Name the identities before comparing them
| Identity | Main purpose |
|---|---|
| Upload key | Authenticate the artifact submitted to Play |
| App-signing key | Sign the APKs users install through Play |
| Debug key | Sign local development builds |
| Internal-sharing certificate | May identify builds delivered by the separate internal app-sharing path |
Do not label every certificate in a spreadsheet simply “release SHA.” Include the distribution path and certificate algorithm. Play App Signing documentation.
Find current certificate information
Open the selected app in Play Console and locate Play App Signing under Protected with Play. The current help documentation references Play Store distribution/protection in this area. Account UI labels and available actions can vary; use the signing page's certificate sections rather than assuming an old Setup → App integrity path still applies.
Download or copy the public certificate information from the relevant section. Never try to export a private key from an APK certificate viewer.
Match API registrations to the installed build
For Firebase authentication, Maps or another certificate-bound integration, register the fingerprint required by that service for the actual installed build. A local signed APK and a Play-installed release may use different certificates even when the package name and version are identical.
Test through the intended track. Internal app sharing and ordinary internal testing are distinct workflows; a successful test through one does not establish the same signing identity for the other.
Treat key reset and rotation differently
An upload-key reset replaces the credential used for future uploads. An app-signing-key upgrade affects the signing lineage and device compatibility arrangements. Do not perform one operation to solve a problem belonging to the other.
Review the options and timing shown for your app before acting. Current signing documentation includes newer platform-specific arrangements, so old universal claims about exactly one permanent fingerprint can be misleading. Android app signing.
Keep a release certificate register
For each distribution path, record the application ID, certificate fingerprints, owner, purpose and effective date. Associate the register with release version codes and CI configuration changes.
APKLint's certificate inspection can help compare a built APK with that register. It does not verify Console ownership, perform a reset or establish that a certificate's descriptive organization name is trustworthy. Use a cryptographic verifier when package integrity is the question.
Sources and further reading
Reference review: 22 September 2026. Examples illustrate the workflow; check your installed versions, release artifact and account-specific Console requirements before applying them. This guide is not a claim that APKLint executed your project or verified your private account.
Android inspection tools and practical release guides. About APKLint · Report a correction
