Skip to main content
This section shows how to sign an APK with APKSigner and provides a demonstration.

​
Sign an APK

Find the apksigner module at /Android/sdk/build-tools/<version>/ and perform the following steps to sign an APK with APKSigner:
1
If using Java JDK version newer than 17, run the following command:
Shell
and replace javaOpts="" with the following line:
None
2
To sign an APK with Android APKSigner, run the following command:
Adjust the values for the following arguments to match your environment:
  • —ks-key-alias: The exact on-token alias listed by keytool -list in the previous section, such as apksignerdemo-1784141140:apksignerdemo. The CryptoHub mangles the alias into the form <alias>-<id>:<alias>, so copy it verbatim from the keytool -list output rather than using the short -alias value you passed to keytool -genkeypair. Note: If there are spaces in the key alias, make sure to wrap the entire alias in double-quotes.
  • —in: The .apk file you want to sign, including the full path to the file if necessary.
  • —out: The name of the signed .apk file, including the full path if necessary.
Shell
When prompted for the keystore password for signer #1, enter the identity password configured inside the <CRYPTO-OPR-PASS> tag in the fxpkcs11.cfg file.
3
To verify the signature of the output file, run the following command:
Shell
You should see output similar to the following example:
Shell
In the preceding example, multiple signatures occurred for different Android signing versions. To only sign with one signing version type, add the following flags to your command and enable only the version you want to use to sign:
Shell

​
APKSigner demonstration

The following example demonstrates a signing command with APKSigner:
Shell
The following example demonstrates a verification command with APKSigner:
Shell
For more information on APKSigner and its functions, refer to the Android Developer Documentation ( developer.android.com/tools/apksigner).