Signing the Application on Android

  • Published on Oct 20, 2026
  • 1 minute(s) read
Prev Next

To sign your application you can use an Android App Bundle (AAB) file or an Android package (APK) file.

To use an AAB file

  • Sign the AAB file by running the following command:

    jarsigner -verbose -sigalg SHA256withRSA -digestalg SHA-256 -keystore <keystore_file_path> -storepass <keystore_password> -keypass <private_key_password> <aab_file_path> <alias_name>

    where:

    • keystore_file_path is the path of the keystore which contains the private key used to sign your Android application.

    • keystore_password is the password that protects your keystore.

    • private_key_password is the password that protects your private key.

    • aab_file_path is the path of the AAB file shielded with App Shielding by OneSpan.

    • alias_name is the name of the alias that represents the signer's private key and certificate data within the KeyStore.

If you upload your own app signing key, it must be an RSA key with a length of 2048 bits or more.

To use an APK file

  • Sign the APK file by running the following command:

    <android_sdk_path>/build-tools/build_tools_version/apksigner sign --verbose --ks <keystore_file_path> --ks-key-alias <alias_name> --ks-pass pass:<keystore_password> --key-pass pass:<private_key_password> <apk_file_path>

    where:

    • android_sdk_path is the path of the Android SDK (e.g. /home/user/software/android-sdk-linux).

    • keystore_file_path is the path of the keystore which contains the private key used to sign your Android application.

    • alias_name is the name of the alias that represents the signer's private key and certificate data within the KeyStore.

    • keystore_password is the password that protects your keystore.

    • private_key_password is the password that protects your private key.

    • apk_file_path is the path of the APK file shielded with App Shielding by OneSpan.

An application that is signed with SHA-256 might not run on older devices.

Google Play Compatibility

By design, App Shielding is not compatible with the Google Play native Automatic Protection service. This feature injects additional code into the application, which causes App Shielding to trigger a repackaging exception. Therefore, it is not recommended to use the Automatic Protection service. Compared to App Shielding, it provides lower security and is easily bypassed.