Publishing on Google Play

Step 1: create an upload key

Every Android app must be digitally signed. With Play App Signing, Google keeps the final app signing key, and you sign your uploads with your own upload key. Create the upload keystore once with keytool, which comes with Java (Android Studio includes a JDK).

keytool -genkey -v -keystore ~/upload-keystore.jks -keyalg RSA -keysize 2048 -validity 10000 -alias upload

Step 2: key.properties

storePassword=<your-store-password>
keyPassword=<your-key-password>
keyAlias=upload
storeFile=<full path to upload-keystore.jks>

Step 3: signing configuration

// android/app/build.gradle.kts (newer projects use the Kotlin DSL)
import java.io.FileInputStream
import java.util.Properties

val keystoreProperties = Properties()
val keystorePropertiesFile = rootProject.file("key.properties")
if (keystorePropertiesFile.exists()) {
    keystoreProperties.load(FileInputStream(keystorePropertiesFile))
}

android {
    // ...
    signingConfigs {
        create("release") {
            keyAlias = keystoreProperties["keyAlias"] as String
            keyPassword = keystoreProperties["keyPassword"] as String
            storeFile = keystoreProperties["storeFile"]?.let { file(it) }
            storePassword = keystoreProperties["storePassword"] as String
        }
    }
    buildTypes {
        release {
            signingConfig = signingConfigs.getByName("release")
        }
    }
}

Step 4: build the App Bundle

flutter build appbundle
# output: build/app/outputs/bundle/release/app-release.aab

Step 5: Play Console

1. Create a Google Play developer account (a one-time US$25 fee at the time of writing, plus identity verification).
2. Create the app and fill in the store listing: name, short and full descriptions, icon, feature graphic and screenshots.
3. Complete App content: privacy policy URL, Data safety form (declare what your app and its SDKs, like Firebase, collect), ads, content rating questionnaire and target audience.
4. Upload the .aab to a testing track (internal, closed or open), invite testers and fix feedback.
5. For personal accounts created after 13 November 2023, Google requires a closed test with at least 12 testers opted in for 14 continuous days before applying for production access (as of 2025; check the current Play Console rules).
6. Release to production, ideally as a staged rollout (for example 10% of users first), and watch crash and ANR rates.

Google also requires apps to target a recent Android API level, raised every year. Flutter sets targetSdk through its Gradle settings; when you upgrade Flutter, check the target and test your app. The official "target API level requirement" page has the current deadline.

Common mistakes

• Committing key.properties or the keystore to a public GitHub repository.
• Building a debug-signed bundle by mistake: Play rejects it.
• Forgetting the INTERNET permission in the main manifest: the release app cannot load data.
• Leaving the 12-tester, 14-day closed test until the week before a deadline.