Firebase Phone Auth fails with "no matching SHA-256 registered" despite correct SHA-256 registered in Firebase Console (Play App Signing key)

I'm getting a persistent Firebase Phone Authentication failure on real phone numbers (test numbers work fine) for a React Native + Expo Android app.

Error from Logcat:

> [SmsRetrieverHelper] SMS verification code request failed: unknown status code: 17028 > > A play_integrity_token was passed, but no matching SHA-256 was registered in the > Firebase console. Please make sure that this application's packageName/SHA256 pair is registered in the Firebase Console. > > Invoking original failure callbacks after phone verification failure for +91XXXXXXXXXX, > > error - This app is not authorized to use Firebase Authentication. Please verify that the correct package name, SHA-1, and SHA-256 are configured in the Firebase Console.

What I've already verified/tried (all confirmed correct):

  1. Blaze plan is active on the correct Firebase project (verified project ID and project number match everywhere — Firebase Console, Google Cloud Console, and Play Console's Play Integrity API project link).

  2. The app is distributed via Google Play Internal/Closed Testing, so it's signed with **Play App Signing**. I retrieved the SHA-1 and SHA-256 from Play Console > Setup > App integrity > App signing key certificate > **Classical key** (not the Upload key, not Post-quantum), and added both to Firebase Console > Project Settings > Your apps > Android app > SHA certificate fingerprints.

  3. Manually character-by-character compared the SHA-256 shown in Play Console against the one registered in Firebase — they match exactly.

  4. Confirmed these APIs are enabled in Google Cloud Console: Identity Toolkit API, Play Integrity API, reCAPTCHA Enterprise API.

  5. Firebase App Check is set to "Unenforced" for Authentication (ruled out as the cause).

  6. Tried adding an Android application restriction (package name + SHA-1) to the Android API key in Google Cloud Console > Credentials — this caused a *different* error ("Requests from this Android client application are blocked. 403"), so I reverted it back to "None".

  7. Waited well over 24 hours after each change for propagation — the error persists.

  8. There are currently 4 SHA-1 and 3 SHA-256 entries registered in Firebase (from earlier troubleshooting attempts) — planning to clean these up to just the one verified-correct pair, but haven't yet confirmed if that's the actual cause.

Setup:

  • React Native + Expo (SDK 57), built with EAS Build, distributed via Google Play Closed Testing

  • @react-native-firebase/auth for Phone Authentication

  • Package name: com.rajselfdrive.app

What else could cause Firebase to not recognize a correctly-registered SHA-256 fingerprint when using Play App Signing? Is there a known propagation issue, a caching issue on the Play Integrity backend, or something else I might be missing (e.g., a separate OAuth client SHA-1 config vs. the Firebase Authentication SHA config)?

0
Aug 18 at 3:58 AM
User AvatarSunil kumar
#android#firebase#firebase-authentication#google-play-console#google-play-integrity-api

Accepted Answer

The missing piece is likely Google Play’s post-quantum app signing key.

In Play Console, under App integrity → App signing key certificate, there can now be two keys:

  • Classical key

  • Post-quantum key

You said you added the SHA-1/SHA-256 from the Classical key, but not from the Post-quantum key.

For some Play-distributed installs, the Play Integrity token sent to Firebase will contain the SHA-256 of the post-quantum certificate, not the classical one. Firebase then looks for that SHA-256 in the Firebase console, doesn’t find it, and returns:

text

A play_integrity_token was passed, but no matching SHA-256 was registered

This matches your situation exactly.

Fix

  1. Go to Play Console → your app → Setup → App integrity → App signing key certificate.

  2. Look for Classical key and Post-quantum key sections.

  3. For both sections, copy:

    • SHA-1 certificate fingerprint

    • SHA-256 certificate fingerprint

  4. In Firebase Console → Project settings → Your apps → your Android app → SHA certificate fingerprints, add all of those fingerprints.

  5. Remove old/duplicate SHA entries to avoid confusion, leaving at least:

    • Classical app signing key SHA-1/SHA-256

    • Post-quantum app signing key SHA-1/SHA-256

  6. Rebuild/reinstall from Play or re-download the closed-test build, wait a few minutes, and test phone auth again.

If it still fails

Then the installed app’s actual signing certificate is not what Firebase has. Verify the real runtime SHA-256 from the installed Play build.

For example, with a connected device:

bash

adb shell dumpsys package com.rajselfdrive.app | grep -A 20 signatures

Or, if you can extract the APK from the device:

bash

apksigner verify --print-certs app.apk

The SHA-256 shown there must exist in Firebase Console for com.rajselfdrive.app.

Also double-check that the built app is actually using the Firebase project where you added the SHAs. The quickest check is to inspect the generated google-services.json inside the build, not just the console. Look at:

  • project_id

  • mobilesdk_app_id

  • package_name

They must match the Firebase project and the Android app package where the SHA fingerprints are registered.

But in most cases like this with Play App Signing, adding the post-quantum app signing key SHA-256/SHA-1 resolves the 17028 error.

User AvatarUSAMA KHAN Web App Developer S
Aug 19 at 11:59 AM
0