Google Sign-In Works in Debug but Fails From Google Play? Register 3 SHA-1 Fingerprints (Flutter, 2026)

Q: What does ApiException 10 mean in Google Sign-In?

It is DEVELOPER_ERROR, which Google’s reference describes as “The application is misconfigured.” In Flutter apps it almost always means the package name and signing SHA-1 of the installed build do not match a registered Android OAuth client.

Q: Why does sign-in still fail after adding the fingerprint?

The usual reason is an old google-services.json in the build or a published build that predates the change. Download the file again, check for the web client entry, rebuild with a new version code and test from a Play testing track.

By giosaia (GSPTeck) · Published 2026-10-20 · Last verified 2026-10-20

Why does Google Sign-In work in debug but fail when installed from Google Play?

Because the app your users install is not signed with your key. With Play App Signing, Google re-signs every release with its own app signing key, so the SHA-1 fingerprint Google Sign-In sees for the Play-installed app differs from the one on your debug or upload build. Register the app signing key’s SHA-1 (and SHA-256) in Firebase, download a fresh google-services.json, rebuild and upload. The rest of this guide shows how to recognise the error in each plugin version, where each of the three fingerprints lives, and how to test the fix before users hit it.

What the error looks like

Plugin version	Typical error	Meaning
google_sign_in 6.x and older	`PlatformException(sign_in_failed, com.google.android.gms.common.api.ApiException: 10: , null)`	Status code 10 is `DEVELOPER_ERROR`: “The application is misconfigured.”
google_sign_in 7.x (Credential Manager)	`GoogleSignInException` with `clientConfigurationError`, or an unexpected `canceled` after picking an account	The plugin docs list “missing or incorrect signing SHA for one or more build configurations” as a common cause

The giveaway in both cases is the pattern the google_sign_in_android documentation calls out: sign-in working in one build configuration but not another. A typical report on Stack Overflow (question 74761490) reads exactly like this: fine with flutter run --release on the developer’s phone, broken in the version downloaded from Play.

Two columns contrasting Flutter builds where Google Sign-In works, signed with the debug or upload key, with the Play-installed build re-signed by Google whose SHA-1 is not registered — Why the Play build fails.

The 3 signing certificates, and which one each build uses

Certificate	Signs	Where to read the SHA-1	Register it?
Debug	`flutter run` builds	`./gradlew signingReport`, or keytool on `~/.android/debug.keystore` (password `android`)	Yes, for local testing
Upload key	Your release build and the AAB you upload	keytool on your upload keystore, or Play Console	Yes, for sideloaded release builds
App signing key	Every install from Google Play, including testing tracks	Play Console: Release, Setup, App integrity (app signing)	Yes: this is the one usually missing

Google’s client authentication guide warns that with Play App Signing “the upload key certificate will be different than the app signing key certificate”, and the Android Studio signing docs say both fingerprints can be copied from the Play Console app signing page. If you ever reset a lost upload key, its fingerprint changes too; our walkthrough on resetting a lost Flutter upload key in Play Console lists every service to update afterwards.

Grid of the three signing certificates to register for Google Sign-In: debug from signingReport, upload from keytool, app signing from Play Console, plus SHA-256, a fresh config file and a rebuild — Three certificates to register.

The fix in 6 steps

Read the debug fingerprint. From your Flutter project run cd android && ./gradlew signingReport and copy the SHA1 line for the debug variant.
Read the upload fingerprint. Run keytool -list -v -alias upload -keystore ~/upload-keystore.jks with your own alias and path, and copy the SHA1 and SHA-256 values.
Copy the app signing fingerprint. In Play Console open your app, then Release, Setup, App integrity, and copy the SHA-1 and SHA-256 of the app signing key certificate.
Add all of them in Firebase. Project settings, General, your Android app, Add fingerprint. Firebase creates the Android OAuth client for each one. If you use Google Cloud directly without Firebase, create an Android OAuth client with the package name and the app signing SHA-1, as Google’s authorization guide describes.
Replace google-services.json. Download it again into android/app/. For google_sign_in 7.x, check that it contains an oauth_client entry with "client_type": 3 (the web client), otherwise you get a “serverClientId must be provided on Android” error.
Rebuild and ship. Run flutter clean, build a new AAB with a higher version code and upload it. Fingerprint changes do not reach a build that is already published.

Six-step grid for fixing Google Sign-In in a Play release: read debug, upload and Play app signing SHA-1, add fingerprints in Firebase, check the config file's web client, rebuild and ship — The fix in six steps.

Test it the way users install it

A release build on your own phone is signed with your upload key, so it proves nothing about the Play-installed app. Push the new AAB to the internal testing track, install it from the Play Store link on a test device, and sign in there. If you are still in pre-launch, the same check fits into the closed testing run with 12 testers for 14 days that new personal accounts need before production.

Install source	Signed with	Proves the fix?
`flutter run`	Debug key	No
`flutter run --release` or a local APK	Upload key	No
Internal, closed or open testing track	App signing key	Yes

Other features that break for the same reason

The app signing certificate is the identity Google services trust for the published app, so anything registered with a fingerprint needs the Play one:

Android App Links. assetlinks.json must list the app signing key’s SHA-256, or verified links open in the browser; see our App Links and Universal Links migration notes.
Firebase App Check with Play Integrity. Firebase asks for the SHA-256 fingerprint of your app’s signing certificate when you register the app; our guide to App Check across staging and production covers enforcement without locking yourself out.
Google APIs keyed to Android apps. Any API key restricted to “Android apps” matches on package name plus SHA-1.

Four features keyed to the Play app signing certificate: Android App Links, Firebase App Check with Play Integrity, Android-restricted API keys and Google Sign-In OAuth clients — Other features that need the Play certificate.

A quick worked example

Illustrative values. Your signing report shows debug SHA-1 A7:89…AB:18 and your keystore shows upload SHA-1 3F:12…9C:04. Both are in Firebase and sign-in works from Android Studio. Play Console’s app signing page shows a third value, 5B:C0…71:E2, that is not in Firebase. That is the missing one: add it, re-download the config file, ship version code 43 to internal testing, install from Play, and sign-in succeeds.

We keep this checklist next to every Flutter release of the apps listed on the GSPTeck apps and projects homepage.

Vertical Pinterest graphic explaining how to fix Google Sign-In failing in a Flutter app installed from Google Play — Pinterest pin: Google Sign-In and Play App Signing.

FAQ

What does ApiException 10 mean in Google Sign-In?

It is DEVELOPER_ERROR, which Google’s reference describes as “The application is misconfigured.” In Flutter apps it almost always means the package name and signing SHA-1 of the installed build do not match a registered Android OAuth client.

Where do I find the SHA-1 for Play App Signing?

In Play Console, open the app and go to Release, Setup, App integrity. The app signing key certificate section lists its MD5, SHA-1 and SHA-256 fingerprints, next to the upload key certificate.

Do I need to add both SHA-1 and SHA-256 to Firebase?

Google Sign-In needs the SHA-1. Adding the SHA-256 as well costs nothing and is needed by other features such as App Check with Play Integrity and App Links, so add both for each certificate.

Why does sign-in still fail after adding the fingerprint?

The usual reason is an old google-services.json in the build or a published build that predates the change. Download the file again, check for the web client entry, rebuild with a new version code and test from a Play testing track.

Sources

Google Play services: client authentication and SHA-1 fingerprints (checked 2026-10-20)
Android Developers: sign your app and Play App Signing (checked 2026-10-20)
google_sign_in_android on pub.dev: integration and troubleshooting (checked 2026-10-20)
CommonStatusCodes reference: DEVELOPER_ERROR = 10 (checked 2026-10-20)
Android Developers: authorize access to Google user data (OAuth clients) (checked 2026-10-20)
Firebase: App Check with Play Integrity on Android (checked 2026-10-20)
Stack Overflow: Flutter Google Sign-In doesn’t work after publishing to Play Store (checked 2026-10-20)