Fix Play Store Upload Key Error

1

1. What this fixes

#

If Play Console rejects your AAB with an error like "Your Android App Bundle is signed with the wrong key", you're hitting this. Older Appwright versions signed each build with a different random key. New Appwright builds use a stable per-package key - but Play Console still expects the old key it has on file. You need to RESET the upload key once. Your live users are NOT affected: Google's app signing key (the one on their devices) never changed. This only updates what Google accepts from you as the developer.

2

1. Rebuild with the latest Appwright

#

Build your app once with the current Appwright version. Along with the AAB, the build now produces three signing files in your Downloads folder:

• <appname>_signkey.p12 - the full signing key (KEEP PRIVATE)
• <appname>_upload_cert.pem - the certificate only (this is what you upload to Google)
• <appname>_signkey_info.txt - readme with credentials

You only need upload_cert.pem for the reset. Hold onto the .p12 - you'll need it for future updates.

3

1. Open Play Console → App integrity

#

On a computer:

1. Go to Play Console and open the affected app.
2. Left menu: Test and release → App integrity.
3. Open the App signing tab.
4. Scroll to Upload key certificate.
5. Click Request upload key reset.

Open Play Console →

4

1. Fill in the reset form

#

On the reset form:

• Reason: choose "I have lost or compromised my existing upload key."
• Upload the upload_cert.pem file from your Downloads folder.
• Submit.

That's it on your side. Google reviews within 24-48 hours (often faster). You'll get an email when they approve.

5

1. Upload the new AAB after approval

#

Once Google approves, the new upload key is active. Upload the AAB you built in step 2 (or any newer AAB built with the same Appwright version). Future updates with the SAME package name will all match automatically - you'll never have to do this reset again.

6

1. What end-users see

#

Nothing. Their installed app is signed with Google's app signing key, which is unchanged. After the reset, your update installs over the existing app like any normal Play Store update - no reinstall, no data loss, no warning.

7If something doesn't work#

• "upload_cert.pem not found in Downloads" - make sure you built the app with the latest Appwright AFTER this guide was added. Older builds only produced .p12; you'd have to derive the .pem yourself.

• "Reset request denied" - Google denies a few. Common cause: a different cert was uploaded than the one matching your new builds. Rebuild and download a fresh upload_cert.pem before requesting again.

• "My app was published as an APK, not an AAB" - this guide doesn't apply: APK-only apps that opted OUT of Play App Signing can't recover. The only path is a new app under a new package name.

• Google Sign-In, Facebook Login, or Firebase Auth stops working after reset - those use the APP SIGNING certificate fingerprint (SHA-1/SHA-256), which is Google's and DID NOT CHANGE. If they broke, the problem is elsewhere - not the reset.