Method: appsigning.enrollApp

Enrolls an app in Play App Signing using a self-hosted Google Cloud KMS key.

Warning: Do not use this method for standard Play App Signing enrollment.

  • Standard enrollment with Google-generated or Google-managed keys cannot be done via API.
  • This advanced API is strictly for enterprise organizations with mandatory compliance, regulatory, or policy requirements to retain key custody in an external Google Cloud KMS instance.
  • Prerequisites: Requires an active, properly configured Google Cloud KMS key with appropriate IAM permissions granted to Google Play before calling this method.

See Help Center: https://support.google.com/googleplay/android-developer/answer/9842756

HTTP request

POST https://androidpublisher.googleapis.com/androidpublisher/v3/applications/{name}/appSigning:enrollApp

The URL uses gRPC Transcoding syntax.

Path parameters

Parameters
name

string

Required. Either package name or app ID of the app enrolling in Play Signing.

Request body

The request body contains data with the following structure:

JSON representation 
{
  "pemUploadCertificate": string,

  // Union field enrollment can be only one of the following:
  "enrollNewApp": {
    object (EnrollNewApp)
  },
  "enrollExistingApp": {
    object (EnrollExistingApp)
  }
  // End of list of possible types for union field enrollment.
}
Fields
pemUploadCertificate

string (bytes format)

The certificate associated with the upload key, in PEM format.

A base64-encoded string.
Union field enrollment. The type of self-hosted enrollment. Requires an active Google Cloud KMS key with appropriate IAM permissions granted to Google Play. enrollment can be only one of the following:
enrollNewApp

object (EnrollNewApp)

Changes the signing key of a new app to an external Cloud KMS key. The app must not have published to Open testing or Production tracks.
enrollExistingApp

object (EnrollExistingApp)

Enrolls an existing app into Play signing using an external Cloud KMS key.

Response body

Response to enroll an app into Play signing.

If successful, the response body contains data with the following structure:

JSON representation 
{
  "signingCertificate": {
    object (CertificateHashes)
  },
  "uploadCertificate": {
    object (CertificateHashes)
  }
}
Fields
signingCertificate

object (CertificateHashes)

The signing certificate hashes for the app. Always set.
uploadCertificate

object (CertificateHashes)

The upload certificate hashes for the app. Set iff pemUploadCertificate was set in the request.

Authorization scopes

Requires the following OAuth scope:

  • https://www.googleapis.com/auth/androidpublisher

EnrollNewApp

Enroll a new app into Play signing.

JSON representation 
{
  "cloudKmsKeyAndCert": {
    object (CloudKmsKeyAndCert)
  }
}
Fields
cloudKmsKeyAndCert

object (CloudKmsKeyAndCert)

Required. Self-hosted key.

Once enrolled, this key will be used to sign your app.

EnrollExistingApp

Enroll an existing app into Play signing.

JSON representation 
{
  "cloudKmsKey": {
    object (CloudKmsKey)
  }
}
Fields
cloudKmsKey

object (CloudKmsKey)

Required. Self-hosted key.

Once enrolled, this key will be used to sign your app.