If your app uses Play App Signing and you lose the upload key, you are not locked out. Create a new upload key, export its certificate as a PEM file, and request an upload key reset in Play Console. The reset does not change the app signing key that users receive.
Two keys, two jobs
Google's documentation describes two keys under Play App Signing. The app signing key signs the APKs delivered to devices, and Google says it never changes during the app's life. The upload key signs the bundle or APK you upload to Google Play.
Google manages and protects the signing key in its key management service. After you set up Play App Signing, you cannot retrieve a copy of the signing key. That is the trade: you hold the upload key, and Google holds the key that matters most for users.
Why this is recoverable
Without Play App Signing, Google's page is blunt: if you lose your app's signing key, you lose the ability to update your app. With it, losing the upload key is a support request. Google states that resetting the upload key does not affect the app signing key used to re-sign APKs before delivery.
The reset steps
Google's help article lists these steps.
- Create a new upload key in Android Studio.
- Export the certificate to PEM format with the keytool utility:
keytool -export -rfc -keystore upload-keystore.jks -alias upload -file upload_certificate.pem
- In Play Console, go to Protected with Play, then Play Store protection, then Manage Play app signing.
- In the Upload key certificate section, choose Request upload key reset.
- Enter a reason for the reset.
- Upload the PEM file and submit the request.
You need admin permission to configure Play App Signing. Menu names change, so follow the current help article if the labels differ.
What to do while you wait
- Do not publish a second copy of the old key in a new place to "make it easier". The reset exists so you do not have to.
- Update your CI secrets with the new upload keystore only after Google confirms the reset.
- Note the new certificate fingerprint in your release records.
Prevent the next loss
A lost key is usually a process failure, not a technology one. Keep the upload keystore in a managed secret store, record who can use it, and keep an encrypted offline backup with a named owner. Google's guidance for self-managed keys also says to use strong passwords for the keystore and key, and not to give or lend anyone your private key.
If a key was compromised rather than lost, Google's article says the same reset route applies, since it covers a lost or compromised upload key. Treat a compromise as an incident and review who had access.
Apps that manage their own key
Google notes that self-managed keys apply to apps created before August 2021. If you are in that group, you are responsible for securing the key and keystore, and losing the key means losing the ability to update. Consider whether to move to Play App Signing, which Google describes for existing apps as a transfer of a copy of your original key.
Where Safeguard fits
Key recovery restores your ability to ship. It does not check what you ship. Safeguard scans dependencies and builds SBOMs for each release, with a free scan at gold.safeguard.sh/scan.
Quick check
Does an upload key reset change the key users get?
No. Google states that a reset does not affect the app signing key used to re-sign APKs before delivery.
Can I recover a lost signing key under Play App Signing?
Google says you cannot retrieve a copy of the app signing key after setup. You do not need to, because Google holds it and you can reset the upload key.
Sources
Last reviewed: 19 October 2026.
