Publish Kivy App to Google Play

You've poured hours into building a polished Kivy app, tested it on your desktop and maybe sideloaded it to a device. But that app is worthless if no one can install it from the Play Store. The gap between a working Kivy project and a published Android app is filled with signing keys, build formats, and Play Console policies that can trip up even experienced developers. This lesson walks you through the entire process of signing and publishing a Kivy app to Google Play — from generating a keystore to uploading an AAB — so your creation reaches millions of potential users.

The problem this lesson solves

You have a Kivy app that runs beautifully on your machine. The challenge is that the Android package you built with buildozer isn't ready for the Play Store. Google requires that every app distributed through the Play Store be signed with a private key and packaged as an Android App Bundle (AAB) rather than a plain APK. Moreover, the Play Console has strict rules about app content, privacy policies, and testing requirements that can delay or even block your release.

Without a proper signing setup, you'll encounter errors both during the build process and when uploading to the Play Console. You might also face the nightmare of losing your keystore — which would make it impossible to update your app in the future. This lesson solves those problems by providing a clear, step-by-step path from your Kivy project to a published app on Google Play, covering signing, building, uploading, and the pitfalls in between.

Core concept / mental model

Think of app signing like a wax seal on a medieval document. The seal (your keystore and key) proves the document (your app) is authentic and hasn't been tampered with. Google uses the signature to verify that updates come from you and no one else. If you lose the seal, you lose the ability to prove ownership of future documents.

Google Play App Signing is a modern twist: you upload your app signed with an upload key, and Google manages the app signing key that ultimately signs what users receive. This separation gives you a safety net — even if your upload key is compromised, Google can help you recover it.

In practical terms, the mental model looks like this:

• Keystore — A binary file that holds one or more private keys. Think of it as a keychain.
• Key — A single signing key within the keystore, identified by an alias. This is the actual 'seal' for your app.
• AAB (Android App Bundle) — The modern publishing format that contains your app's code and resources; Google generates optimized APKs for each device from it.
• Play Console — The dashboard where you upload, manage, and release your app.

How it works step by step

Publishing a Kivy app to Google Play follows a predictable sequence. Here's the high-level flow:

1. Prepare your Kivy app — Ensure your app is stable, has an icon, and its buildozer.spec is correctly configured.
2. Generate a signing keystore — Use keytool (from the JDK) to create a keystore with a key for your app. This keystore is your identity as a developer.
3. Configure Buildozer — Point your buildozer.spec to the keystore, key alias, and passwords.
4. Build a release AAB — Run buildozer android release to produce an unsigned or signed AAB, depending on your setup.
5. Upload to Play Console — Create a new app, fill in the store listing, set up app signing, and upload your AAB.
6. Review and release — Complete the content rating, data safety, and target audience forms, then roll out your app.

Each step builds on the previous one, so getting the signing configured correctly early saves you from rebuilding later.

Hands-on walkthrough

Step 1: Generate a signing keystore

First, ensure you have the JDK installed (for keytool). Then run:

keytool -genkey -v -keystore my-release-key.keystore -alias myapp -keyalg RSA -keysize 2048 -validity 10000

You'll be prompted for a password and details like your name and organization. Important: Store this keystore and password in a secure place — you'll need them for every future update.

Step 2: Configure buildozer.spec

Edit your buildozer.spec file to include signing information:

# buildozer.spec
android.archs = arm64-v8a
android.package_name = com.yourcompany.yourapp
android.permissions = INTERNET
android.keystore = my-release-key.keystore
android.keyalias = myapp
android.storepass = your-store-password
android.keypass = your-key-password

Replace paths and passwords with your actual values. It's wise to keep passwords out of version control; use environment variables if possible.

Step 3: Build the release AAB

Now build the Android App Bundle for release:

buildozer android release

This produces an AAB file in bin/ (e.g., bin/MyApp-0.1-arm64-v8a-release.aab). In older versions of Buildozer, you might need buildozer android release --aab explicitly.

Step 4: Verify the AAB

Before uploading, you can inspect the AAB with apksigner (part of Android SDK) to confirm it's signed:

cd $(find ~/.buildozer -name "apksigner" -type f | head -1)
apksigner verify --print-certs /path/to/your-app.aab

You should see the certificate details matching your keystore.

Step 5: Upload to Google Play Console

1. Go to Google Play Console and sign in.
2. Click Create app, enter your app's name, choose it as an app or game, and select the free/paid status.
3. Follow the prompts to set up your app's Store listing (description, screenshots, feature graphic).
4. In the Setup > App signing section, choose "Let Google manage and protect your app signing key" and upload your signed AAB. Google will then generate the upload key and ask you to download a PEPK file to opt in.
5. Complete the Content rating and Data safety forms.
6. Go to Production > Release, select your release track, and upload the AAB. Add release notes and roll out.

Compare options / when to choose what

For most developers today, Google Play App Signing is the way to go. It adds protection without harming your workflow.

Troubleshooting & edge cases

Error: "Keystore was tampered with, or password was incorrect" — You mistyped a password or the keystore path is wrong. Double-check your buildozer.spec and try using keytool -list -keystore to test the keystore.

Error: "Android App Bundle must be signed" when uploading — The build produced an unsigned AAB. Ensure your buildozer.spec has the keystore configured, and you ran with release (not debug). Also, Buildozer sometimes needs android.release_artifact = aab in the spec.

AAB is too large or unsupported — Kivy apps often miss android.archs = arm64-v8a. Older 32-bit-only ABIs may cause issues since Google requires 64-bit support. Set android.archs = arm64-v8a to keep it lean.

Lost keystore — If you opted into Google Play App Signing, you can reset your upload key via Play Console. If not, you're stuck: you'll need to publish under a new package name or reach out to Google support, but there's no guarantee of recovery.

Buildozer can't find Java or SDK — Ensure you have the full Android SDK and JDK installed, and the ANDROIDSDK and ANDROIDNDK environment variables set if using custom paths.

What you learned & what's next

You now know how to sign and publish your Kivy app to Google Play. You learned the difference between upload keys and app signing keys, how to generate a keystore with keytool, configure Buildozer to produce a signed AAB, and navigate the Play Console release process. You also understand the most common pitfalls—password errors, missing 64-bit support, and keystore loss—and how to avoid them.

With your app live, the next step is marketing and maintenance: monitoring crashes with Firebase Crashlytics, responding to user reviews, and rolling out updates. In the next lesson of this track, you'll dive into monetizing and analyzing your Android app, where we'll cover in-app purchases, analytics, and A/B testing. Build on this foundation to turn your Kivy app into a thriving product.