Android signing & keystores
Every Android release must be signed with a keystore. BuildStack gives you two options, and either way the keystore is sealed — encrypted at rest and only opened for the moment a build needs it.
Option 1: Managed signing (recommended)
Let BuildStack generate and hold a keystore for your app. There's nothing to upload and nothing to lose — the key is created once, sealed, and reused for every release build.
Enable it from the project's Keystore panel.
Option 2: Bring your own keystore
If you already have a keystore (for example an app that's live on Google Play), upload it so new builds keep the same signing identity:
- Open the project → Keystore.
- Upload the
.jks/.keystorefile and enter the keystore password, key alias,
and key password.
- BuildStack seals it; release builds are signed with it automatically.
Keep a backup of your original keystore. If you're already published on Google Play, you must sign with the same key (or use Play App Signing) or Google will reject the upload.
How sealing works
Credentials are encrypted with an envelope key held in a hardware-backed key vault. The plaintext keystore exists only in memory, only during a build, and is never returned to the dashboard or logs.
Debug builds
Debug variants are signed with a standard debug key automatically — no setup needed. The keystore above applies to release builds.