SHA-1 & SHA-256 Keys
Firebase needs your Android signing fingerprints for Google sign-in and phone (OTP) sign-in.
A SHA key is the fingerprint of the key that signs your Android app. Firebase needs it for:
| Sign-in | Needs |
|---|---|
| Continue with Google | SHA-1 |
| Phone number (SMS code) | SHA-1 and SHA-256 |
Add them for the customer app and the delivery boy app. The store app signs in with email only; adding keys there does no harm.
Three different keys
| Key | Signs |
|---|---|
| Debug key | flutter run on your computer. Each computer has its own. |
| Upload key | APKs and AABs you build with your own keystore (Android release) |
| Google Play app signing key | The app people install from Google Play. Google re-signs your AAB. |
Add all three to Firebase, or sign-in works in testing but fails from Google Play.
1. Get the fingerprints#
keytool -list -v -keystore "%USERPROFILE%\.android\debug.keystore" -alias androiddebugkey -storepass android -keypass androidkeytool -list -v -keystore ~/.android/debug.keystore -alias androiddebugkey -storepass android -keypass androidkeytool -list -v -keystore upload-keystore.jks -alias uploadPlay Console → your app → Test and release → App integrity → App signing. Copy the SHA-1 and SHA-256 of the App signing key certificate.
Copy the lines that start with SHA1: and SHA256:.
Or let Gradle list them
From the app's android folder run ./gradlew signingReport (gradlew signingReport on Windows). keytool comes with Java; Android Studio has its own copy in its jbr/bin folder.
2. Add them in Firebase#
Open your Android app#
Firebase consoleSettingsGeneral → under Your apps, pick the Android app, for example com.yourbrand.customer.
Add each fingerprint#
Click Add fingerprint, paste a SHA-1, Save. Again for the SHA-256. Repeat for every key above.
Refresh the settings file#
Run flutterfire configure in the app folder again, or download google-services.json and replace android/app/google-services.json. Then rebuild.