DEVELOPER_ERROR: SHA1 doesn't work on Google Play Store, but work on production code [android] [googleSignIn]

[alexiej]

My code for googleSignIn works fine on iPhone, Android Debug, Android Release, but when I push the code to Google Play for testing I've got error:

DEVELOPER_ERROR

I've added all type of SHA1, SHA256 to the firebase but without success :(

One I've got from ./gradlew signingReport for debug, and release, and after adding this it works fine. But when I've upload a release to the Google Play :(

I also added all SHA1, SHA256 from the Google Console Play App Signing Certificate but without success.
The only version that works is:

• iPhone
• Android Debug
• Android Release

but I din't know why Android Google Play for Open / Internal testing doesn't work :( Is it possible to get information about what SHA1 is assigned to the app after release?

[alexiej]

The topic can be closed. I found the solution. For anyone like me who f** with this 2 days. You need use App signing key: legacy key (not latest)

[maztak]

It's worked for me although I'm developing native android app.
When I run apksigner verify --print-certs 90.apk for the apk that signed universal apk downloaded from Play Console bundle explorer.

Signer (minSdkVersion=33, maxSdkVersion=2147483647) certificate SHA-1 digest:
Signer (minSdkVersion=24, maxSdkVersion=32) certificate SHA-1 digest:
Source Stamp Signer certificate SHA-1 digest:

My Android device and Android emulator also Android14(SDK34), so I don't know this response really relevant to this bug, but It worked for me. Thanks a lot, lovely ;)

[JayceLuong]

it took me a half of day too, Thank you for your answer

[mikehardy]

Hey @JayceLuong may I ask for a link to rnfirebase.io where you were instructed to do this? Or what feature you were implementing that required this? (phone auth, social auth, general setup ?)

Your not the first to lose a bunch of time obviously, and others have been confused as well.

Some people are still using APKs but most are using ABBs signed by Play Store so it seems like the best thing to do is to update our documentation - where ever it is - to direct all people to go to Play Store -> their most recent release -> find bundle explorer -> downloads tab -> download one of the APKs -> use apksigner verify --print-certs <downloaded apk> to get the SHAs.

That way it doesn't matter how it was uploaded, the actual artifact users get (and what you need the SHA for) is what someone following the directions will get

[JayceLuong]

Hi @mikehardy I'm not using RN firebase, I'm a native android dev, yes you're right we should always verify certificate by command apksigner but I assume it use the sign key provide by google instead of legacy key

[mikehardy]

Then I must be missing something. I always thought the certificate of the APK the end user actually got was the certificate known to the app (it has been when I've programmatically interrogated the apis for signing info in my own app). So if I get that Sha it should work? I'd love to understand more, but honestly I didn't realize there was a legacy and nonlegacy key. Perhaps that's the new signature format I read about last year and it's in place now