AppsinityAPPSINITY
Signing and releases

App signing

You do not supply a keystore. Appsinity signs every Android build with its own key, on the server, and hands back an installable APK.

Open Appsinity Studio
On this pageThe signing keyThe pipeline, in orderThe fields signing writesHow signing gets triggeredFailure modesFrequently asked questions

The signing key

A keystore is generated per project when none exists, with these fixed parameters:

  • The key stays on Appsinity infrastructure. You cannot download it, and you cannot substitute your own.
  • Because validity is ~27 years, expiry is not a realistic failure for a listing.
  • The CN is your project id, so the certificate subject is the one place your project identity is visible to anyone who inspects the APK.
keypair      RSA 2048
validity     10000 days
alias        appsinity
distinguished name
             CN=<project id>, OU=Appsinity Studio,
             O=Appsinity Technologies, L=Faridabad,
             ST=Haryana, C=IN
Important: This is a store-signing model, not a bring-your-own-key model. A build signed here cannot be updated later by a build signed with your own key, and vice versa. Decide before you distribute anywhere else.

The pipeline, in order

  1. Gate. Only .apk and .aab are accepted. Anything else returns Only APK and AAB files can be signed.
  2. Bundle (AAB only). bundletool build-apks --mode universal then extracts universal.apk.
  3. Align. zipalign to a 4-byte boundary — required before apksigner on modern Android.
  4. Sign. apksigner with the project keystore and the appsinity alias.
  5. Scan. The malware scanner runs against the signed output.
  6. Upload. The result is copied to storage under a key derived from the source path.
  7. Patch the record. The build document gains the signed fields, and the local working copy is deleted.
POST https://api.appsinity.com/api/apps/{appId}/builds/sign
Authorization: Bearer <developer token>

{ "buildUrl": "https://storage.appsinity.com/public/games/<id>/builds/<v>/game.aab" }

The fields signing writes

FieldMeaning
signingStatusProgress marker; failed on error
signedApkUrlThe installable output — what players receive
originalBuildUrlThe file you uploaded
sourceTypeWhether the source was an APK or an AAB
originalSizeBytes / signedSizeBytesSizes before and after alignment and signing
signedAtWhen it completed
signingErrorWritten only on failure
Watch out: signedApkUrl is the field the download chain and the dashboard both look for. A listing whose build has only originalBuildUrl is offering an unsigned — and for an AAB, uninstallable — file.

How signing gets triggered

Two routes exist. The dashboard calls the endpoint when you save a build: it only submits .aab files, and reports Saved. Signing started. or Saved. Signing is queued and finishes automatically.

Separately, a background signer on the server polls every 30 seconds and picks up AAB rows that have no signedApkUrl. That loop is the safety net, and it is why an upload that appeared to fail to sign often signs itself within half a minute.

  • The sign endpoint itself is synchronous. A large bundle can exceed the 60-second proxy timeout and return a 504 while the signing continues — see the FAQ.
  • An APK upload from the dashboard is not auto-submitted; the signing call is gated on the AAB extension.
  • There is no signing-status badge in Studio. Read the listing, or download the file.

Failure modes

On failure the record keeps the original URL and writes signingError. Nothing falls back automatically, so check the listing after any failure.

SymptomCauseFix
Only APK and AAB files can be signed.Wrong upload typeUpload the Android package
"Failed to fetch" on the sign requestA 60-second gateway timeout on a long signing runWait 30-60 s and reload; the background signer usually completes it
signingStatus: failedCorrupt archive, alignment error, or a tool failureRebuild and re-upload; if it repeats, send the build URL to devhelp
Signed APK missing after successThe upload step to storage failedRe-trigger signing
"Could not delete original AAB" in logsStorage CLI not on the server pathCosmetic — the signed output is unaffected

Frequently asked questions

Can I use my own keystore?

No. The signing key is generated and held per project by Appsinity and is not exportable.

Will I lose the ability to update if I leave Appsinity?

Yes for existing installs — an update signed with your own key cannot replace an Appsinity-signed one. Players must uninstall first.

Does signing change the APK size?

Slightly, and signedSizeBytes records it. An AAB's universal APK is much larger than the bundle, see Android App Bundle.

Related documentation

APK versus AABAndroid App BundlePublish an updateUpload a build
Need help?

Developer publishing support: [email protected]
General support: [email protected]
Partnerships: [email protected]