签名APK生成后Firebase Authentication（谷歌登录）无法正常工作

Hey there! Let's figure out why your Firebase Google Sign-In works perfectly in debug mode but breaks on the signed APK—this is one of the most common pitfalls with Firebase Auth, and it almost always ties back to certificate fingerprint misconfiguration or build setup issues.

1. Missing SHA-1/SHA-256 Fingerprints for Your Signed APK in Firebase #

Debug and release builds use different signing keys, so Firebase only allows authentication from apps whose certificate fingerprints are registered in the console. Here's how to fix it:

• Locate the keystore file (.jks or .keystore) you use to sign your release APK.
• Run this command in your terminal to generate the required fingerprints:

  keytool -list -v -alias <your-key-alias> -keystore <full-path-to-your-keystore-file>
  

  Replace <your-key-alias> and <full-path-to-your-keystore-file> with your actual values. You'll get both SHA-1 and SHA-256 strings.
• Head to your Firebase Console → Project Settings → Your Android App → Click Add fingerprint and paste both SHA-1 and SHA-256 values.
• Re-download the google-services.json file and replace the old one in your project's app/ directory. Rebuild your signed APK after this.

2. Incorrect Signing Configuration in build.gradle #

Sometimes, your release build isn't using the correct signing key you intended—this can happen if the signingConfigs block in your module-level build.gradle isn't set up right.

• Open your app/build.gradle file and check these sections:

  signingConfigs {
      release {
          storeFile file("path/to/your/keystore.jks")
          storePassword "your-store-password"
          keyAlias "your-key-alias"
          keyPassword "your-key-password"
      }
  }
  
  buildTypes {
      release {
          signingConfig signingConfigs.release
          // Other release configurations (minifyEnabled, etc.)
      }
  }
  

  Make sure the release build type is explicitly linked to signingConfigs.release—if this is missing, your build might be using a default debug key instead.

3. OAuth 2.0 Client ID Mismatch in Google Cloud Console #

Firebase syncs your app's fingerprint to Google Cloud Console automatically, but sometimes the corresponding OAuth client ID for your release build might be missing or have the wrong fingerprint.

• Go to Google Cloud Console → APIs & Services → Credentials.
• Look for the Android OAuth 2.0 Client ID that matches your release app. Check if its SHA-1 fingerprint matches the one from your signing keystore.
• If it's incorrect or missing, re-adding the fingerprint in Firebase Console (step 1) will automatically create/update this client ID for you.

4. ProGuard/R8 Obfuscation Breaking Auth Code #

If you have minification enabled for release builds, ProGuard/R8 might strip away critical Firebase Auth or Google Sign-In classes, causing the feature to fail silently.

• Add these rules to your proguard-rules.pro file to protect the necessary classes:

  # Firebase Authentication
  -keep class com.google.firebase.auth.** { *; }
  -keep class com.google.firebase.auth.internal.** { *; }
  # Google Sign-In
  -keep class com.google.android.gms.auth.api.signin.** { *; }
  -keep class com.google.android.gms.common.api.** { *; }
  

  Rebuild your signed APK after updating the rules.

内容的提问来源于stack exchange，提问作者Farhan Saikh