Why Google Sign-In Fails Only in the Google Play Build

Google Sign-In may work in an app installed directly from Android Studio but fail in a closed-test or production build installed from Google Play.

Common symptoms include:

• Returning to the original screen after selecting a Google account
• DEVELOPER_ERROR or error code 10
• No user appearing in Firebase Authentication
• Failure to obtain an ID token only in an internal-test or production build

The most common cause is that the SHA fingerprint of the app signing key used by Google Play for the distributed build has not been registered in Firebase or Google Cloud.

Why does the debug build work?

Google Sign-In identifies an Android app through a combination of values such as:

• Package name
• Signing certificate
• SHA-1 or SHA-256 fingerprint
• OAuth client
• Firebase or Google Cloud project

An Android Studio debug build is normally signed with debug.keystore. An APK distributed by Google Play is signed with the app signing key managed through Play App Signing.

Even with the same package name, the signing certificates differ. Registering only the debug SHA can therefore make authentication work locally while the Google Play build fails.

Distinguish the upload key from the app signing key

Play App Signing uses two important keys:

For authentication in the Google Play build, the certificate that normally matters is the app signing key certificate.

Do not copy the upload-key fingerprint when the Firebase configuration requires the certificate of the installed Play-distributed app. For more detail, see Play App Signing and Upload Keys Explained.

Fastest fix sequence

1. Open the target app in Play Console
2. Open the Play App Signing or app-integrity page
3. Copy the SHA-1 from the app signing key certificate
4. Copy SHA-256 as well when required by the feature
5. Add the fingerprints to the correct Android app in Firebase
6. Enable the Google provider in Firebase Authentication
7. Review the OAuth clients in Google Cloud
8. Download the latest google-services.json
9. Increase versionCode and publish a new AAB
10. Update the app from Google Play and test again

Add the SHA fingerprint to Firebase

In Firebase Console:

1. Open the correct project
2. Open Project settings
3. Go to General and Your apps
4. Select the Android app
5. Choose Add fingerprint
6. Save the SHA copied from Play Console

SHA-1 is especially important for Google Sign-In. SHA-256 may be required for Firebase App Check, Play Integrity, Android App Links, or other APIs, so follow the official setup instructions for the features you use.

The same Android app entry can contain fingerprints for debug, local release, and Google Play app-signing certificates.

Confirm the package name

The package registered in Firebase must match the actual applicationId of the Google Play build.

android {
    defaultConfig {
        applicationId = "com.example.app"
    }
}

A product flavor can change the final package name:

productFlavors {
    create("development") {
        applicationIdSuffix = ".dev"
    }
}

In this example, the development build is com.example.app.dev, while production is com.example.app.

Check the production package submitted to Google Play, not the package used by a local development flavor.

Android client ID versus web client ID

Google Sign-In commonly involves two OAuth client types that serve different purposes.

Android client ID

An Android OAuth client identifies the app through its package name and SHA-1 certificate fingerprint.

Web client ID

A web OAuth client is commonly used as the ID-token audience or server client ID. With Credential Manager, setServerClientId normally receives the web client ID.

val googleIdOption = GetGoogleIdOption.Builder()
    .setFilterByAuthorizedAccounts(false)
    .setServerClientId(WEB_CLIENT_ID)
    .build()

Using an Android client ID in this field can produce an audience or configuration mismatch.

Review the client type in Google Cloud Console instead of selecting an ID only because its name looks familiar.

Update google-services.json

After adding SHA fingerprints or changing Google Sign-In configuration, download the latest google-services.json from Firebase.

The standard Android location is:

app/google-services.json

Flutter and React Native normally use:

android/app/google-services.json

Confirm that the file belongs to the intended Firebase project and Android app by checking both project_id and package_name. See What Is google-services.json? for a complete configuration checklist.

When only the backend returns 401

If account selection succeeds but the backend rejects the token with HTTP 401, inspect the ID token’s aud claim.

Compare:

• The web client ID used by the app
• The web OAuth client ID in Google Cloud
• The audience or client IDs accepted by the backend

When these do not match, the Google account flow can complete while server-side token verification fails.

Do not disable audience verification merely to make the request pass. Correct the client configuration on the app and backend.

Test each distribution type separately

After the fix, distinguish these builds:

When testing the Google Play build, make sure the device is running the version installed or updated through Google Play, not an older locally installed APK with the same package name.

If a differently signed local build remains installed, uninstall it only after confirming that losing local app data is acceptable.

Additional checks when the SHA is already registered

If the app signing SHA-1 is already present, verify:

1. The fingerprint was added to the correct Firebase Android app
2. The Firebase project matches the one used by the app
3. The Google provider is enabled
4. The current google-services.json contains the correct client configuration
5. The server client ID is a web client ID
6. The backend accepts that web client ID as an audience
7. The published AAB has a higher unused versionCode
8. The tester actually received the latest release

A matching SHA cannot compensate for a wrong package name, wrong Firebase project, or wrong OAuth audience.

Summary

When Google Sign-In fails only in the Google Play build, check these items in order:

1. App signing key SHA-1 in Play Console
2. The Android app entry in Firebase
3. Package name
4. Google provider status
5. Android OAuth client
6. Web client ID
7. Latest google-services.json
8. Latest AAB and versionCode

Start by confirming that Firebase contains the SHA of the app signing key, not only the upload key or debug key. For a comparison of all certificate types, see Add SHA-1 and SHA-256 for Debug, Release, and Google Play.