App Signing

App signing is required to distribute your app on iOS and Android. Digital signatures verify that your app hasn’t been tampered with and identify you as the developer.

Overview

iOS requires:

Distribution Certificate (P12 file)
Provisioning Profile (mobileprovision file)

Android requires:

Keystore (JKS or BKS file)
Key alias and passwords

EAS Build can manage these credentials automatically, or you can provide your own.

Managed Credentials (Recommended)

EAS automatically generates and stores your credentials securely.

First-Time Setup

When you run your first build, EAS will prompt you:

Tab Title
Tab Title

eas build --platform ios

Prompts:

Log in to your Apple Developer account
EAS generates a distribution certificate
EAS creates a provisioning profile
Credentials are encrypted and stored on EAS servers

EAS handles:

Creating distribution certificates
Generating provisioning profiles
Managing device UDIDs for ad hoc builds
Automatically renewing expired credentials

eas build --platform android

Prompts:EAS asks: Would you like to generate a new keystore?Select “Yes” to:

Generate a new keystore automatically
Store it securely on EAS servers
Use it for all future builds

Never lose your Android keystore. If you do, you cannot update your app on the Play Store - you’ll need to publish a new app with a different package name.

Viewing Managed Credentials

View and download your credentials:

# iOS credentials
eas credentials --platform ios

# Android credentials
eas credentials --platform android

Or use the Expo dashboard:

Navigate to your project
Go to Credentials
Select platform and view/download credentials

Local Credentials

Provide your own credentials using a credentials.json file.

Setting Up credentials.json

Create credentials.json

Create credentials.json at your project root:

credentials.json

{
  "android": {
    "keystore": {
      "keystorePath": "android/keystores/release.keystore",
      "keystorePassword": "KEYSTORE_PASSWORD",
      "keyAlias": "KEY_ALIAS",
      "keyPassword": "KEY_PASSWORD"
    }
  },
  "ios": {
    "provisioningProfilePath": "ios/certs/profile.mobileprovision",
    "distributionCertificate": {
      "path": "ios/certs/dist-cert.p12",
      "password": "CERT_PASSWORD"
    }
  }
}

Add to .gitignore

Never commit credentials to version control. Add them to .gitignore immediately.

.gitignore

# App signing credentials
credentials.json
android/keystores/*.keystore
ios/certs/*

Configure eas.json

Tell EAS to use local credentials:

eas.json

{
  "build": {
    "production": {
      "credentialsSource": "local"
    }
  }
}

iOS Code Signing

Generating iOS Credentials Manually

Create Distribution Certificate

Go to Apple Developer Portal
Click + to create a new certificate
Select Apple Distribution (for App Store and Ad Hoc)
Generate a Certificate Signing Request (CSR) on your Mac:
- Open Keychain Access
- Keychain Access > Certificate Assistant > Request a Certificate from a Certificate Authority
- Enter your email and name
- Select Save to disk
Upload the CSR to Apple Developer Portal
Download the certificate (.cer file)
Double-click to install in Keychain
Export as P12:
- Open Keychain Access
- Find the certificate under My Certificates
- Right-click > Export
- Save as .p12 with a password

Create Provisioning Profile

Go to Provisioning Profiles
Click + to create new profile
Select type:
- App Store for production
- Ad Hoc for internal distribution
Select your App ID
Select your distribution certificate
For Ad Hoc: Select devices to include
Name the profile and download (.mobileprovision)

Configure credentials.json

credentials.json

{
  "ios": {
    "provisioningProfilePath": "ios/certs/MyApp_AdHoc.mobileprovision",
    "distributionCertificate": {
      "path": "ios/certs/distribution.p12",
      "password": "your-p12-password"
    }
  }
}

Multi-Target iOS Projects

If your app has multiple targets (main app + extensions), provide credentials for each:

credentials.json

{
  "ios": {
    "myapp": {
      "provisioningProfilePath": "ios/certs/myapp-profile.mobileprovision",
      "distributionCertificate": {
        "path": "ios/certs/dist.p12",
        "password": "PASSWORD"
      }
    },
    "ShareExtension": {
      "provisioningProfilePath": "ios/certs/share-profile.mobileprovision",
      "distributionCertificate": {
        "path": "ios/certs/dist.p12",
        "password": "PASSWORD"
      }
    }
  }
}

Managing Device UDIDs (Ad Hoc)

For Ad Hoc distribution, register test devices:

# Register a new device
eas device:create

# List registered devices
eas device:list

# Delete a device
eas device:delete

# Rename a device
eas device:rename

After adding devices, rebuild to include them in the provisioning profile:

eas build --platform ios --profile preview

Android App Signing

Generating an Android Keystore

Create a release keystore using the Java keytool:

keytool -genkey -v \
  -storetype JKS \
  -keyalg RSA \
  -keysize 2048 \
  -validity 10000 \
  -storepass YOUR_KEYSTORE_PASSWORD \
  -keypass YOUR_KEY_PASSWORD \
  -alias YOUR_KEY_ALIAS \
  -keystore release.keystore \
  -dname "CN=com.yourcompany.yourapp,OU=,O=,L=,S=,C=US"

Parameters:

storepass: Password for the keystore file
keypass: Password for the specific key
alias: Identifier for the key
validity: Number of days (10,000 = ~27 years)
dname: Distinguished name (use your package name as CN)

Keystore Storage

Move keystore to a secure location:

mkdir -p android/keystores
mv release.keystore android/keystores/

Configure credentials.json:

credentials.json

{
  "android": {
    "keystore": {
      "keystorePath": "android/keystores/release.keystore",
      "keystorePassword": "YOUR_KEYSTORE_PASSWORD",
      "keyAlias": "YOUR_KEY_ALIAS",
      "keyPassword": "YOUR_KEY_PASSWORD"
    }
  }
}

Play App Signing

Google Play uses Play App Signing to re-sign your app with a separate key. How it works:

You upload your app signed with an upload key
Google strips your signature
Google re-signs with the app signing key
Users download the app signed by Google’s key

Benefits:

Google securely manages your app signing key
Lost upload key can be reset (app signing key is protected)
Enhanced security and key rotation

Enrolling in Play App Signing:

Go to Google Play Console
Navigate to your app
Go to Setup > App signing
Follow enrollment steps

Migrating Existing Keystore

If you have an existing keystore from a previous build system:

Locate Your Keystore

Find your existing keystore file and gather:

Keystore file path
Keystore password
Key alias
Key password

Create credentials.json

Add your keystore details:

credentials.json

{
  "android": {
    "keystore": {
      "keystorePath": "path/to/existing.keystore",
      "keystorePassword": "existing-password",
      "keyAlias": "existing-alias",
      "keyPassword": "existing-key-password"
    }
  }
}

Build with Local Credentials

eas build --platform android --profile production

EAS will use your existing keystore to sign the build.

Using Credentials in CI/CD

For CI/CD pipelines, encode credentials as base64:

Encoding Credentials

# Encode credentials.json
base64 credentials.json

# Encode keystore
base64 android/keystores/release.keystore

# Encode iOS certificate
base64 ios/certs/dist.p12

Decoding in CI

Add environment variables to your CI service with base64 values, then decode:

# Decode credentials.json
echo $CREDENTIALS_JSON_BASE64 | base64 -d > credentials.json

# Decode keystore
echo $KEYSTORE_BASE64 | base64 -d > android/keystores/release.keystore

# Decode iOS files
echo $IOS_DIST_CERT_BASE64 | base64 -d > ios/certs/dist.p12
echo $IOS_PROFILE_BASE64 | base64 -d > ios/certs/profile.mobileprovision

Example GitHub Actions Workflow

.github/workflows/build.yml

name: EAS Build
on:
  push:
    branches: [main]

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      
      - name: Setup Node.js
        uses: actions/setup-node@v3
        with:
          node-version: 18
      
      - name: Setup Expo
        uses: expo/expo-github-action@v8
        with:
          expo-version: latest
          eas-version: latest
          token: ${{ secrets.EXPO_TOKEN }}
      
      - name: Restore credentials
        run: |
          echo ${{ secrets.CREDENTIALS_JSON }} | base64 -d > credentials.json
          mkdir -p android/keystores
          echo ${{ secrets.ANDROID_KEYSTORE }} | base64 -d > android/keystores/release.keystore
      
      - name: Build Android
        run: eas build --platform android --non-interactive --profile production

Credential Security Best Practices

Do’s

✅ Use EAS managed credentials for simplicity
✅ Keep backups of Android keystores in secure storage
✅ Use strong passwords for keystores and certificates
✅ Rotate credentials periodically
✅ Limit access to credentials to essential team members
✅ Use environment variables in CI/CD

Don’ts

❌ Never commit credentials.json to version control
❌ Never share keystores via email or Slack
❌ Never use weak or default passwords
❌ Never store credentials in plaintext on developer machines
❌ Never reuse keystores across different apps

Troubleshooting

iOS: “Provisioning profile doesn’t include signing certificate”

Solution: Regenerate provisioning profile with correct certificate:

eas credentials --platform ios
# Select "Remove provisioning profile"
eas build --platform ios --clear-cache

Android: “Keystore was tampered with, or password was incorrect”

Solution: Verify passwords in credentials.json match keystore:

# List keystore contents to verify
keytool -list -v -keystore android/keystores/release.keystore
# Enter keystore password when prompted

iOS: “No suitable application records were found”

Solution: Create App ID in Apple Developer Portal:

Go to Identifiers
Create App ID matching your bundle identifier
Rebuild with EAS

Android: “Key alias not found”

Solution: List aliases in keystore:

keytool -list -keystore android/keystores/release.keystore

Update credentials.json with correct alias.

Next Steps

Build Configuration - Configure build profiles in eas.json
Internal Distribution - Share builds with testers
Submit to App Stores - Deploy signed builds to stores

Building

Distribution

Web Deployment

​App Signing

​Overview

​Managed Credentials (Recommended)

​First-Time Setup

​Viewing Managed Credentials

​Local Credentials

​Setting Up credentials.json

​Create credentials.json

​Add to .gitignore

​Configure eas.json

​iOS Code Signing

​Generating iOS Credentials Manually

​Create Distribution Certificate

​Create Provisioning Profile

​Configure credentials.json

​Multi-Target iOS Projects

​Managing Device UDIDs (Ad Hoc)

​Android App Signing

​Generating an Android Keystore

​Keystore Storage

​Play App Signing

​Migrating Existing Keystore

​Locate Your Keystore

​Create credentials.json

​Build with Local Credentials

​Using Credentials in CI/CD

​Encoding Credentials

​Decoding in CI

​Example GitHub Actions Workflow

​Credential Security Best Practices

​Do’s

​Don’ts

​Troubleshooting

​iOS: “Provisioning profile doesn’t include signing certificate”

​Android: “Keystore was tampered with, or password was incorrect”

​iOS: “No suitable application records were found”

​Android: “Key alias not found”

​Next Steps

App Signing

Overview

Managed Credentials (Recommended)

First-Time Setup

Viewing Managed Credentials

Local Credentials

Setting Up credentials.json

Create credentials.json

Add to .gitignore

Configure eas.json

iOS Code Signing

Generating iOS Credentials Manually

Create Distribution Certificate

Create Provisioning Profile

Configure credentials.json

Multi-Target iOS Projects

Managing Device UDIDs (Ad Hoc)

Android App Signing

Generating an Android Keystore

Keystore Storage

Play App Signing

Migrating Existing Keystore

Locate Your Keystore

Create credentials.json

Build with Local Credentials

Using Credentials in CI/CD

Encoding Credentials

Decoding in CI

Example GitHub Actions Workflow

Credential Security Best Practices

Do’s

Don’ts

Troubleshooting

iOS: “Provisioning profile doesn’t include signing certificate”

Android: “Keystore was tampered with, or password was incorrect”

iOS: “No suitable application records were found”

Android: “Key alias not found”

Next Steps