Play Store Signing Key Generator

Run this from anywhere. It writes the keystore to ~/keys/ — deliberately outside the project, so it can never be committed by accident. keytool will prompt for your name and organisation interactively, then for a password twice. Fill in the identity fields above to skip the prompts.

mkdir -p ~/keys
keytool -genkeypair -v \
  -keystore ~/keys/upload-keystore.jks \
  -storetype PKCS12 \
  -keyalg RSA -keysize 2048 \
  -validity 9855 \
  -alias upload

The keystore lives outside the repo, but the properties file holding its password does not. Add these before the first commit — a password in git history stays there after you delete the line.

key.properties
*.jks
*.keystore
*.p12

Passwords stay in this file, and this file stays out of git. It sits next to android/app, not at the Flutter project root. Use an absolute path for storeFile — a relative one resolves differently depending on which directory Gradle was invoked from.

storePassword=<the password you just set>
keyPassword=<the same password>
keyAlias=upload
storeFile=/Users/you/keys/upload-keystore.jks

The two imports have to sit at the very top of the file, above the plugins block — Kotlin DSL rejects an import anywhere else. The exists() guard is what lets the project still build on a machine that has no key, which is what you want for CI that only runs tests.

import java.util.Properties

val keystoreProperties = Properties()
val keystorePropertiesFile = rootProject.file("key.properties")
if (keystorePropertiesFile.exists()) {
    keystorePropertiesFile.inputStream().use { keystoreProperties.load(it) }
}

android {
    signingConfigs {
        create("release") {
            keyAlias = keystoreProperties["keyAlias"] as String
            keyPassword = keystoreProperties["keyPassword"] as String
            storeFile = file(keystoreProperties["storeFile"] as String)
            storePassword = keystoreProperties["storePassword"] as String
        }
    }

    buildTypes {
        release {
            signingConfig = signingConfigs.getByName("release")
        }
    }
}

Play requires an .aab, not an .apk. The file lands at build/app/outputs/bundle/release/app-release.aab. If it builds but Play rejects it as debug-signed, the signingConfig line inside buildTypes is missing — Gradle falls back to the debug key silently rather than failing.

flutter build appbundle --release

SHA-1 and SHA-256 from this keystore are what Firebase, Google Sign-In and Android App Links need. Register the upload key's fingerprint now, then add the one Play generates after your first release — with Play App Signing there are two, and only registering one is why sign-in works in debug and fails in production.

keytool -list -v -keystore ~/keys/upload-keystore.jks -alias upload