App signing and bundle identifiers
The cryptographic signature and permanent ID that prove each app update comes from you, and that the stores use to tie every release together.
Updated October 2026 · with examples from our own builds
What does app signing and bundle identifiers mean in practice?
Every Android and iOS build is signed with keys that belong to the publisher, and every app has a bundle identifier or package name that the store treats as its identity. An update must carry the same identity and a valid signature, or the store refuses it.
These belong to your company from day one. Signing keys, certificates and store accounts are product assets, and if they live only on a former developer's laptop, shipping the next update can turn into a recovery project.
Identifiers are effectively permanent once an app is listed. A brand rename doesn't mean renaming the identifier, and changing it on one platform to match the other can break uploads in ways that look like permission errors.
App signing and bundle identifiers at a glance
- Who should own it
- The company's accounts, not an individual developer
- Hand over
- Keys, certificates and store access, documented
- Treat as permanent
- Bundle identifiers and package names
Where has app signing and bundle identifiers come up in our builds?
A brand rename had changed the iOS identifier to match Android's while the App Store Connect record had always been fit.trainr.mobile, so uploads failed from 25 May with what looked like a permissions problem. At handover we passed over the signing material along with the accounts and runbooks.
Every APK is recorded with its git tag, commit, sha256, signing certificate and the backend commit it expects, and a verifier script checks the certificate before any build is shared.
The app still carries React Native's default bundle identifiers, one of the items recorded as standing between the build and a store release.
Common questions about app signing and bundle identifiers
What happens if we lose the app's signing key?
On iOS, certificates can be reissued from the company's developer account. On Android, apps enrolled in Play App Signing can have a lost upload key reset, but an app signed only with a lost key can't be updated under the same listing. Keep keys in company-owned accounts and write down where they live.
Can I change my app's bundle identifier after launch?
Not for the same store listing; a new identifier is a new app. Rebrand the name and icon instead and leave the identifier alone, which is what fixed Trainr's iOS uploads.
Related terms
Sources
Planning a product and not sure where app signing and bundle identifiers fits? Ask us, or browse all 116 terms in the glossary.