Upload an Android app to Google Play for the first time

One-time $25, government-ID verification

Go to play.google.com/console/signup. Sign in with the Google account you want to own the app. Pick Personal or Organization:

• Personal — you're an individual publisher. Government ID verification required.
• Organization — a company entity owns the apps. Requires a D-U-N-S number for the business plus a verifiable phone number tied to the organization. Slower verification (1–2 weeks) but lets you publish as a brand instead of a person.

Pay the $25 (lifetime fee — you can publish as many apps as you want on this account forever). Submit the ID. Wait for verification — usually 48 hours for personal accounts, longer for organizations.

Almost everyone should pick Play App Signing

You're choosing one of two patterns:

• Play App Signing (recommended for ~99% of cases). You generate an upload key locally; Google generates and holds an app signing key. Every AAB you upload is signed by your upload key, Play strips that, signs with the app key, and ships the result. If your upload key is compromised, you contact Google and rotate it; the app on users' devices keeps working because the app signing key never left Google.
• Self-managed signing (legacy). You generate one key, sign everything yourself, never upload the key to Google. If you lose the key, you can't update the app — period. The new app would be a separate listing under a different package ID. This pattern exists for organizations with legal reasons to never let Google touch the signing key. It's not what you want.

Pick Play App Signing. The "upload key" you'll generate next is what your local builds sign with.

One keystore file, kept somewhere safe forever

keytool -genkey -v \
  -keystore ~/keys/mybrand-upload.keystore \
  -keyalg RSA -keysize 2048 -validity 25000 \
  -alias mybrand-upload
# Enter a password. Save it in your password manager.
# Fill in the X.500 fields (name, organization, country).
# 25000 days = ~68 years. Yes, really. Keystores aren't supposed to expire.

Back this keystore up: cloud storage, encrypted USB, password manager attachment — anywhere it'll survive your laptop dying. Losing it means you can't push updates that bypass Google's escalation flow (which exists but is slow). Treat it like the deed to a property.

The keystore password and the key password (you'll be asked for both) can be the same; many people use the same for simplicity. Store both in your password manager.

AAB, not APK — Play Console rejects APKs for new apps

In app/build.gradle.kts (or app/build.gradle for Groovy DSL), add a release signing config:

android {
    signingConfigs {
        create("release") {
            storeFile = file(System.getenv("UPLOAD_KEYSTORE_PATH") ?: "$rootDir/keystore-not-set")
            storePassword = System.getenv("UPLOAD_KEYSTORE_PASSWORD")
            keyAlias = "mybrand-upload"
            keyPassword = System.getenv("UPLOAD_KEY_PASSWORD")
        }
    }
    buildTypes {
        release {
            signingConfig = signingConfigs.getByName("release")
            isMinifyEnabled = true
            proguardFiles(getDefaultProguardFile("proguard-android-optimize.txt"), "proguard-rules.pro")
        }
    }
}

Build the bundle:

export UPLOAD_KEYSTORE_PATH=~/keys/mybrand-upload.keystore
export UPLOAD_KEYSTORE_PASSWORD='your-password'
export UPLOAD_KEY_PASSWORD='your-password'
./gradlew :app:bundleRelease

# Output:
# app/build/outputs/bundle/release/app-release.aab

That's the file you upload. Verify it's signed:

jarsigner -verify -verbose -certs app/build/outputs/bundle/release/app-release.aab
# Last line should say: "jar verified."

The shell of the listing

Play Console → Create app. Fill in:

• App name — what users see in the store. Max 30 chars. Can change later but the URL slug is set from it.
• Default language — the locale your store listing's primary copy is in. You can add other languages later.
• App or game — affects which category trees you can pick. Mostly cosmetic.
• Free or paid — paid is one-time purchase or subscription. Free apps can still have in-app purchases. You cannot change free → paid later, only paid → free. Pick conservatively.

Submit. The app is now in Play Console as a draft. You can't publish anything yet; you need a signed AAB on a track and a bunch of metadata first.

Six forms; none are optional

In Play Console, sidebar App content, work through each item. Submitting without filling these in is the #1 first-upload error.

• Privacy policy. A URL to a publicly accessible privacy policy document. If your app collects any data, this is mandatory. If it collects no data, you still need a one-line policy stating that. Generators exist (app-privacy-policy-generator.firebaseapp.com); host the result somewhere durable.
• App access. If parts of your app require a login, you must provide test credentials so reviewers can access them. "Username: [email protected], Password: ..." — Google reviewers actually use these.
• Ads. Yes or no. If yes, additional ad-content rating questions follow.
• Content rating. A questionnaire ("Does the app contain violence?", "References to gambling?") that generates an IARC rating. Takes 5–10 minutes. The rating affects which countries can see the app.
• Target audience and content. Age bands, with extra rules if you target under-13. "Mixed audience" is the safe pick for most consumer apps.
• Data safety. The heaviest form. Disclose every kind of data your app collects (location, contacts, photos, files, device IDs, etc.) and whether it's required, shared with third parties, encrypted in transit. The disclosures must match reality — Google does cross-check the app's runtime behavior against the form, and mismatches are a removal reason. Block out 20–40 minutes for this form on the first app.
• Government apps / News apps / Health apps / etc. Conditional declarations if your app falls in a regulated category.

What users see when they tap your app

Sidebar Main store listing. Required assets:

• App icon — 512×512 PNG, 32-bit, with alpha. The icon Google shows everywhere.
• Feature graphic — 1024×500 JPG/PNG. The wide banner shown at the top of your listing.
• Phone screenshots — at least 2, max 8. PNG or JPG, 16:9 or 9:16, between 320 and 3840 px on the shorter side. Take these from the AVD: adb exec-out screencap -p > screen.png.
• Short description — 80 chars. Appears in search-result snippets.
• Full description — 4000 chars. The actual product page copy.
• Tablet screenshots — optional but recommended if you support tablets. Skipping these means tablet users see your phone screenshots in a less-flattering aspect ratio.

The descriptions are the part most worth iterating on — they're also editable post-launch, so good-enough at first is fine. Icon and feature graphic are harder to redo without re-uploading.

The fastest path to the app installed on a real device

Sidebar Testing → Internal testing → Create new release:

• App signing — Play Console offers Play App Signing on first upload. Accept it.
• Upload AAB — drop in app-release.aab from Step 4. Upload takes 1–3 minutes.
• Release name — auto-fills from the version code. Leave it.
• Release notes — what changed. For the first release: "Initial release."

Save → Review release → Start rollout to internal testing. The release is processing within 5 minutes.

Add testers: Internal testing → Testers tab → create an email list (paste up to 100 Gmail addresses, one per line). Save. Each tester gets a Play Store opt-in link they need to click before they can install the app.

Send the opt-in link to your testers. They click it, accept, then visit the app's Play Store page (or the direct internal-test link) and install. Within 5–10 minutes of release rollout, the app is installable on their device.

The progression that actually ships to the public

Once internal testing confirms the build works:

• Closed testing — a private group, usually email-list-based or Google Group. Same upload flow; Promote release from internal → closed. Use this for early-access users, beta programs. If you're on a personal account, this is the 14-day requirement.
• Open testing (optional) — anyone with the link can join. Lower commitment than production. Useful for "soft launch" without the Play Store search visibility.
• Production — the public launch. Anyone in the supported countries can find and install your app. The first production release goes through full review (3–7 days); subsequent updates often clear in under 24 hours.

For the first push to production: Production → Create new release → Promote from closed testing. Add release notes. Submit. Wait. Email lands when status changes.