Android signing and the Play Store
Read this before you plan a Play Store release. There is a real limitation here, and knowing it now is better than finding it at the upload screen.
What Memberside signs with today
Section titled “What Memberside signs with today”The build pipeline has no signing configuration of its own. A release build is therefore signed with the Android debug certificate.
Uploading a keystore of your own is not yet supported in the builder. If a Play release is your immediate goal, get in touch before you plan around it.
What you can do today
Section titled “What you can do today”- Install the APK directly on any Android device, including devices in your community. Android warns about the source; that is expected.
- Share the APK with testers by any means you like.
- Use the app internally, at full functionality. Nothing about how the app works depends on the signing certificate.
The signing fingerprint
Section titled “The signing fingerprint”Each build records the SHA-1 fingerprint of the certificate it was signed with, and the builder shows it when you configure social sign-in.
Google requires that fingerprint to authorise native Google sign-in for your package. The builder surfaces it rather than asking you to extract it yourself.
It changes when the signing certificate changes. If signing moves to a key of your own, native Google sign-in has to be re-authorised with the new fingerprint, or it stops working in the next build.
What Play will require when this lands
Section titled “What Play will require when this lands”Worth knowing in advance, because these are your decisions rather than Memberside’s:
A Google Play developer account. One-time fee, registered to you or your organisation. Memberside cannot submit on your behalf — see iOS builds for why this is a rule rather than a preference, and the same reasoning applies on Android.
Play App Signing. Google holds the app signing key and you hold an upload key. This is the default for new apps and the option to prefer: losing an upload key is recoverable, losing an app signing key is not.
A stable application ID. Your package name — for example
app.memberside.yourcommunity — is permanent once published. It cannot be
changed later without shipping a different app that your members must install
fresh.
Store listing material. Title, short and full description, a feature graphic, screenshots at several sizes, a privacy policy URL, and content rating answers. None of this comes from Memberside.
When it does not work
Section titled “When it does not work”| Symptom | Cause | Fix |
|---|---|---|
| Play rejects the bundle as debug-signed | Builds are signed with the debug certificate today | Get in touch; keystore support is not in the builder |
| Google sign-in fails in the built app, works in preview | The SHA-1 is not authorised in Google Cloud | Copy the fingerprint from the social sign-in settings and add it to your OAuth client |
| Sign-in broke after a rebuild | The signing certificate changed | Re-authorise the new SHA-1 |