Google Sign-In fails with DEVELOPER_ERROR (code 10) only on Play App Signing builds

[jajo1009-coder]

Is there an existing issue for this?

• I have searched the existing issues.

Which plugins are affected?

Auth

Which platforms are affected?

Android

Description

Google Sign-In (google_sign_in + firebase_auth) fails exclusively on builds distributed via Google Play (signed with Play App Signing). It works perfectly on debug builds and on local release builds signed with my own upload key.

Exact error on the Play Store build:
PlatformException(sign_in_failed, com.google.android.gms.common.api.ApiException: 10: , null, null)

What I already verified:

• Play App Signing SHA-1 registered in Firebase Console (+ SHA-256)
• Same SHA-1 present in google-services.json as oauth_client (client_type 1)
• Android OAuth client with that SHA-1 + correct package exists in Google Cloud Console
• serverClientId in code matches the Web client ID in Firebase Auth > Google sign-in method exactly
• OAuth consent screen is "In production"
• All OAuth clients belong to the same project number, no duplicates sharing the SHA-1
• Tested WITH and WITHOUT serverClientId — identical code 10
• Persisted for several days, so it is not OAuth propagation delay

Expected: sign-in should succeed on Play App Signing builds as it does on locally-signed release builds.
Actual: DEVELOPER_ERROR (code 10) only on Play-distributed builds.

Reproducing the issue

1. Build a Flutter app with google_sign_in + firebase_auth, using GoogleSignIn with serverClientId (Web client ID).
2. Register all SHA-1 fingerprints (debug, upload key, and Play App Signing) in Firebase Console.
3. Upload the AAB to Google Play (Play App Signing enabled).
4. Install the app from Play Store (closed testing track).
5. Tap "Sign in with Google", select an account.
6. Result: PlatformException sign_in_failed, ApiException code 10. The same build installed locally via adb (signed with upload key) works fine.

Firebase Core version

3.15.2

Flutter Version

3.41.9

Relevant Log Output

PlatformException(sign_in_failed, com.google.android.gms.common.api.ApiException: 10: , null, null)

Flutter dependencies

flutter 3.41.9 / Dart 3.11.5
firebase_core 3.15.2
firebase_auth 5.7.0
google_sign_in 6.3.0
firebase_analytics 11.6.0
firebase_crashlytics 4.3.10
cloud_firestore 5.6.12
in_app_purchase 3.3.0

Additional context and comments

Login works on debug and locally-signed release builds, fails only via Play Store distribution.

[SelaseKay]

Hi @jajo1009-coder, thanks for the detailed report.
ApiException: 10 is DEVELOPER_ERROR from Google Sign-In / Google Play services and is almost always caused by a package name + signing certificate mismatch in the OAuth/Firebase configuration. Since this fails before Firebase Auth receives a Google credential, this does not currently look like a firebase_auth plugin issue.

For Play App Signing builds, the installed app is signed with Google’s app signing certificate, not the local upload key. Could you verify the actual certificate on the Play-distributed APK and compare it against the Firebase/Google Cloud OAuth client?

[jajo1009-coder]

Thanks @SelaseKay. I verified the actual signing certificate of the Play-distributed APK as you suggested.

I downloaded the universal signed APK from Play Console (App Bundle Explorer) and extracted its certificate with apksigner:

apksigner verify --print-certs 7.apk

Result — V3.0 Signer certificate (CN=Android, O=Google Inc.):
SHA-1: 4E:AF:53:43:EC:C9:1B:95:4E:79:BE:C3:0C:8F:C2:D2:90:BF:BA:9F

This SHA-1 is identical to the Play App Signing certificate registered in Firebase Console and to the Android OAuth client in Google Cloud Console (auto-created by Google Service) with package com.sellofoto.sellofoto. So the certificate in the distributed APK matches the registered OAuth client exactly — there is no package/certificate mismatch.

To summarize what is verified:

• APK distributed by Play is signed with 4E:AF:53... (confirmed via apksigner on the actual APK)
• That exact SHA-1 is registered in Firebase + Cloud Console for the correct package
• Web client ID in code (serverClientId) matches the Web client ID in Firebase Auth > Google provider
• OAuth consent screen is in production
• Same code works on debug builds and on locally-signed release builds (upload key SHA-1, also registered)
• Fails with ApiException 10 ONLY on the Play-distributed build

Given that the distributed certificate matches the registered OAuth client, what else could trigger DEVELOPER_ERROR specifically for Play App Signing builds?