---
title: "Signing the Application on Android"
slug: "oapps-iga-signing-the-application-on-android-9-0-1"
updated: 2026-10-20T11:52:43Z
published: 2026-10-20T11:52:43Z
canonical: "docs.onespan.com/oapps-iga-signing-the-application-on-android-9-0-1"
excludeFromSearch: true
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.onespan.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Signing the Application on Android

To sign your application you can use an Android App Bundle (AAB) file or an Android package (APK) file.

To use an AAB file

- Sign the AAB file by running the following command:

```plaintext
jarsigner -verbose -sigalg SHA256withRSA -digestalg SHA-256 -keystore <keystore_file_path> -storepass <keystore_password> -keypass <private_key_password> <aab_file_path> <alias_name>
```

where:
  - keystore_file_path is the path of the keystore which contains the private key used to sign your Android application.
  - keystore_password is the password that protects your keystore.
  - private_key_password is the password that protects your private key.
  - aab_file_path is the path of the AAB file shielded with App Shielding by OneSpan.
  - alias_name is the name of the alias that represents the signer's private key and certificate data within the KeyStore.

> If you upload your own app signing key, it must be an RSA key with a length of 2048 bits or more.

To use an APK file

- Sign the APK file by running the following command:

```plaintext
<android_sdk_path>/build-tools/build_tools_version/apksigner sign --verbose --ks <keystore_file_path> --ks-key-alias <alias_name> --ks-pass pass:<keystore_password> --key-pass pass:<private_key_password> <apk_file_path>
```

where:
  - android_sdk_path is the path of the Android SDK (e.g. /home/user/software/android-sdk-linux).
  - keystore_file_path is the path of the keystore which contains the private key used to sign your Android application.
  - alias_name is the name of the alias that represents the signer's private key and certificate data within the KeyStore.
  - keystore_password is the password that protects your keystore.
  - private_key_password is the password that protects your private key.
  - apk_file_path is the path of the APK file shielded with App Shielding by OneSpan.

> An application that is signed with SHA-256 might not run on older devices.