How can I use the same SHA1 for an app that has different package-name, as another one?

Question

Background

I work on 2 different apps with common shared code, both used on the same project (using productFlavors in gradle file), but with different package names.

The problem

The apps are supposed to be able to login to Google account and fetch some information from it.

The first one works fine, but the second has issues logging-in, especially on release-variant.

Both are already published on the Play Store and have Firebase being used, so I can't perform operations that might damage how the apps work.

What I've found

I made the app write to logs to show the issue:

    override fun onActivityResult(requestCode: Int, resultCode: Int, data: Intent?) {
        val result = Auth.GoogleSignInApi.getSignInResultFromIntent(data)
        if (result?.isSuccess == true) {
          ...
        }
        else {
          Log.e("AppLog", "onActivityResult failure:${result?.status}")
        }

And indeed this is what I got:

onActivityResult failure:Status{statusCode=DEVELOPER_ERROR, resolution=null}

Searching the Internet and here on StackOverflow, it showed that I need to add the SHA-1 to the project, of both release and debug:

https://console.firebase.google.com/u/0/project/.../settings/general/...

Adding the SHA-1 of debug-variant works fine (though for some reason during login it had multiple steps instead of just one or two), but when I try to add the SHA-1 of release-variant, it seems identical to the SHA-1 of the other app (which has a different package). It shows me this message (via "project settings"->"general"):

An OAuth2 client already exists for this package name and SHA-1 in another project. You can omit the SHA-1 for now and read more about this situation and how to resolve it.

So I followed the link, and I tried to do as was written there:

First, find your existing project's OAuth 2.0 client ID. To do this:

1. Go to the Credentials page of the Google Cloud console. If the project containing the OAuth 2.0 client ID doesn't open automatically, select it from the drop down menu in the upper right corner of the page.
2. Under the OAuth 2.0 client IDs section, locate the client name containing the SHA-1 and package name you used for your Firebase project. If you're unsure which one is correct, click the name of the client to see the details.
3. When you have located the correct client name, copy the full value in the Client ID column.

Next, whitelist this client ID for Google as a sign in provider. To do this:

1. Go to the Firebase console and select your project.
2. Select Auth from the menu on the left.
3. Select the Sign in method tab.
4. On the Sign in method page, click on Google in the Sign in providers card.
5. Expand the Whitelist client IDs from external projects option.
6. Paste your client ID from the Cloud console into the text field and click Add.

So I pasted each of them (from "https://console.developers.google.com/apis/credentials?project=..." into "https://console.firebase.google.com/u/0/project/.../authentication/providers" ) that I thought that should be there, and as it didn't work, I pasted even more, including of both apps.

Still didn't work.

I also tried to add SHA-256 instead, and even though it allowed me to do it, it didn't help either.

I tried to search for solutions on StackOverflow and on other places, but the questions don't seem to be related to the exact scenario I have, as here it's 2 different package names already (so there shouldn't be a problem), and the apps are already published (so I can't remove stuff from the websites).

The questions

The most important question is the first one. The rest are optional and only so that I could learn what's wrong and what's going on. I would really appreciate it to understand for next time how to handle it properly:

1. How can I solve it for the second app, without causing any issue to either apps? I don't want to remove the account/project on the website of any of those apps.

2. How come I can't add SHA-1 of an app of a different package name?

3. It said to copy the "client ID" on the instructions, but it didn't say of which app. I guess it means of the app that works fine, right?

4. Some solutions said that I could re-create the SHA-1 to have a new key, but I couldn't find how. How do I do this? Would it help? Wouldn't it affect the app that works fine, and I will have the same issue of same SHA-1 being used for both, again?

Answer 1

This is a little late...I guess this has been solved for you but for others who might need a solution...

All your steps described above are correct. You missed one last step. Take the Oauth Client id that you copied from the google console (and whitelisted in Firebase Sign In) and add it to the google-services.json file you downloaded from Firebase. This last step is very important!! In the json file, find the oauth section...

"oauth_client": [ { "client_id": "PASTE Oauth client ID here", "client_type": 3 } ],

Rebuild app.

Answer 2

Try adding the SHA-1 key to Firebase which you get while uploading the app to Google Play Console. You can get this key while navigating to App signing info at Play Console.

Answer 3

These days it's probably preferred to add SHA-256 instead of SHA-1 key fingerprints.

Play App Signing "might" solve the issue in terms of not adding duplicate release keys, no matter the upload keys. Closely check the documentation, if not the enrollment would mess up the release by changing keys; so far I have not attempted to migrate an already published app to Play App Signing, but if this would not break anything, this might be a suitable way out of the situation.

Another option would be to click "Add App" and then add the other one package-name (in case both flavors would use the same one Firebase project). I have configured this for debug/release builds, which also have different package names (it doesn't really matter how they were build).

In case you have to mess around, publish one more release, which features kind of "maintenance mode", to be switched on/off with Firebase Remote Config, in order to prevent data-changes.

Answer 4

The SHA-1 belongs to the certificate you're using to sign the APK, doesn't belong to any individual app.

The problem seems to be that you have have multiple projects with the same Package+SHA added. Check https://console.firebase.google.com/ here you'll be able to see all the projects under your account.