Follow the current sign-in integration
The Firebase Android Google sign-in guide uses the current Android credential flow and Firebase Authentication integration. Do not mix an older GoogleSignInClient tutorial with current Credential Manager examples without a deliberate migration plan.
Enable the Google provider for the intended Firebase project and use configuration belonging to the correct Android app registration.
Match package, certificate and client identity
| Build source | Certificate to verify |
|---|---|
| Local debug | Debug signing certificate |
| Locally signed release | Your local release/upload certificate as applicable |
| App installed from a Play testing or production track | Play app-signing certificate |
| Internal App Sharing | Its separate distribution signing behavior |
Play App Signing explains why the upload key and app-signing key have different roles. A successful upload does not mean the installed APK uses the upload certificate.
Diagnose the boundary that failed
Determine whether the failure occurs when obtaining a Google credential, exchanging it with Firebase, or authorizing a backend request after sign-in. Keep the exception type and redacted status details.
Do not log ID tokens, access tokens or user credentials in public issue reports. A backend must verify the token intended for its trust boundary rather than accept a client-supplied user ID.
Test every distributed identity
Install the actual Play-delivered test build and complete sign-in using the same Firebase environment intended for release. A locally installed release APK is not a complete substitute for this test.
After changing registered fingerprints or configuration, rebuild as required and verify that the running artifact contains the intended configuration.
Use APKLint to inspect, not authenticate
The signing and Firebase tools can help compare package metadata and certificate fingerprints. They do not access your OAuth settings or certify a credential exchange. Use them to narrow identity mismatches, then confirm the complete sign-in and authorization flow in your app and backend.
Sources and further reading
Reference review: 22 September 2026. Examples illustrate the workflow; check your installed versions, release artifact and account-specific Console requirements before applying them. This guide is not a claim that APKLint executed your project or verified your private account.
Android inspection tools and practical release guides. About APKLint · Report a correction
