# Android: Import the upload key

An app that is already on Google Play must keep being signed with its original upload key; you import that key into the platform once.

> Source: https://www.application-platform.com/en/docs/android-keystore-import/

When the platform sets up an Android app, it generates its own **upload key**, with which the pipeline signs every app bundle before upload. If the app is already published on Google Play, Google rejects bundles signed with a different key; the pipeline then reports *Android App Bundle was signed with the wrong key*. You then import the original key.

For the import you only need the upload key as a `.jks` file, not the app signing key, which Google manages itself with **Play App Signing**.

## Look up the fingerprint in the Play Console

1. Open the [Google Play Console](https://play.google.com/console) and select the app.
2. Go to **Release** → **Setup** → **App integrity** (or **App signing**).
3. Under **Upload key certificate**, note the **SHA-1 fingerprint**.

## Obtain the keystore file

Export the upload keystore from the previous build environment, such as Android Studio or the former CI system, or from the team's password manager. The file is often called `upload-keystore.jks`. You also need the keystore password, a key password if it differs, and the alias of the key, often `upload`.

## Import in the platform

1. Open the project for editing.
2. Next to the **Android bundle ID**, click the **key icon** (advanced).
3. Choose **Import existing upload key**.
4. Upload the `.jks` file and enter the passwords and the alias.
5. Click **Import**. The platform stores the values encrypted and shows the **SHA-1** of the imported key.

The displayed SHA-1 must match the fingerprint from the Play Console; if it differs, you have most likely chosen the wrong `.jks` file or alias. After the import, the platform updates the variables for Terraform and GitLab CI, and the next Android pipeline signs with the imported key.

{{< docnote >}}
The import is only available once the project has been saved; for a new project, create it first and then open it for editing.
{{< /docnote >}}

## Whitelabel apps

For [whitelabel projects]({{< relref "whitelabel-apps" >}}) with a separate bundle ID per variant, you import the key next to the bundle ID of each variant. The pipeline uses variant-specific variables following the pattern `ANDROID_KEYSTORE_BASE64__{variant_ci_key}`. Special characters in the variant ID become underscores, so `kvb-live` becomes `kvb_live`; the `APP_ID` variable keeps the unchanged variant ID.

## Back to the platform key

With **Reset to platform key** in the import dialog, you delete the imported key, and the platform generates a new one on the next sync. That only makes sense for apps without a store listing.