AppReviewX Log in

Google Sign-In works in debug but fails in the test build

Signing keys differ between debug, upload and Play app signing. How to check which fingerprint you registered.

updated ·2 min read

In this guide

Sign-in works when you run from your IDE and breaks as soon as testers install the build from Google Play. A common cause is that the app is signed with a different key than the one you registered with Google.

Why it happens

An Android app can be signed with several keys over its life:

  • The debug key, created on your machine. Builds you run from the IDE use it.
  • The upload key, which you use to sign the bundle you upload.
  • The key Google Play uses to sign the apps it delivers to devices, when Play app signing is on. Testers receive the app signed with this key, not with your upload key.

Google's help for Android OAuth clients says you specify your app's package name and SHA-1 fingerprint (retrieved 2026-10-24). If you registered only the debug fingerprint, a build signed with another key can fail. Firebase and other setups may ask for more fingerprints; check the current documentation for yours.

Checklist

  1. Note the exact error. Developer errors, "sign in failed" or a cancelled dialog point to different causes. Capture the log from a tester device if you can.
  2. List the fingerprints you registered in your Google Cloud project or Firebase project for this package name.
  3. Find the fingerprint of the key Play uses. Google's app signing page names Release > Setup > App signing as the place where the fingerprints (including SHA-1) of the app signing and upload certificates are shown; menu labels can change.
  4. Compare. Is the app signing key's fingerprint registered? The upload key's? The debug key's?
  5. Register the missing fingerprint, and wait for the change to apply before retesting.
  6. Check the package name. It must match exactly between the build and the registered client.
  7. Retest on a clean install from the test track, not an IDE build.
  • A test build installed through a link or sideloaded file can carry a different signature than the Play-delivered one.
  • Using different Google Cloud projects for debug and release.

Keep a record

Write down once: package name, debug fingerprint, upload fingerprint, Play signing fingerprint, project where they are registered. It turns the next occurrence into a two-minute check.

Get a second opinion on the build

AppReviewX offers private, structured feedback from other developers. One feedback you write earns one credit; new accounts start with 0 credits. Test groups are for Google Play closed tests (12 testers, 14 days in a row), for Android apps.

Start here

More in App testing problems and fixes. Related: In-app products not showing in a test build and Deep links not opening your test build.