在.NET MAUI中集成Firebase Google认证报错求助：INVALID_IDP_RESPONSE

问题概述 #

按以下步骤集成Firebase Google认证后调用SignInWithCredentialAsync抛出400错误：

• Visual Studio创建MAUI项目，Firebase控制台添加debug keystore的SHA-1（命令：keytool -list -v -keystore C:\Users\user\.android\debug.keystore -alias androiddebugkey -storepass android -keypass android）
• Firebase控制台启用Google认证，将google-services.json放入MAUI项目Platforms->Android目录
• 安装FirebaseAuthentication.net NuGet包

错误信息：

Firebase.Auth.FirebaseAuthHttpException: "Exception occured during Firebase Http request. Url: https://www.googleapis.com/identitytoolkit/v3/relyingparty/verifyAssertion?key=myapikey Request Data: {"requestUri":"https://projectname-7fec3.firebaseapp.com","postBody":"access_token=mytoken","returnIdpCredential":true,"returnSecureToken":true} Response: { "error": { "code": 400, "message": "INVALID_IDP_RESPONSE : Unsuccessful check authorization response from Google: {\n "error_description": "Invalid Value"\n}\n", "errors": [ { "message": "INVALID_IDP_RESPONSE : Unsuccessful check authorization response from Google: {\n "error_description": "Invalid Value"\n}\n", "domain": "global", "reason": "invalid" } ] } }

核心错误原因 #

代码中错误地将Firebase控制台里Google认证的Web Client ID（或Client Secret）传入GoogleProvider.GetCredential()，但该方法需要的是用户通过Google OAuth登录后生成的有效Access Token，而非客户端ID/密钥。

修正方案 #

1. 先完成Google OAuth登录获取Access Token #

在.NET MAUI中需先引导用户完成Google OAuth授权流程，拿到真实的Access Token。示例代码（基于Xamarin.Auth）：

var authenticator = new OAuth2Authenticator(
    clientId: "你的Google Web Client ID", // 此处用Firebase控制台的Web Client ID
    scope: "email",
    authorizeUrl: new Uri("https://accounts.google.com/o/oauth2/v2/auth"),
    redirectUrl: new Uri("com.googleusercontent.apps.xxxx:/oauth2redirect")); // 需与Firebase控制台配置一致

authenticator.Completed += async (sender, e) =>
{
    if (e.IsAuthenticated)
    {
        string validAccessToken = e.Account.Properties["access_token"];
        await SignInWithFirebase(validAccessToken);
    }
};

// 启动Google登录界面
await AuthenticatorUI.PresentAuthenticator(authenticator);

2. 修正Firebase认证调用代码 #

将获取到的有效Access Token传入认证方法：

private async Task SignInWithFirebase(string accessToken)
{
    var config = new FirebaseAuthConfig
    {
        ApiKey = "你的Firebase Web API Key",
        AuthDomain = "你的Firebase授权域",
        Providers = new FirebaseAuthProvider[]
        {
             new GoogleProvider().AddScopes("email"),
             new EmailProvider()
        },
        UserRepository = new FileUserRepository("FirebaseSample")                                                                         
    };
    var client = new FirebaseAuthClient(config);

    var credential = GoogleProvider.GetCredential(accessToken);
    var userCredential = await client.SignInWithCredentialAsync(credential);
}

额外排查点 #

• 重新验证SHA-1值：确保Firebase控制台添加的SHA-1与debug keystore输出完全一致，注意区分大小写
• 检查google-services.json属性：右键文件→属性→生成操作需设置为AndroidResource
• 核对授权域：代码中AuthDomain需与Firebase控制台「认证→授权域」的域名完全一致，无拼写错误

内容的提问来源于stack exchange，提问作者Aleksandr