Signing Android Release Builds in Android Studio

Signing Android Release Builds in Android Studio

The problem is that Android Studio can assemble a debug APK with no signing setup, but a release APK or Android App Bundle (AAB) for distribution must be signed with a private key. Google Play rejects unsigned artifacts, and an existing app cannot be updated with a different signing certificate. The useful takeaway is to define a signing config in the module-level build file, assign it to the release build type, and verify the produced artifact before uploading it anywhere.

Prerequisites

• Android Studio with a project open and at least one application module, typically `app`.
• The module uses `build.gradle` with the Groovy DSL; Kotlin DSL syntax differs.
• Android Gradle Plugin 8.x and Gradle 8.x are assumed; behavior may differ with other versions.
• File-system permission to create a keystore and modify files inside the project directory.

Step 1: Generate a keystore

A keystore is a binary file that stores private keys and certificates. Use the JDK `keytool` command in a system terminal or Android Studio's embedded Terminal tab:

keytool -genkeypair -v -keystore /release-keystore.jks \
  -alias  -keyalg RSA -keysize 2048 -validity 10000

Where to run: any directory where you can create files. Do not store the keystore inside a publicly shared project folder. Required permissions: write access to the target directory. Risks: losing the keystore file or its passwords means you cannot sign future updates for apps released under that key. Never hard-code passwords in the build file.

Step 2: Add the signing config to the module build file

Open `app/build.gradle`. Add `signingConfigs` inside the `android` block and assign it to `buildTypes.release`. Example configuration:

android {
    ...
    signingConfigs {
        release {
            storeFile file("/absolute/path/to/release-keystore.jks")
            storePassword System.getenv("RELEASE_STORE_PASSWORD")
            keyAlias "my-release-key"
            keyPassword System.getenv("RELEASE_KEY_PASSWORD")
        }
    }
    buildTypes {
        release {
            signingConfig signingConfigs.release
            minifyEnabled false
            proguardFiles getDefaultProguardFile('proguard-android-optimize.txt'), 'proguard-rules.pro'
        }
    }
}

Reading passwords from environment variables keeps secrets out of version control. If a variable is missing, Gradle fails the task instead of silently producing an unsigned build.

Step 3: Sync the project and build the release artifact

1. Open the Gradle tool window from the right sidebar in Android Studio.
2. Expand the module, then `Tasks` > `build`.
3. Run `assembleRelease` to produce an APK, or `bundleRelease` to produce an AAB.

Expected check: the Gradle console ends with `BUILD SUCCESSFUL`.

Step 4: Verify the signed artifact

Check the expected output directory:

• APK: `app/build/outputs/apk/release/app-release.apk`
• AAB: `app/build/outputs/bundle/release/app-release.aab`

Confirm the signature using the SDK's `apksigner` tool:

apksigner verify --verbose app/build/outputs/apk/release/app-release.apk

A successful run reports that the APK is verified. If the tool reports that the file is not signed, the signing config was not applied to the release build type.

Diagnostic decision: signed build installs on some devices but not others

If installation fails, compare the device API level with `minSdkVersion` in the module's `defaultConfig` block. If the error mentions a certificate mismatch, the same app package was previously installed under a different signing key; uninstall the existing app before reinstalling the release build.

Limitations

• Absolute keystore paths break when the project moves to another machine; use environment variables for both the path and the passwords.
• This guide assumes AGP 8.x and Gradle 8.x. Older versions may use different defaults for signing schemes.
• Local build steps do not cover CI pipelines, which require injecting the keystore and passwords as protected secrets.

Recovery

Editing `build.gradle` changes project state. If the release build fails after adding the signing config, revert the `signingConfigs` block and the `buildTypes.release` assignment, sync the project, and confirm `assembleDebug` still works before retrying.

Practical check

Run `assembleDebug` to confirm the project still builds, then run `assembleRelease` and confirm a non-zero-sized file appears in `app/build/outputs/apk/release/`.