Firebase App Check (Play Integrity) failing with 100% "Unverified: invalid requests" on Play Store Internal Testing build (Token generation succeeds)
I am implementing Firebase App Check using the Play Integrity provider in my Android app. The implementation works perfectly in my local debug environment, but fails completely when deployed through Google Play.
The Environment:
App is built as a signed Release .aab in Android Studio.
Uploaded to Google Play Console and distributed via the Internal Testing track.
Downloaded to a physical device via the official Play Store tester link.
The Problem:
When monitoring the Firebase App Check dashboard, the Release build generates 100% "Unverified: invalid requests". It completely fails to connect to Firebase services.
However, when I test the app locally in Android Studio using the DebugAppCheckProviderFactory, it works flawlessly and requests are 100% verified.
Furthermore, checking the logcat for the failing Release build shows that PlayCore is successfully requesting and receiving the integrity token from Google Play without any errors:
PlayCore : UID: \[10143\] PID: \[22027\] IntegrityService : requestIntegrityToken(IntegrityTokenRequest{...}) PlayCore : UID: \[10143\] PID: \[22027\] IntegrityService : ServiceConnectionImpl.onServiceConnected(ComponentInfo{com.android.vending/com.google.android.finsky.integrityservice.IntegrityService}) PlayCore : UID: \[10143\] PID: \[22027\] OnRequestIntegrityTokenCallback : onRequestIntegrityTok
What I have already tried:
-
Copied the Upload Key SHA-256 fingerprint into Firebase (Project Settings & App Check menu).
-
Copied the Google Play App Signing Key SHA-256 fingerprint from the Play Console into Firebase.
-
Completely uninstalled the app, cleared storage, and reinstalled fresh from the Play Store internal tester link.
-
Verified that the Google Play Console is officially linked to my Firebase project.
Since the token generation is clearly succeeding on the device (per the logcat), but Firebase is rejecting the token as invalid, what could be causing this disconnect? Is there a delay in SHA-256 propagation, or a specific configuration required for the Internal Testing track that differs from Production?
