Publishing a PWA to Google Play as a Trusted Web Activity: the checklist

1. Is the PWA actually ready?

A Trusted Web Activity is a thin Android shell that opens your web app in Chrome, full-screen, with no browser UI. Anything wrong with the web app is wrong with the Play app. Before you touch the Play Console:

• The site is served over HTTPS on every URL the app can reach, including redirects.
• Chrome on Android offers Install app when you visit — proof that the manifest and icons pass installability checks. If it doesn't, fix that first with the common mistakes guide.
• The manifest's start_url and scope cover every page the app should show. Links that leave the scope open in a Chrome Custom Tab with a URL bar — jarring inside an app.
• The service worker serves something when offline, at minimum the branded offline page. A blank error inside a Play-installed app is a one-star review.
• Pages render properly at 360 px wide with no horizontal scrolling.

2. A Google Play developer account

US$25 one-time. Google asks for identity verification, and organisations need a D-U-N-S number. Personal accounts created since late 2023 must run a closed test with at least 12 testers opted in for 14 continuous days before they can apply for production access — budget for that in your launch date. Organisation accounts skip this requirement.

3. Digital Asset Links: prove you own the domain

This is the step that makes a TWA "trusted". You host a JSON file at https://yourdomain.com/.well-known/assetlinks.json that lists your Android package name and the SHA-256 fingerprint of the signing certificate. Chrome checks it on launch; if it fails, the app still opens but shows a browser bar, which defeats the purpose.

[{
  "relation": ["delegate_permission/common.handle_all_urls"],
  "target": {
    "namespace": "android_app",
    "package_name": "com.example.myapp",
    "sha256_cert_fingerprints": ["AA:BB:CC:…"]
  }
}]

The fingerprint that matters is the one Google Play signs with, not your upload key. After your first upload, open Play Console → Test and release → Setup → App signing and copy the SHA-256 from the App signing key certificate section. The PWA Builder writes an assetlinks.json for you with the upload key; replace the fingerprint with Play's once you have it, and you can list both while testing.

• File is served with Content-Type: application/json and no redirect.
• File is reachable at the exact path — .well-known directories are hidden on some hosts and blocked by some CMS rewrites.
• Test with Google's Statement List Generator and Tester, or simply open the URL in a browser.

4. Build the App Bundle

Google Play accepts new apps only as an Android App Bundle (.aab), not an APK. The PWA Builder's Android option gives you a signed TWA APK for on-device testing plus the starter assetlinks.json; for the AAB itself, run Bubblewrap or PWABuilder against the same manifest (free, local tooling), or — if a WebView-based listing is acceptable — use the Android app builder's APK + AAB bundle (US$5). Whichever produces the bundle, the same rules apply:

• Package name is unique on Play and you will never need to change it — it cannot be edited later.
• Target SDK meets Google's current requirement for new apps (Android 15 / API 35 as of 2025); Play will refuse the upload otherwise.
• Version code increments with every upload.
• Keep your upload keystore somewhere you will find it in three years. With Play App Signing, a lost upload key can be reset — but only through a support process.

5. Store listing assets

Screenshots should show the app as it looks installed — full-screen, no browser bar. Take them from the TWA build, not from Chrome.

6. Data safety, content rating and policy declarations

Three questionnaires in Play Console, all mandatory:

• Data safety. Declare what your website collects, because the app is the website. Analytics? Declare it. Account sign-in? Declare email and name. OneSignal push? Declare the device identifier. Understating this is a common reason for rejection after launch.
• Content rating. Answer the IARC questionnaire honestly; a rating appears on the listing within minutes.
• Target audience and ads. If your site shows ads, say so. If it could appeal to children, the Families policy applies and is much stricter.

7. Closed testing

Create a closed testing track, upload the AAB, add testers by email or Google Group, and share the opt-in link. Testers must install from Play, not from an APK. During the 14 days:

• Confirm the app opens with no browser bar (asset links working).
• Open it in aeroplane mode: the offline page should appear, not an error.
• Rotate the phone, use the back gesture, tap external links — they should open in a Custom Tab, then return.
• Check the pre-launch report in the console; Google runs the app on real devices and reports crashes and accessibility warnings.

8. What review looks at on a TWA specifically

• Minimum functionality. Google rejects apps that are "just a website in a wrapper" with nothing a browser doesn't already do. TWAs are in better standing than plain WebViews because Google designed the pattern, but a static one-page brochure can still be refused. Installability, offline support and push notifications are the usual evidence of app-like behaviour.
• Broken functionality. Any link that 404s, any form that errors, any video that fails to load. Reviewers click everything.
• Metadata. The title, description and screenshots must describe this app. No competitor names, no "#1", no ranking claims.
• Payments. If you sell digital content or subscriptions inside the app, Play Billing rules apply — for a TWA that means the Digital Goods API. Physical goods and services can use your existing web checkout.

9. After launch

Because the app is your website, content changes ship instantly with no Play update. You only release a new AAB when you change the icon, colours, package configuration or need a new target SDK level — Google raises that bar every year, so expect one maintenance release annually. Keep assetlinks.json in place forever; removing it turns every installed copy into a browser tab overnight.