Google Play "signed with the wrong key" — why it happens and how to catch it in 2 seconds

You build your release AAB, upload it to Google Play, and after the whole build + upload flow you get:

"Your Android App Bundle is signed with the wrong key. Ensure that your App Bundle is signed with the correct signing key and try again."

The build was fine. The code was fine. The signature wasn't. And Google only tells you at the very end — after the build, the download, and the Play Console upload. On CI pipelines (EAS, Bitrise, GitHub Actions) this mistake easily costs an hour or more.

Why it happens

Google Play permanently associates your app with the certificate of your upload key. Every release must be signed with that exact key. The error means your artifact was signed with something else. The usual suspects:

• The debug keystore — the release build type isn't wired to signingConfigs.release in android/app/build.gradle, so Gradle silently falls back to debug signing
• A teammate's local keystore — everyone on the team has their "own" release keystore, and they don't match
• A regenerated keystore — the original was lost, someone created a new one with the same alias and assumed it would work (it won't; the fingerprint is different)
• CI credentials drift — the keystore stored in your CI secrets isn't the one Play expects

Diagnosing it manually

The JDK's keytool can print the signing certificate of any signed APK/AAB:

keytool -printcert -jarfile app-release.aab

Compare the SHA1 with Play Console → Setup → App signing → Upload key certificate. If the Owner line says CN=Android Debug, your artifact is debug-signed. If the fingerprints simply differ, you signed with the wrong keystore — find the right one and fix your signing config.

If you've genuinely lost the original keystore, Play Console lets you request an upload key reset (Setup → App signing), which takes a couple of days.

Catching it before the upload

Manual fingerprint comparison works, but nobody does it every release. I hit this error one time too many, so I built siglock — a small MIT-licensed CLI that turns the comparison into a two-second check.

Lock your known-good signature once (from an artifact Play accepted, or straight from your keystore):

npx siglock init app-release.aab

This writes a .siglock.json with the certificate fingerprints. They're public data — the same values shown in Play Console — so you can commit the file and your whole team verifies against the same key.

Then, before every upload:

npx siglock check app-release.aab

• ✅ Match → ✓ Signature matches, ready to upload. and exit code 0
• ❌ Mismatch → expected vs. found fingerprints and exit code 1
• ⚠️ Debug keystore → an explicit warning that the build can't go to production

The non-zero exit code means you can drop it into CI and a wrongly-signed build fails the pipeline instead of reaching Play Console:

- name: Verify release signature
  run: npx siglock check android/app/build/outputs/bundle/release/app-release.aab

You can also verify against a fingerprint pasted straight from Play Console, no lock file needed:

npx siglock check app-release.aab --expect "AA:BB:CC:..."

Under the hood it just shells out to keytool (which every Android dev already has), with an apksigner fallback for APKs signed only with the v2/v3 scheme.

Takeaway

"Wrong key" is a category of error that's entirely preventable before upload — Google just doesn't check it for you until submission. Whether you use siglock or a manual keytool comparison, put a signature check in front of every Play upload and this error disappears from your life.

Links: GitHub · npm