Add SHA-1 to Firebase for Debug, Release, and Google Play

Features such as Google Sign-In with Firebase Authentication require the signing-certificate fingerprint of the Android app to be registered in Firebase.

Android apps can be signed differently depending on how they are built and distributed:

• A debug build run from Android Studio
• A locally distributed release APK
• An AAB uploaded to Google Play
• An APK delivered to users by Google Play

Registering the wrong fingerprint can produce a situation where authentication works in debug builds but fails only in the Google Play version.

What SHA-1 and SHA-256 identify

A SHA fingerprint identifies an Android app’s signing certificate.

Firebase and Google Cloud commonly identify an Android client by the combination of:

• Package name
• Signing-certificate SHA fingerprint

Typical uses include:

Follow the current official setup instructions for the specific product you use.

Which fingerprint should be registered?

For Google Sign-In in a Play-distributed app, the most important value is usually the SHA-1 of the app-signing certificate shown in Play Console.

Add a fingerprint in Firebase

1. Open the correct project in Firebase Console
2. Open Project settings
3. In General, find Your apps
4. Select the relevant Android app
5. Choose Add fingerprint
6. Enter the SHA-1 or SHA-256 value
7. Save the change

One Firebase Android app can contain multiple fingerprints, including debug, local release, and Google Play app-signing certificates.

Get fingerprints with signingReport

Run the Gradle task from the directory containing the Gradle Wrapper.

Windows PowerShell

.\gradlew signingReport

macOS or Linux

./gradlew signingReport

For Flutter, the command is normally run inside the android directory.

cd android
./gradlew signingReport

Example output:

Variant: debug
Config: debug
SHA1: AA:BB:CC:DD:...
SHA-256: 11:22:33:44:...

Confirm the build variant before copying a value.

Get fingerprints with keytool

When you know the keystore file and alias, use keytool:

keytool -list -v \
  -keystore upload-keystore.jks \
  -alias upload

In Windows PowerShell, you can run it on one line:

keytool -list -v -keystore upload-keystore.jks -alias upload

This shows the certificate stored in the specified local keystore. A Google Play-managed app-signing certificate must be checked in Play Console.

Get the fingerprint for the Google Play build

Open the app in Play Console and go to the Play App Signing or app-integrity page.

The page normally shows two certificate sections:

• App-signing certificate
• Upload certificate

For an app installed from Google Play, register the SHA shown for the app-signing certificate.

What changes when you use another computer?

Android Studio normally creates the debug keystore in the current user’s home directory.

A different computer may generate another debug keystore with a different certificate fingerprint.

If Google Sign-In fails only on the new computer, run signingReport there and add its debug SHA to Firebase.

Product flavors and separate package names

When development and production use different package names, register each as a separate Android app in Firebase.

Development: com.example.app.dev
Production: com.example.app

Add the debug certificate to the development Firebase app and the Google Play app-signing certificate to the production Firebase app.

A correct SHA does not help if it is registered under the wrong package name.

What to check after adding a fingerprint

When changing Google Sign-In configuration, also confirm:

1. The Google authentication provider is enabled
2. You downloaded the latest google-services.json when required
3. The file is in the correct app module
4. You performed a clean rebuild
5. The versionCode was increased before publishing another Play build

Common Android path:

app/google-services.json

Flutter and React Native:

android/app/google-services.json

Are SHA fingerprints secret?

SHA-1 and SHA-256 fingerprints are identifiers of public certificates, not the private keys themselves.

Do not expose:

• .jks or .keystore files
• Private keys
• Keystore passwords
• CI signing secrets

You do not upload the keystore itself to Firebase.

Summary

The fingerprint Firebase needs depends on the signature of the app actually installed on the device:

• Debug build: SHA of the debug keystore
• Locally distributed release build: SHA of the release key used
• Google Play build: SHA of the Play app-signing certificate

If authentication fails only after installation from Google Play, first confirm that the app-signing SHA-1, rather than only the upload-key SHA-1, is registered in Firebase.