--- title: "Let the store hold the signing key and ยท Agent Wranglers" url: https://agentwranglers.se/playbook/mobile-apps/signing-and-release/signing-keys updated: 2026-10-21 licence: "CC BY 4.0" licence_url: https://creativecommons.org/licenses/by/4.0/ --- # Let the store hold the signing key and back up the upload key For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Signing and release](https://agentwranglers.se/playbook/mobile-apps/signing-and-release.md). By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers). Updated 2026-10-21. - ID: MOB-7 - Level: Required - Chapter: [Signing and release](https://agentwranglers.se/playbook/mobile-apps/signing-and-release) - Rule: Use Play App Signing so Google holds the Android app signing key. Keep the upload key and its passwords in a secrets store with a second copy offline. - Risk: The app down or unusable - How: An Android app signed with a key you lose can never be updated again, and the key cannot be made again. Play App Signing is required for apps created since August 2021. Then a lost upload key can be reset in Play Console, and updates go on. Apps on the old self-signed path should move to it. On iOS, signing certificates come from your Apple developer account, so guard that account with [keep tested break-glass accounts](https://agentwranglers.se/playbook/infrastructure/identity-and-access/break-glass-access). Store the keystore file as the [secrets store rule](https://agentwranglers.se/playbook/engineering/running-in-production/secrets-store) says, never in the repository. - Check: Play Console shows Play App Signing on for every Android app. Once a year, a person restores the upload keystore from the offline copy and signs a test build that Play Console accepts. ## Sources - [Android, Sign your app](https://developer.android.com/studio/publish/app-signing) ## Related rules - [Keep tested break-glass accounts](https://agentwranglers.se/playbook/infrastructure/identity-and-access/break-glass-access) in Infrastructure - [Keep secrets in a secrets store](https://agentwranglers.se/playbook/engineering/running-in-production/secrets-store) in Engineering **For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `Agent Wranglers mobile apps playbook`. In code you write, add a comment next to it with the same link. - Next: [Sign release builds only in CI](https://agentwranglers.se/playbook/mobile-apps/signing-and-release/sign-in-ci) - [Signing and release](https://agentwranglers.se/playbook/mobile-apps/signing-and-release)