Android: Concept behind KeyHash of Facebook SDK?

Question

I am using FacebookSDK and following all steps to generate a new keyhash, keyhash generated using debug keystore is working like a charm but keyhash generated using our own couple of keystores is not working, then I tried the function given in troubleshooting but it's still not working. I have tried using the following code in onCreate

// Add code to print out the key hash
        try {
            System.out.println("Inside try for keyhash");
            PackageInfo info = getPackageManager().getPackageInfo(
                    "com.myapp.facebookint", 
                    PackageManager.GET_SIGNATURES);
            for (Signature signature : info.signatures) {
                MessageDigest md = MessageDigest.getInstance("SHA");
                md.update(signature.toByteArray());
                Log.d("KeyHash:", Base64.encodeToString(md.digest(), Base64.DEFAULT));
                System.out.println("KeyHash:"+Base64.encodeToString(md.digest(), Base64.DEFAULT));
                }
        } catch (NameNotFoundException e) {
            System.out.println("keyhash name not found");
        } catch (NoSuchAlgorithmException e) {
            System.out.println("keyhash algo not found");
        }

It gave me a keyhash, which I inserted in Facebook App settings, no resolution! Now I am wondering about the concept of using keyhash, how facebook identifies it? and what will happen if I just upload the app using debug keyhash?

My impression was that facebook matches the keyhash with signatures of of app itself and if both are signed with same keystore then it allows the app to authenticate but it doesn't seem to be the case. As I exported the app like I would prepare it for release, downloaded the apk into the phone through file explorer and tried installing and running from there, it was same as it would do in debug mode.

Can any one please shed some light on this.

score 0 · Answer 1 · edited May 23 '17 at 11:49

Yes, that is indeed the case. The facebook knows your app signatures and verifies it to know if the app trying to authenticate is the right one. I guess something in my System.out.println was wrong, I used the following code from https://stackoverflow.com/a/9600642/243354

You can insert this code, export the apk as you will sign it for release, then load that apk to the emulator and check the logcat for hash key tag, once found, update to facebook settings.

Android: Concept behind KeyHash of Facebook SDK?

1 Answers1