PeerPlay
Play Console shows this error when the file you uploaded was signed with Android's debug key instead of your own release key. The fix is to create a release keystore, make your release build use it, and upload the release build again.
The message usually reads: "You uploaded an APK or Android App Bundle that was signed in debug mode. You need to sign your APK or Android App Bundle in release mode." It often shows up right when a developer is trying to get a first build onto a closed testing track, so here is how to find the cause quickly.
Why Google Play refuses debug builds
Android Studio creates a debug keystore automatically on every developer's computer, usually at .android/debug.keystore in your home folder, with the well-known password android. It exists so you can run builds on your own phone without any setup.
Because every machine has its own throwaway debug key with the same public password, it can't identify you as the publisher of an app. Google Play needs every upload signed with a key that belongs to you, so it rejects anything signed with the debug certificate.
Step 1: check which key signed the file
Before you change anything, confirm what you uploaded. In a terminal, run keytool -printcert -jarfile app-release.aab, using the path to your bundle. keytool comes with the JDK that Android Studio uses.
Look at the Owner line. If it says CN=Android Debug, O=Android, C=US, the file was signed with the debug key. If it shows the name you entered when you created your release key, the signing is fine and you probably uploaded a different file than you think.
Step 2: build the release variant with your own key
In Android Studio, don't use the Run button or a plain build for this. Open Build, choose Generate Signed App Bundle or APK, pick Android App Bundle, and create a new keystore if you don't have one yet. On the last screen choose the release variant.
If you build from the command line, run gradlew bundleRelease. A debug task such as assembleDebug or bundleDebug always uses the debug key.
If you have no release keystore at all, this is the moment to create one and store it safely, together with its passwords. Every future update has to be signed with the same upload key.
Step 3: check the release block in Gradle
If you ran a release build and still got the error, open android/app/build.gradle or build.gradle.kts and find the release entry under buildTypes. If it says signingConfig signingConfigs.debug, your release build is signed with the debug key on purpose.
This is the default in new Flutter and React Native projects. Both templates sign release builds with the debug key until you change it, with a comment telling you to add your own signing config. So flutter build appbundle produces a release build that Google Play still rejects.
Add a release entry under signingConfigs with your keystore path, store password, key alias and key password, then set the release build type to signingConfigs.release. Keep the passwords in a key.properties file or environment variables that aren't committed to your repository.
Step 4: if it only fails in CI
If local builds are fine but builds from GitHub Actions or another CI service are rejected, the signing secrets are probably missing on the runner. Some build scripts quietly fall back to the debug key when the keystore variables are empty, so the build passes and Play Console rejects the file.
Check that the secret names in your CI settings match the names your Gradle file reads, and that the decoded keystore file exists where the build expects it. Then run the keytool check from step 1 on the file the CI produced.
Once Play Console accepts the bundle, the next step for a new personal account is usually the closed test with 12 opted-in testers for 14 days in a row. PeerPlay is a free way to find those testers: Android developers test each other's apps every day through your real closed track.
FAQ
What does signed in debug mode mean on Google Play?
It means your APK or app bundle was signed with Android's automatic debug key, which Google Play doesn't accept. Sign it with your own release key and upload again.
Why does my Flutter release build still get this error?
New Flutter projects sign the release build with the debug key by default. Add a release signing config in android/app/build.gradle and point the release build type to it.
How do I check if my AAB is signed with the debug key?
Run keytool -printcert -jarfile followed by the file path. If the Owner line says CN=Android Debug, it is a debug signature.
What if I lose my release keystore?
If your app uses Play App Signing, the key you upload with is an upload key, and you can ask Google to reset it from Play Console. Keep a backup anyway.