Skip to main content

Android code signing using the Android Sign Step

You can create a signed APK or AAB using the Android Sign Step in your Bitrise Workflow.

The Android Sign Step is not required if signing is configured in your project's build.gradle file. If so, running the Android Build Step (or the Gradle Runner Step) signs the output (APK or AAB) automatically. Nevertheless, we recommend that you use the Android Sign Step to sign your project in an easy and secure way.

To sign your app with the Android Sign Step:

  1. Upload your keystore file to Bitrise. This creates the following Environment Variables from your keystore's credentials:
  • $BITRISEIO_ANDROID_KEYSTORE_URL
  • $BITRISEIO_ANDROID_KEYSTORE_PASSWORD
  • $BITRISEIO_ANDROID_KEYSTORE_ALIAS
  • $BITRISEIO_ANDROID_KEYSTORE_PRIVATE_KEY_PASSWORD

  1. Add the Android Sign Step to your Workflow, after the Step that builds your APK or AAB file.

    The Step's Keystore url, Keystore password, Key alias, and Key password inputs default to the Environment Variables generated from your keystore credentials, so you don't need to set them if you uploaded a single keystore file. If you uploaded multiple keystore files or set a custom keystore ID, point these inputs at the matching Environment Variables instead (see Uploading Android keystore files to Bitrise).

  2. Optional: on the Signer tool input, choose whether the Step signs with apksigner, jarsigner, or decides automatically (the default: apksigner for APKs, jarsigner for AABs). AAB files can only be signed with jarsigner regardless of this setting.

  3. Optional: on the APK Signature Scheme input, choose which signature scheme(s) apksigner applies, or leave it on automatic (the default) to let it decide based on your app's minimum and target SDK versions.

Once the Step runs, it produces a signed APK or AAB. Use the signed output in a deploy Step, for example the Google Play Deploy Step or the Deploy to Bitrise.io Step, which publishes it on the Artifacts tab. You can also use Release Management to deploy your app once you've built a signed artifact.

Downloading your keystore file

You can download your keystore file to the project directory using the File Downloader Step:

- file-downloader:
   inputs:
   - source: $BITRISEIO_ANDROID_KEYSTORE_URL
   - destination: "$HOME/keystores/my_keystore.jks" #native android#

If a Step requires the keystore file, make sure to include that Step AFTER the File Downloader Step.

After this Step, my_keystore.jks will be available at $HOME/keystores/my_keystore.jks.