Use Play App Signing and keep only an upload key on your build side. Google's documentation says that with it, a lost or compromised upload key can be reset, whereas for apps not using it, losing the signing key means losing the ability to update the app. For a game with players, that difference is large.
Two keys, two jobs
Android developer documentation describes the two keys:
- App signing key. Used to sign the APKs installed on a user's device. It is private and must be kept secret.
- Upload key. You keep it and use it to sign your app bundle for upload. Google uses the upload certificate to verify your identity, then signs the APKs with the app signing key for distribution.
The page says that once Play App Signing is configured, with either a generated key or one you supply, you cannot retrieve a copy of the app signing key, and Google may keep a backup for disaster recovery.
Why it matters for games
A signing key is the identity of your game. Players update only if the new build is signed by the same identity. If that key leaks, someone could sign a lookalike build. If it is lost, you cannot publish updates to the same app.
Game studios have several places a key can leak: a build server, a shared drive, a contractor's laptop, or a repository where someone committed a keystore file. A split between upload key and signing key limits the damage of any of those. The documentation says a separate upload key allows you to request an upload key reset if it is lost or compromised, and that you can keep uploading updates to the original app even if you change upload keys.
Setup steps
The documentation gives a high level path for a new app:
- Generate an upload key and keystore.
- Sign your app with the upload key.
- Configure Play App Signing.
- Upload your app to Google Play.
- Prepare and roll out the release.
For an app already published with its own signing key, the page describes signing with that key first and then enrolling, and mentions a key upgrade option if a key is compromised or you want to migrate to a cryptographically stronger one.
Housekeeping that studios forget
| Item | Practice |
|---|---|
| Keystore file | Never commit it. Store it in a secrets manager or vault the build job reads at run time |
| Keystore password | Keep separate from the file, and not in build scripts |
| Who can sign | Name the people and build jobs; remove contractors on exit |
| Backup | Keep an encrypted backup of the upload key in a second controlled location |
| Reset path | Write down who in your organization can request an upload key reset in the Play Console |
| Engine settings | Unity, Unreal and Godot all let you point to a keystore; check that debug keys are never used for release builds |
The last row is general advice; check your engine's documentation for exact settings.
When something goes wrong
If you suspect the upload key leaked, request a reset through the Play Console as Google's documentation describes, rotate the build credentials, and review who had access. If the app signing key was compromised, the documentation describes a key upgrade option.
Safeguard's SBOM and dependency scanning covers what your game build depends on, and a free scan is at gold.safeguard.sh/scan. Choosing and protecting the signing keys is your team's decision and sits outside that scan.
Quick check
Can I download my app signing key from Google later?
Google's documentation says you cannot retrieve a copy of the app signing key after configuring Play App Signing.
What if I lose the upload key?
With Play App Signing, you can request an upload key reset in the Play Console, per Google's documentation.
What if I never enrolled?
The same page says that for apps without Play App Signing, losing the signing key means losing the ability to update the app.
Sources
Last reviewed: 19 October 2026.
