# Android code signing using the Android Sign Step

You can create a signed APK or AAB using the [**Android Sign**](https://github.com/bitrise-steplib/steps-sign-apk) Step in your Bitrise Workflow.

The **Android Sign** Step is not required if signing is configured in your project's `build.gradle` file. If so, running the [**Android Build**](https://github.com/bitrise-steplib/bitrise-step-android-build) Step (or the [**Gradle Runner**](https://github.com/bitrise-io/steps-gradle-runner) Step) signs the output (APK or AAB) automatically. Nevertheless, we recommend that you use the **Android Sign** Step to sign your project in an easy and secure way.

To sign your app with the Android Sign Step:

1. [Upload your keystore file to Bitrise](/bitrise-ci/code-signing/android-code-signing/uploading-android-keystore-files-to-bitrise). This creates the following Environment Variables from your keystore's credentials: 
- `$BITRISEIO_ANDROID_KEYSTORE_URL`
- `$BITRISEIO_ANDROID_KEYSTORE_PASSWORD`
- `$BITRISEIO_ANDROID_KEYSTORE_ALIAS`
- `$BITRISEIO_ANDROID_KEYSTORE_PRIVATE_KEY_PASSWORD` 
1. Add the [**Android Sign**](https://github.com/bitrise-steplib/steps-sign-apk) Step to your Workflow, after the Step that builds your APK or AAB file.

   The Step's **Keystore url**, **Keystore password**, **Key alias**, and **Key password** inputs default to the Environment Variables generated from your keystore credentials, so you don't need to set them if you uploaded a single keystore file. If you uploaded multiple keystore files or set a custom keystore ID, point these inputs at the matching Environment Variables instead (see [Uploading Android keystore files to Bitrise](/bitrise-ci/code-signing/android-code-signing/uploading-android-keystore-files-to-bitrise)).
1. Optional: on the **Signer tool** input, choose whether the Step signs with `apksigner`, `jarsigner`, or decides automatically (the default: `apksigner` for APKs, `jarsigner` for AABs). AAB files can only be signed with `jarsigner` regardless of this setting.
1. Optional: on the **APK Signature Scheme** input, choose which signature scheme(s) `apksigner` applies, or leave it on automatic (the default) to let it decide based on your app's minimum and target SDK versions.

Once the Step runs, it produces a signed APK or AAB. Use the signed output in a deploy Step, for example the [**Google Play Deploy**](https://github.com/bitrise-io/steps-google-play-deploy) Step or the **Deploy to Bitrise.io** Step, which publishes it on the **Artifacts** tab. You can also use [Release Management](/release-management) to deploy your app once you've built a signed artifact.

:::note[Downloading your keystore file]

You can download your keystore file to the project directory using the **[File Downloader](https://github.com/bitrise-steplib/steps-file-downloader)** Step:

```yaml
- file-downloader:
   inputs:
   - source: $BITRISEIO_ANDROID_KEYSTORE_URL
   - destination: "$HOME/keystores/my_keystore.jks" #native android#
```

If a Step requires the keystore file, make sure to include that Step AFTER the [**File Downloader**](https://github.com/bitrise-steplib/steps-file-downloader) Step.

After this Step, `my_keystore.jks` will be available at `$HOME/keystores/my_keystore.jks`.

:::