[🐛] Phone Auth `auth/app-not-authorized` — "play_integrity_token passed, but no matching SHA-256" on Play-signed build, despite correct SHA registration

[Younes91coding]

Issue

signInWithPhoneNumber fails on the Play-distributed Android build (installed
from Play internal testing) with:

[auth/app-not-authorized] This app is not authorized to use Firebase
Authentication... A play_integrity_token was passed, but no matching SHA-256 was
registered in the Firebase console. Please make sure that this application's
packageName/SHA256 pair is registered in the Firebase Console.

Firebase test phone numbers work (they bypass Play Integrity), so the failure
is isolated to Play Integrity token verification for real numbers.

Environment

• @react-native-firebase/app + /auth 20.5.0
• Expo SDK 51, React Native 0.74, expo-build-properties targetSdk 35
• Managed/EAS build (google-services.json via expo.android.googleServicesFile)
• Android package app.dingdrop.mobile, Play App Signing enabled

Everything verified correct

• App-signing key SHA-256 (from Play Console → App signing) and SHA-1,
  plus the upload key SHA-256/SHA-1, are all registered on the Firebase
  Android app (confirmed in Project settings). App-signing SHA-256 matches Play
  Console exactly.
• google-services.json is current and matches app ID / package / project number
  / api_key.
• Play Integrity API enabled; the Android API key's API restrictions include
  Play Integrity API + Identity Toolkit API.
• Play Console → App integrity → Integrity API Cloud project linked to the
  Firebase project (582947107702).
• Clean, Play-only install (all sideloaded builds uninstalled).
• Several days elapsed (well past SHA propagation).

Question

With all of the above verified, why does the SHA-256 inside the
play_integrity_token not match the registered app-signing SHA-256? Is this a known
Play Integrity ↔ Firebase decryption/propagation issue, and is there a fix or
workaround for real-number phone sign-in on the Play build?

Repro

1. Configure phone auth per docs (SHA-256 + Play Integrity API).
2. Install the Play-signed build from an internal-testing track.
3. Call signInWithPhoneNumber(auth, '+<realNumber>') → the error above.
   (A configured Firebase test number succeeds.)

[mikehardy]

With all of the above verified, why does the SHA-256 inside the play_integrity_token not match the registered app-signing SHA-256?

I don't know, but in 100% of previous cases it has turned out to be some sort of app-specific configuration problem, in 0% of these cases has it resulted in any change to this repository - I don't have any specific information to share but I state that with such certainty to hopefully motivate extra effort in checking local items

[shashi1020]

Same issue here!! please

Failing for play store production version

17028 A play_integrity_token was passed, but no matching SHA-256 was registered in the Firebase console. Please make sure that this application’s packageName/SHA256 pair is registered in the Firebase Console.

Invoking original failure callbacks after reCAPTCHA Enterprise + phone verification failure for +91966##16805, error - This app is not authorized to use Firebase Authentication. Please verify that the correct package name, SHA-1, and SHA-256 are configured in the Firebase Console. [ A play_integrity_token was passed, but no matching SHA-256 was registered in the Firebase console. Please make sure that this application’s packageName/SHA256 pair is registered in the Firebase Console. ]

Despite adding sha keys (from play console, debug, reslease) to firebase and rebuilt app again with new json still firebase OAuth is failing.

as the app is in closed testing i want to fix this issue as early as possible. Please Help 🙏🙏

[mikehardy]

@shashi1020

I stand by this comment:

I don't know, but in 100% of previous cases it has turned out to be some sort of app-specific configuration problem, in 0% of these cases has it resulted in any change to this repository - I don't have any specific information to share but I state that with such certainty to hopefully motivate extra effort in checking local items

...however, you mention reCAPTCHA Enterprise. I wasn't aware that was turned on in the firebase backend yet for mobile. There is a lot of setup required to make that work and last time I tried (#9066) it wasn't ready to go upstream quite yet.

You might try removing that and just doing phone verification by itself to separate concerns / isolate problems

[shashi1020]

Update: phone otp auth issue is resolved. Enable google play integrity api on gcp, recaptcha enterprise api (firebase as well as gcp).

But however Google sign-in remains the same : Failure

Logs
### 2026-08-15 12:02:31.224 18607-18647 SessionLifecycleClient com.enterprise.akashdrones D Sending lifecycle 1 to service
2026-08-15 12:02:31.226 18607-18753 SessionLifecycleService com.enterprise.akashdrones D Activity foregrounding at 23334608.
2026-08-15 12:02:31.226 18607-18655 Surface com.enterprise.akashdrones D Surface::disconnect
2026-08-15 12:02:31.226 18607-18655 BufferQueueProducer com.enterprise.akashdrones D com.enterprise.akashdrones/com.google.android.gms.auth.api.signin.internal.SignInHubActivity#13559(BLAST Consumer)pid:18607 disconnect: api 1
2026-08-15 12:02:31.233 18607-18607 WindowOnBackDispatcher com.enterprise.akashdrones W sendCancelIfRunning: isInProgress=false callback=android.app.Activity$$ExternalSyntheticLambda0@a6d4de2
2026-08-15 12:02:31.234 18607-18607 ViewRootImpl com.enterprise.akashdrones D Skipping stats log for color mode
2026-08-15 12:02:31.251 18607-18607 InsetsController com.enterprise.akashdrones D hide(ime(), fromIme=false)
2026-08-15 12:02:31.251 18607-18607 ImeTracker com.enterprise.akashdrones I com.enterprise.akashdrones:cdc34433: onCancelled at PHASE_CLIENT_ALREADY_HIDDEN

[mikehardy]

feel free to log findings here however this statement is still my position as far as maintenance goes, since there is no capability to help people with individual projects, and this doesn't seem to be a general issue

I don't know, but in 100% of previous cases it has turned out to be some sort of app-specific configuration problem, in 0% of these cases has it resulted in any change to this repository - I don't have any specific information to share but I state that with such certainty to hopefully motivate extra effort in checking local items

[github-actions]

Hello 👋, to help manage issues we automatically close stale issues.

This issue has been automatically marked as stale because it has not had activity for quite some time.

Has this issue been fixed, or does it still require attention?

This issue will be closed in 15 days if no further activity occurs.

Thank you for your contributions.