Signing and store upload problems

This page covers the signing and upload problems we’re asked about most. For build failures in general, start with Troubleshooting. For first-time setup, see Generate Certificates with VoltSigner, Uploading to Google Play and Uploading to App Store Connect.

Android

• APK or AAB: which settings do I need?
• Google Play says the app is signed with the wrong key
• Version code has already been used
• My build didn’t upload to Google Play

iOS

• iOS debug builds need certificates too
• iosPackageType
• Certificate and provisioning profile don’t match
• Installing on testers’ iPhones
• App Store Connect sign-in errors
• Build number or version already used
• My build didn’t upload to App Store Connect

Android

APK or AAB: which settings do I need?

Google Play needs an Android App Bundle (.aab). Other stores, and installing directly on devices, use an .apk. These are the voltbuilder.json settings for each:

You want	release	androidPackageType	Also needed
APK to test on your own device	"debug"	(ignored)	Nothing. Debug builds are signed with a test key.
Signed APK for direct install	"release"	"apk" (default)	Keystore settings
AAB to upload to Play yourself	"release"	"bundle"	Keystore settings
AAB uploaded to Play for you	"release"	"bundle"	Keystore settings, googlePlayKey, googlePlayTrack

Things to know:

• There’s no such thing as a debug AAB. Debug builds always produce an APK, whatever androidPackageType says.
• googlePlayTrack: "production" always produces an AAB, even if androidPackageType is apk.
• The keystore settings are androidKeystore, androidKeystorePassword, androidAlias and androidAliasPassword. If you made the keystore with VoltSigner, the alias is key0 and the alias password is the same as the keystore password. See How to set up your project for every setting.

Google Play says the app is signed with the wrong key

Most apps on Google Play use Play App Signing: Google holds the key that signs the app for users, and you sign each upload with an upload key. The keystore in your voltbuilder.json must be the upload key registered for that app in Play Console.

• To check, compare the upload key SHA-1 fingerprint in Play Console (App integrity > App signing) with your keystore’s fingerprint: keytool -list -v -keystore android.keystore
• If you’ve lost the upload key, or want to use a new one from VoltSigner, you can ask Google for an upload key reset from the same Play Console page. Google’s steps are in Use Play App Signing.

Keep a backup of your keystore and its passwords. Without them you can’t publish updates until Google resets the upload key.

Version code has already been used

Every upload to Google Play needs a higher android-versionCode than any build Google has seen for that app, including ones you uploaded and then deleted:

<widget id="com.example.app" version="1.0.1" android-versionCode="10102" ...>

android-versionCode must be a whole number. For Capacitor projects, the version code comes from versionCode in android/app/build.gradle.

My build didn’t upload to Google Play

VoltBuilder only uploads when the build is a release build and googlePlayKey points to your Google service account JSON file. If either is missing, the build finishes normally without uploading. If the upload fails, the error appears at the end of your log:

• invalid_grant: Invalid JWT Signature: refresh your credentials.
• Target SDK too low: Google requires a recent target SDK. See Match android-targetSdkVersion to your engine.
• Permission errors: the service account needs release permissions for this app. See Add App Permissions to the Credentials.

iOS

iOS debug builds need certificates too

Apple requires every iOS app to be signed, including test builds. A debug build needs these in voltbuilder.json, with the files in your certificates folder:

"iosDevP12": "certificates/ios_development.p12",
"iosDevP12Password": "mypassword",
"iosDevelopment": "certificates/development.mobileprovision",

You can create them without a Mac using VoltSigner. You need an Apple Developer account.

iosPackageType

iosPackageType tells VoltBuilder what kind of release build to make. It must match the type of distribution provisioning profile you created in your Apple Developer account:

iosPackageType	Provisioning profile type	Used for
"ad-hoc"	Ad Hoc	Installing on registered testers’ devices
"app-store"	App Store Connect	TestFlight and the App Store
"enterprise"	In House	Apple Developer Enterprise Program only

• Release builds require it. Without it you get iosPackageType must be ad-hoc, app-store, or enterprise.
• Not every plan includes every type. If yours doesn’t, you get iosPackageType ... not included in ... Plan. See plans.
• Remove it for debug builds. Debug builds always use your development profile. If iosPackageType is "app-store" and your App Store Connect credentials are set, VoltBuilder tries to upload the debug build to App Store Connect, which rejects it. Leave iosPackageType out (or remove the App Store Connect settings) while you’re making debug builds, and add it back for release.

Certificate and provisioning profile don’t match

Errors such as no certificate matching team, Signing certificate is invalid, Missing private key for signing certificate and invalid provisioning profile errors usually mean the .p12 and .mobileprovision don’t belong together. Check that:

1. Both come from the same Apple Developer team.
2. The provisioning profile was created with this certificate. If you made a new certificate, edit the profile in your Apple Developer account, select the new certificate, and download the profile again.
3. The profile’s App ID matches the id in your config.xml exactly.
4. You’re using a development certificate and profile for debug builds, and a distribution certificate and profile for release builds.
5. The profile hasn’t expired, and includes any capabilities your app uses, such as push notifications. If you turn on a capability for your App ID, download the profile again.

The .p12 must contain the private key as well as the certificate. A .cer file downloaded from Apple doesn’t. VoltSigner makes the .p12 for you.

Installing on testers’ iPhones

To install a build on someone else’s iPhone without the App Store, either:

• Use TestFlight: build with "iosPackageType": "app-store" and upload to App Store Connect, then invite testers there. You don’t need their device details.
• Use an Ad Hoc build: add each tester’s device (UDID) under Devices in your Apple Developer account, edit your Ad Hoc provisioning profile to include them, download it again, and build with "iosPackageType": "ad-hoc". Devices added after the profile was downloaded can’t install the app.

App Store Connect sign-in errors

VoltBuilder signs in to App Store Connect with appStoreConnectAccount and an app-specific password in appStoreConnectAppPassword, not your normal Apple ID password.

• If you get Please sign in with an app-specific password or Your account information was entered incorrectly, generate a new app-specific password and update voltbuilder.json.
• Apple revokes all app-specific passwords when you change your Apple ID password. After changing it, generate a new app-specific password.
• If you change the email address of your Apple ID, update appStoreConnectAccount too.
• Older projects may use itunesAccount and itunesAppPassword. They still work, but please rename them to appStoreConnectAccount and appStoreConnectAppPassword.
• If you get Cannot obtain the content provider public id, see Troubleshooting.

Build number or version already used

Each upload to App Store Connect needs a new build number, set with ios-CFBundleVersion:

<widget id="com.example.app" version="1.0.1" ios-CFBundleVersion="12" ...>

Once a version (the version attribute) has been submitted for review and released, Apple closes it to new builds. If you get an error that the version must be higher than the previously approved version, increase version.

For Capacitor projects, both numbers come from your Xcode project in the ios folder.

My build didn’t upload to App Store Connect

VoltBuilder only uploads when iosPackageType is "app-store" and both appStoreConnectAccount and appStoreConnectAppPassword are set. Otherwise your log shows App Store Connect credentials not found, skipping upload and the build finishes without uploading.

If Apple rejects the upload, the reason appears at the end of your log. Common ones are a missing icon size, an icon with transparency (the App Store icon can’t have an alpha channel), and a build or version number that’s already been used.

Still stuck?

See What to send if you need help.