Google Sign-In fails only in Google Play version (ApiException: 10), but Release APK works

[mohamadnoorir63-svg]

Title
Google Sign-In fails only in Google Play distributed app (ApiException: 10), but Release APK works perfectly
Body
Hello,
I have been trying to solve this issue for several days without success.
Environment
Flutter 3.32.2
firebase_core 3.15.2
firebase_auth 5.7.0
google_sign_in 6.3.0
google_sign_in_android 6.2.1
Package name:
com.heratnoor.afghanmarket
Firebase project:
afghanbazar-a5ac4
The problem
Google Sign-In works perfectly when I install a locally built Release APK.
I build it using:
flutter clean
flutter pub get
flutter build apk --release
After installing the APK manually, Google Sign-In works correctly.
However, when I build an App Bundle:
flutter clean
flutter pub get
flutter build appbundle --release
upload it to Google Play, publish it, then install the application from Google Play, Google Sign-In always fails with:
PlatformException(sign_in_failed,
com.google.android.gms.common.api.ApiException: 10)
The Google account picker appears normally.
After selecting an account, sign-in immediately fails.
What has already been verified
Firebase Authentication (Google provider) is enabled.
Package name is correct.
OAuth clients exist.
google-services.json is correct.
AndroidManifest.xml checked.
Gradle configuration checked.
Release signing configuration checked.
AAB SHA-1 verified.
Upload keystore verified.
SHA fingerprints verified.
APK and AAB are built from exactly the same source code.
Testing
The issue has been tested on three different Android devices.
Results:
✅ Release APK works on all devices.
❌ Google Play installed version fails on all devices.
At this point I cannot identify any configuration difference between the APK and the Play-distributed version.
Has anyone experienced a case where Google Sign-In only fails in the Google Play version with ApiException: 10, while the Release APK works correctly?
Any guidance would be greatly appreciated.
Thank you.

[rakeshutekar]

This is Play App Signing, and it's the one thing your checklist doesn't quite cover. ApiException: 10 is DEVELOPER_ERROR, which for Google Sign-In almost always means "the SHA-1 that reached Google doesn't match any certificate registered in Firebase for this package."

The reason it works from the local APK but not from Play:

• Your release/upload keystore signs the APK you install manually. That SHA-1 is in Firebase, so local sign-in works.
• When you upload an AAB, Google Play re-signs the installed app with the Play App Signing key — a different key that Google holds. Apps installed from Play are signed with that key, not your upload key. Its SHA-1 is not in Firebase yet, so Google rejects the sign-in with error 10.

You verified "AAB SHA-1" and "upload keystore" — but those are the upload key. The one that matters for Play-distributed installs is the App signing key, which is a separate fingerprint.

Fix:

1. Google Play Console → your app → Test and release → App integrity (older UI: Setup → App signing).
2. Under App signing key certificate, copy both the SHA-1 and SHA-256 fingerprints. This is Google's signing key, distinct from the upload key shown just below it.
3. Firebase Console → Project settings → your Android app → Add fingerprint, paste the SHA-1 (add the SHA-256 too — it's required for newer Google Identity flows).
4. Download the refreshed google-services.json, drop it back into android/app/, and rebuild.

You usually don't even need a new release — adding the fingerprint in Firebase is a server-side change that takes effect within a few minutes.

Quick way to confirm this is the cause before you change anything: the App signing key SHA-1 in Play Console will not be present in your current google-services.json. If you grep certificate_hash android/app/google-services.json (values are lowercase, no colons) you'll see your upload key's hash there but not the Play signing key's — that gap is the bug.

One caveat: Firebase's google-services.json only carries SHA-1 hashes into the OAuth client config, and Google Identity Services on newer devices increasingly wants the SHA-256 as well, so register both to avoid a second round of this.