Method: appsigning.rotateAppSigningKey

Rotates an app's signing key to a new self-hosted Google Cloud KMS key.

Warning: This method only applies to apps enrolled with self-hosted Cloud KMS keys. For apps using standard Google-managed Play App Signing, key rotation requests must be initiated through the Google Play Console UI.

See Help Center: https://support.google.com/googleplay/android-developer/answer/9842756

HTTP request

POST https://androidpublisher.googleapis.com/androidpublisher/v3/applications/{name}/appSigning:rotateAppSigningKey

The URL uses gRPC Transcoding syntax.

Path parameters

Parameters
name

string

Required. Either package name or app ID of the app rotating the signing key.

Request body

The request body contains data with the following structure:

JSON representation 
{
  "rotatedCloudKmsKey": {
    object (RotatedCloudKmsKey)
  },
  "keyRotationReason": enum (KeyRotationReason)
}
Fields
rotatedCloudKmsKey

object (RotatedCloudKmsKey)

Required. Self-hosted Cloud KMS key.
keyRotationReason

enum (KeyRotationReason)

Required. Reason for rotating the app key.

Response body

Response to rotate an app's signing key.

If successful, the response body contains data with the following structure:

JSON representation 
{
  "rotatedKeyCertificate": {
    object (CertificateHashes)
  }
}
Fields
rotatedKeyCertificate

object (CertificateHashes)

The rotated key certificate hashes for the app. Always set.

Authorization scopes

Requires the following OAuth scope:

  • https://www.googleapis.com/auth/androidpublisher

KeyRotationReason

Key rotation reasons.

Enums
KEY_ROTATION_REASON_UNSPECIFIED Unspecified key rotation reason. Cannot be used.
COMPROMISED_KEY Key is compromised.
USE_STRONGER_KEY Stronger key is required.
USE_SAME_KEY_FOR_MULTIPLE_APPS Same key is used for multiple apps.
ROUTINE_KEY_UPGRADE Routine key upgrade.
OTHER Other reason.

RotatedCloudKmsKey

Message representing rotated Cloud KMS key. Consists of the Cloud KMS key and its associated proof of rotation.

JSON representation 
{
  "cloudKmsKeyAndCert": {
    object (CloudKmsKeyAndCert)
  },
  "signingCertificateLineage": string
}
Fields
cloudKmsKeyAndCert

object (CloudKmsKeyAndCert)

Required. Cloud KMS key and the certificate associated with the key.
signingCertificateLineage

string (bytes format)

Required. Proof-of-rotation. See creating signing certificate lineages.

A base64-encoded string.