Signing Credentials

Apple and Google only accept builds that are signed with the right certificate or key. When you publish to the App Store or Google Play from Draftbit, we create those signing files for you on your app’s first publish and store them with the app, so later publishes are signed the same way.

You can manage these credentials yourself when you need to:

• Import credentials from another app in your organization, so a new app uses the same store accounts and signing files.
• Upload your existing Android keystore if your app is already on Google Play and was signed somewhere else.
• Delete generated certificates or signing keys to start over.
• Remove store credentials when you no longer want Draftbit to publish with them.

Plan requirement

iOS and Android publishing are available on Standard and up. On the Free plan, the App Store Connect and Google Play Console cards show a lock, and clicking one opens the upgrade dialog.

Where to find them

Open the Publishing page for your app and switch to the Publish Destinations tab. Click the App Store Connect card for iOS or the Google Play Console card for Android. Everything on this page happens in the dialog that opens.

These cards only appear for apps that can be published to iOS and Android.

The dialog sets up each credential in its own step. To change one later, click its step, enter or upload the new value, and save it. Draftbit checks a new API key or service account key with Apple or Google first and keeps the saved one if the check fails. Saved values stay hidden, and fields you leave empty keep the saved value.

What each destination stores

Destination	You provide	Draftbit generates
App Store Connect (iOS)	The API key file (.p8) with its Key ID and Issuer ID, your Team ID, and your app’s bundle ID	A distribution certificate and provisioning profile
Google Play Console (Android)	Your Package name, the service account key file (.json), and optionally an Android keystore	A signing key, unless you upload your own keystore

For where to get each value, see iOS Publishing and Android Publishing.

Import credentials from another app

If you already publish another app from the same Apple or Google account, you can copy its credentials instead of entering them again.

1. Open the destination for the new app

   In the app you’re setting up, open the App Store Connect or Google Play Console card.

2. Expand Import Credentials

   Click Import Credentials at the top of the dialog. On iOS it’s marked Recommended. It only appears until the app has its own credentials; to import over them, remove them first.

3. Choose the source app

   Pick the app to copy from in Select source app. Only apps in the same organization are listed.

4. Decide whether to reuse the Android signing key

   Android only. Turn on Reuse Signing Key only if this app will replace the source app’s listing on Google Play. Leave it off for a separate Play Store app.

5. Click Import

   Draftbit copies the credentials and checks them with Apple or Google. The steps they cover show their results.

What gets copied

	Copied	Not copied
iOS	Team ID, Key ID, Issuer ID, and API key file, plus the source app’s generated certificate and provisioning profile if it has them	Bundle ID
Android	Service Account key file. With Reuse Signing Key on, also the source app’s generated signing key and uploaded keystore	Package Name

Then finish the remaining steps for the new app: choose its app on iOS, or enter its package name on Android.

Why importing is recommended on iOS

Apple limits how many distribution certificates an account can have. Importing reuses the certificate Draftbit already generated for the source app. If you enter the same account details by hand instead, Draftbit generates a new certificate, and it counts toward that limit.

Import errors

Message	What to do
No credentials to import	The source app has no saved publishing credentials. Pick an app that’s already set up for publishing.
Cannot import publishing secrets across organizations.	Credentials can only be copied between apps in the same organization. Pick a source app from the same organization, or enter the credentials by hand.

Upload your existing Android keystore

By default, Draftbit generates a signing key for your Android app the first time you publish. That works for a new Play Store listing. If your app is already on Google Play and was published with another tool, such as Draftbit Classic, Android Studio, or Expo’s build service, Google Play rejects builds signed with a different key.

If you still have the keystore you used to sign uploads for that listing, upload it to Draftbit and your builds are signed with the same key. If you don’t have it, follow Publishing apps built outside Draftbit to reset the upload key with Google instead.

1. Open the Google Play Console card

   On the Publish Destinations tab, click Google Play Console, then expand Advanced: use your own signing key (optional) at the bottom of the dialog.

2. Choose your keystore file

   Click Upload keystore (optional) and select your .jks or .keystore file. The file must be smaller than 10 KB; a valid keystore file is usually much smaller than that.

3. Enter the keystore details

   Fill in Keystore password, Key alias, and Key password. These are the values you set when the keystore was created.

4. Save

   Click Save signing key. Your next Android publish is signed with this keystore.

To replace the keystore, click the keystore button and choose a new file, then save. You can also change just the password or alias fields and save.

To stop using your keystore, click the trash icon next to it. The dialog shows Keystore will be removed on save. Click Undo if you change your mind, or Save signing key to remove it. Without an uploaded keystore, Draftbit signs your builds with a key it generates.

Delete generated certificates or signing keys

Deleting is for starting over: for example, after you revoke the certificate in your Apple Developer account, or when you want a new Android signing key and are ready to register it with Google. Open the card and expand the Advanced section at the bottom of the dialog: Advanced: generated certificates on iOS, or Advanced: use your own signing key (optional) on Android.

This can’t be undone

Both buttons ask you to confirm, then delete permanently. Draftbit generates replacements on your next publish.

iOS: Delete generated certificates

Delete generated certificates removes Draftbit’s references to the distribution certificate and provisioning profile it generated for this app. Your App Store Connect settings stay as they are. On the next iOS publish, Draftbit generates a new certificate and profile, and the new certificate counts toward your Apple account’s certificate limit.

Android: Delete generated signing key

Delete generated signing key permanently deletes the signing key Draftbit generated for this app. A new key is generated on the next Android publish.

If the app is already on Google Play, Google rejects builds signed with the new key until you request an upload key reset in Google Play Console. The steps are in Publishing apps built outside Draftbit. Google reviews the request before you can publish again.

This button doesn’t remove a keystore you uploaded. Use the trash icon next to your keystore for that.

Remove store credentials

To stop Draftbit from publishing with a store account, open its card and click Remove credentials at the bottom of the dialog, then confirm. On iOS this removes the Team ID and API key; on Android it removes the service account key. Your bundle ID or package name, generated signing files, and uploaded keystore stay in place, so you can add credentials again and keep publishing the same app.

Limits

• You can only import credentials from apps in the same organization.
• Import copies store credentials and signing files, not the Bundle ID or Package Name.
• Android keystore files must be .jks or .keystore and smaller than 10 KB. Each app has one keystore at a time.
• Deleted generated certificates and signing keys can’t be recovered.