraform and GitLab CI, and the next Android pipeline signs with the imported key.

Whitelabel apps

For whitelabel projects with a separate bundle ID per variant, you import the key next to the bundle ID of each variant. The pipeline uses variant-specific variables following the pattern ANDROID_KEYSTORE_BASE64__{variant_ci_key}. Special characters in the variant ID become underscores, so kvb-live becomes kvb_live; the APP_ID variable keeps the unchanged variant ID.

Back to the platform key

With Reset to platform key in the import dialog, you delete the imported key, and the platform generates a new one on the next sync. That only makes sense for apps without a store listing.