gamesRodrigo Antunes
Signed APKs, real ads and Google sign-in: how we ship on Android
What we learned putting several games and apps on Android: debug key, upload key, test ads and the Firebase SHA-1.
Every PixelPerBits game and app with an Android version follows the same path, and it hides a few traps. This post collects the ones that bit us most.
Debug is not release
The debug APK is signed with the Android Studio debug key and shows only Google test ads. The release one is signed with our own key and uses the real ad unit. So before offering an APK for download we check two things: the signature must not be the debug one and the ad ID must not be a test one. A script does this check and refuses the file if anything is wrong.
APK for the site, AAB for Google Play
Google Play wants the AAB format, signed with an upload key, and one app per edition (a free one with ads and a paid one without ads, for example). On the site we offer the APK of the free edition. Since it does not come from Play, Android asks you to allow installs from the site, and every page shows the version, size and SHA-256 of the file for anyone who wants to verify the download.
Google sign-in depends on the SHA-1
Google sign-in on Android only works if the SHA-1 of the certificate that signed the APK is registered in the Firebase app. When you create a new key you have to register that SHA-1 and download google-services.json again, which then includes the certificate. After that, build the APK once more.
There is a free APK to download today for Critter Pop, Pirate Rush, Pirate Rush: Survival, Rodents Chess, Under the Sea, BibleTrend and GameBubble. The games list also has an APK-only view.