Google Play Console API keys and credentials

What every Google Play Console credential a founder holds does, whether it expires, and what tends to break. Each fact links to Google Play Console's own docs.

Last checked 2026-11-06 · play.google.com/console

At a glance

Credential	Expiry	Permissions
Service account JSON key (Google Play Android Developer API)	You choose	Can be scoped
Upload key (Play App Signing)	Not documented	Full access only
Google account (Play Console owner login)	Not documented	–

Each credential

Service account JSON key (Google Play Android Developer API)

You choose
Can be scoped

Create the service account in Google Cloud, then invite its email in Play Console Users and permissions and grant only the needed rights (for example View financial data, Manage orders and subscriptions). Google Cloud keys never expire by default (default_lifetime_days null means no default expiry); an organization policy constraint can set a validity period. A service account can have up to 10 keys. Disable before deleting; deletion is permanent. Deleting a key does not revoke short-lived credentials already issued from it. Google recommends Workload Identity Federation over keys where possible. The Play page says to use the API without linking a Cloud project.

Google Play Console docs

Upload key (Play App Signing)

Not documented
Full access only

Used to sign uploads; Google holds the app signing key when Play App Signing is used. If the upload key is lost or compromised Google can reset it: create a new upload key, export its certificate to PEM with keytool, and submit it from the Play app signing page with a reason. If you manage the app signing key yourself and lose it, it cannot be reset.

Google Play Console docs

Google account (Play Console owner login)

Not documented

Developer account is tied to a Google account that must complete identity verification using a government ID and a credit card under the legal name. Play Console access is granted per user through Users and permissions.

Google Play Console docs

What usually goes wrong

Service account JSON key stops authenticating after being disabled or deleted, breaking CI publishing
Service account lacks Play Console permissions after the invite is removed, so API calls return 403
Lost upload key blocks uploads until Google completes a reset request
Service account reaches the 10-key limit and new keys cannot be created until old ones are deleted
JSON key committed to a repo or shared chat and not rotated

Renewals and billing

One-time US$25 registration fee, not renewable. Identity info that is found invalid means the fee is not refunded.

What Google Play Console's docs don't say

We couldn't confirm these from official docs, so don't rely on them either way:

Whether service account key validity periods are returned by the API (the Google Cloud page mentions validity fields but was not fully confirmed)
Whether the upload key expires (page does not say)
Whether the Play Developer API key creation page itself provides a different expiry setting
Play Console account closure policy
Whether an organization policy in the customer's Google Cloud project is set to enforce key expiry

Rotating or replacing a Google Play Console key

The steps are the same for most providers: make the new key, deploy it everywhere the old one is used, check it works, then revoke the old one. Our guides walk through it:

Rotate an API keyWithout downtime, in the right order. A key leakedWhat to do in the first hour.

Sources

Related providers

Apple Developer ProgramApp stores Chrome Web StoreApp stores

Keep track of every Google Play Console key

StackHangar stores your Google Play Console keys in an encrypted vault, grouped by the product they belong to, warns you before they expire, and walks you through rotating them. We can't read your secrets.

Start free with 2 projects How the vault works