I'm developing a Flutter Android app and I'm facing an issue with Google Sign-In.

Problem:

Google Sign-In works perfectly when I build and install the release APK locally:

flutter build apk --release

However, when I build an AAB and install the app through Google Play Internal Testing, Google Sign-In fails with:

GoogleSignInExceptionCode.canceled
[16] Account reauth failed

The same Flutter code and Firebase project are used in both cases.

Environment

Flutter
google_sign_in: 7.2.0
google_sign_in_android: 7.2.13
Firebase Authentication
Android

I also tried:

flutter pub upgrade google_sign_in

but the dependency remained:

google_sign_in 7.2.0
google_sign_in_android 7.2.13

SHA-1 configuration

My upload keystore SHA-1 is:

5B:FA:B6:B5:82:4F:20:54:0B:**********************

The Google Play App Signing SHA-1 is:

94:EA:3E:25:1F:7F:37:77:*************************

Both SHA-1 fingerprints have been added to the Firebase Android app for:

com.app.app

Firebase also has Android OAuth clients corresponding to both certificates.

My google-services.json contains both Android OAuth clients:

{
  "package_name": "com.app.app",
  "certificate_hash": "5bfab6b5824f20540*************78"
}

and:

{
  "package_name": "com.app.app",
  "certificate_hash": "94ea3e251f************4548141"
}

Signing verification

My AAB is signed with the upload certificate locally:

SHA1:
5B:FA:B6:B5:82:4F:20:54:0B:78:*******************

Google Play should then re-sign the distributed app with the Play App Signing certificate.

Google Sign-In configuration

I'm using the Firebase-generated Web OAuth client as the server client ID:

12796219*******-*******eufniblmapam76drbsh12.apps.googleusercontent.com

The important observation is:

Local release APK → Google Sign-In works

Google Play Internal Testing → Google Sign-In fails

GoogleSignInExceptionCode.canceled
[16] Account reauth failed

I have already verified the package name, Firebase configuration, upload SHA-1, and Play App Signing SHA-1.

What could cause Google Sign-In to work in a locally installed release APK but fail only when the same AAB is distributed through Google Play Internal Testing?

Is there another Google Cloud OAuth / Play App Signing configuration that I need to check?

Any guidance on how to identify exactly which certificate/OAuth client Google Sign-In is using in the Play-distributed build would be appreciated.