Native white label app | Troubleshooting JSON key creation (Google Play Console)

Content

• Background
• Cause
• Solution
  • A) Contact Administrator
  • B) Adjust the policy in the Google Cloud Console
• Security Notice
• Responsibilities (Who does what?)

Background

To sign your native whitelabel app in the Google Play Console, a JSON key must be created. In some organizations, this step is blocked because the creation of service account keys is disabled by an organizational policy in the Google Cloud.

The error occurs during this step: Creating a JSON key to sign your app.

Cause

In the Google organization, the policy for service account key creation is active:

iam.disableServiceAccountKeyCreation

When this policy is enforced, no JSON keys can be created.

Solution

A) Contact Administrator

Contact the Organization Policy Administrator with the role:

roles/orgpolicy.policyAdmin

Only this role can disable the above policy or define exceptions. Explain why the JSON key is needed (e.g., app signing for a whitelabel app) and that there is no suitable alternative.

B) Adjust the policy in the Google Cloud Console

1. Select Organization: In the Google Cloud Console at the top, select the Organization (not just a project).
2. Navigate to Policies: Menu → IAM & Admin → Organization Policies.
3. Search for Policy: In the filter field, enter “Service account key” or directly iam.disableServiceAccountKeyCreation.
4. Edit Policy: Open the policy → Manage policy.
5. Disable enforcement or define an exception:
   • Option Enforcement: Off to disable the policy, or
   • define an Allow rule as an exception for the affected project.
6. Save: Save the changes. Afterwards, the creation of JSON keys should be possible.

Security Notice

The creation of service account keys is a potential security risk if keys are not managed carefully:

• Use JSON keys exclusively for the app signature of the whitelabel project.
• Store keys securely and DO NOT share them publicly.
• Transmit the key to Allthings only in encrypted form.
• Revoke / delete keys that are no longer needed in the Google Cloud.

Responsibilities (Who does what?)