How to Fix Android Google Sign-In “DEVELOPER_ERROR”

DEVELOPER_ERROR

Status{statusCode=DEVELOPER_ERROR, resolution=null}

ApiException: 10

What Does DEVELOPER_ERROR Mean?

Google Play services defines:

DEVELOPER_ERROR = 10

The application is misconfigured.

The official API reference describes it as a developer-side configuration error rather than a normal user-recoverable sign-in failure. :contentReference[oaicite:18]{index=18}

Common configuration areas include:

• Android application ID / package name
• Debug SHA-1 fingerprint
• Release SHA-1 fingerprint
• Google Play App Signing SHA-1
• Firebase Android app registration
• Android OAuth 2.0 client ID
• Web / server OAuth client ID
• google-services.json

Common Situations

• Google Sign-In was just added
• Google authentication was added through Firebase Authentication
• Debug works but Release fails
• A locally installed build works but the Google Play version fails
• The release keystore was changed
• Google Play App Signing was enabled
• The application ID was changed
• Product flavors were added
• The Firebase project was changed
• An OAuth client was deleted or recreated
• The wrong client ID is passed to requestIdToken()

Cause 1: The SHA-1 Fingerprint Is Not Registered

Android OAuth configuration identifies an Android client using its package and signing certificate information.

Different signing keys produce different SHA-1 fingerprints:

Debug keystore → SHA-1 A

Release keystore
→ SHA-1 B

Google Play App Signing key
→ SHA-1 C

If only the Debug certificate is configured, a Release or Google Play build can fail with DEVELOPER_ERROR.

Solution 1: Run signingReport

macOS or Linux:

./gradlew signingReport

Windows:

gradlew.bat signingReport

Example output:

Variant: debug Config: debug Store: ... Alias: AndroidDebugKey SHA1: AA:BB:CC:DD:... SHA-256: ...

Use the fingerprint for the exact variant that is failing.

Cause 2: Debug and Release SHA-1 Fingerprints Are Different

An Android Studio Debug build and a signed Release APK/AAB are normally signed with different certificates.

If Firebase only contains your Debug SHA-1, a Release build can fail.

Solution 2: Register Every Signing Certificate You Actually Use

With Firebase:

Firebase Console → Project settings → General → Your apps → Android app → SHA certificate fingerprints

Check:

Debug SHA-1 Release SHA-1 Google Play App Signing SHA-1

Cause 3: Google Play App Signing SHA-1 Is Missing

With Google Play App Signing, the APK distributed to users can be signed with Google’s App Signing key instead of the local Upload key.

This explains a common pattern:

Local build → Google Sign-In works

Google Play build
→ DEVELOPER_ERROR

Solution 3: Register the Google Play App Signing Fingerprint

Open Google Play Console and locate the App Signing certificate for the application.

Add that SHA-1 fingerprint to the corresponding Firebase / Google OAuth Android configuration.

Cause 4: The Package Name Does Not Match the OAuth Client

Android:

android { defaultConfig { applicationId = "com.example.myapp" } }

OAuth configuration:

com.example.oldapp

This is a different application identity.

Solution 4: Check the Final applicationId

Do not look only at namespace.

namespace = "com.example.code"

defaultConfig {
applicationId =
"com.example.production"
}

The OAuth Android package normally needs to correspond to:

com.example.production

Cause 5: applicationIdSuffix Changes the Debug Package

android { buildTypes { debug { applicationIdSuffix = ".debug" } } }

This produces:

Release: com.example.app

Debug:
com.example.app.debug

Solution 5: Register the Debug Application

If Debug is intentionally a separate Firebase Android app, register:

com.example.app.debug

and add the Debug signing certificate SHA-1.

Cause 6: Google Sign-In Is Not Enabled in Firebase Authentication

When using Firebase Authentication, the Google provider must be enabled.

Solution 6: Check the Google Provider

Firebase Console → Authentication → Sign-in method → Google

Firebase’s current authentication troubleshooting guide also recommends disabling and saving the Google provider, then enabling and saving it again in certain Google sign-in configuration problems. :contentReference[oaicite:19]{index=19}

Cause 7: google-services.json Is Outdated

After modifying certificates or OAuth configuration, an old local Firebase configuration can remain in the Android project.

Firebase’s current troubleshooting documentation specifically recommends making sure the application uses an up-to-date google-services.json. :contentReference[oaicite:20]{index=20}

Solution 7: Download google-services.json Again

Firebase Console → Project settings → General → Your apps → Android app → Download google-services.json

Replace the file normally located at:

app/google-services.json

Cause 8: The Android OAuth Client Is Missing

The Google Cloud project should contain an Android OAuth 2.0 client corresponding to the current package name and signing certificate.

Firebase’s authentication troubleshooting guide recommends checking that the required underlying OAuth 2.0 clients are present in the Google Cloud Credentials page. :contentReference[oaicite:21]{index=21}

Solution 8: Inspect OAuth 2.0 Client IDs

Google Cloud Console → APIs & Services → Credentials → OAuth 2.0 Client IDs

Check the Android client for:

Package name SHA-1 certificate fingerprint

Cause 9: An Android Client ID Is Passed to requestIdToken()

Legacy Google Sign-In code used with Firebase Authentication often looks like:

GoogleSignInOptions.Builder( GoogleSignInOptions.DEFAULT_SIGN_IN ) .requestIdToken( getString( R.string.default_web_client_id ) ) .requestEmail() .build()

The argument to requestIdToken() is a server client ID, normally a Web application OAuth client that verifies the ID token.

Google’s API reference explicitly says that requestIdToken(serverClientId) requires the client ID of the server that will verify the token. :contentReference[oaicite:22]{index=22}

Solution 9: Use the Correct Web / Server Client ID

In Firebase-based legacy projects, this is often available as:

R.string.default_web_client_id

For example:

.requestIdToken( getString( R.string.default_web_client_id ) )

Cause 10: The Web Client ID Belongs to Another Project

A configuration such as:

Android OAuth client → Firebase Project A

requestIdToken()
→ Web client from Project B

can break the expected authentication configuration.

Solution 10: Verify the Google Cloud Project for Every Client ID

Check that the intended:

Firebase project Android OAuth client Web OAuth client

belong to the correct Google Cloud project.

Cause 11: Product Flavors Change the Package Name

productFlavors { create("free") { applicationId = "com.example.app.free" }
create("paid") {
    applicationId =
        "com.example.app.paid"
}

}

Solution 11: Configure Every Flavor

free: com.example.app.free + signing SHA-1

paid:
com.example.app.paid

signing SHA-1

If the flavors use separate Firebase projects, use variant-specific configuration files:

app/src/free/google-services.json

app/src/paid/google-services.json

Cause 12: The Release Keystore Changed

A new release keystore means a different signing certificate and therefore a different SHA-1.

Solution 12: Inspect the Actual Keystore

keytool -list -v \ -keystore release.jks \ -alias myalias

Look for:

SHA1: AA:BB:CC:...

and compare it with the registered Android OAuth client.

Cause 13: The Debug Keystore Changed

A different development computer or regenerated debug.keystore can result in a new Debug SHA-1.

Solution 13: Register the Current Debug Fingerprint

./gradlew signingReport

Add that SHA-1 to the Firebase / OAuth configuration.

Cause 14: Only the Google Play Version Fails

Android Studio Debug → works

Local Release APK
→ works

Installed from Google Play
→ DEVELOPER_ERROR

This strongly suggests checking the Google Play App Signing certificate.

Solution 14: Add the Play App Signing SHA-1

Copy the App Signing certificate SHA-1 from Google Play Console and register it with the corresponding Firebase Android app / OAuth configuration.

Then download an updated google-services.json when using Firebase.

Cause 15: Old OAuth Client IDs Remain in the Source Code

After moving to another Firebase or Google Cloud project, an old client ID may remain hard-coded.

Solution 15: Search the Entire Project

Search for:

apps.googleusercontent.com

default_web_client_id

requestIdToken

requestServerAuthCode

Remove or replace obsolete client IDs.

Cause 16: requestServerAuthCode() Uses the Wrong Client ID

Backend authorization flows may use:

.requestServerAuthCode( serverClientId )

Google’s official API reference states that this must be the server client ID that will exchange the authorization code for tokens. :contentReference[oaicite:23]{index=23}

Solution 16: Use the Backend/Web Client ID

Do not substitute the Android OAuth client ID when the API expects the server client ID.

Cause 17: The Wrong Firebase File Is Used for a Variant

Development and production builds may use different Firebase projects.

Solution 17: Use Variant-Specific Configuration Files

app/src/development/google-services.json

app/src/production/google-services.json

Make sure the selected build variant uses the intended Firebase project.

Cause 18: The Google Services Gradle Plugin Is Missing

When using Firebase Authentication, the Google Services plugin processes the Firebase configuration and generates Android resources.

Solution 18: Apply the Plugin

plugins { id("com.android.application") id("com.google.gms.google-services") }

Check default_web_client_id

After a successful Google Services build, inspect generated resources under a path such as:

app/build/generated/res/google-services/ debug/values/values.xml

If a Web OAuth client is configured, you may find:

<string name="default_web_client_id"> ... </string>

Cause 19: Firebase and Google Cloud OAuth Configuration Are Out of Sync

Manually deleting OAuth clients in Google Cloud Console can leave the Firebase authentication setup inconsistent.

Firebase’s current troubleshooting guide recommends checking the Google provider, downloading the latest Firebase configuration, and confirming that the underlying OAuth 2.0 clients exist. :contentReference[oaicite:24]{index=24}

Solution 19: Refresh the Google Provider Configuration

Firebase Console → Authentication → Sign-in method → Google → Disable → Save → Enable → Save

Then download the latest Firebase config and verify the OAuth clients in Google Cloud Console.

How to Confirm the Status Code

Legacy Google Sign-In applications can log the ApiException status:

try { val account = GoogleSignIn.getSignedInAccountFromIntent( data ).getResult( ApiException::class.java ) } catch (e: ApiException) { Log.e( "GoogleSignIn", "statusCode=${e.statusCode}", e ) }

If:

statusCode = 10

the error is DEVELOPER_ERROR. Google’s CommonStatusCodes documentation defines DEVELOPER_ERROR = 10. :contentReference[oaicite:25]{index=25}

Is This a Network Problem?

Usually no.

Google Play services defines network failures separately:

NETWORK_ERROR = 7

DEVELOPER_ERROR = 10

Status 10 points to application configuration rather than connectivity. :contentReference[oaicite:26]{index=26}

Is the User’s Google Account the Problem?

Usually no.

Because DEVELOPER_ERROR is an application configuration error, switching accounts generally does not correct the underlying problem.

Will Updating Google Play services Fix It?

An outdated Google Play services installation can cause other failures, but a confirmed status code 10 should be investigated as a configuration problem first.

Will Clearing Android Studio Caches Fix It?

Not if the OAuth package name, SHA-1, or client ID is actually wrong.

After correcting the configuration, however, a clean build is useful.

Clean and Rebuild

macOS or Linux:

./gradlew clean ./gradlew assembleDebug

Windows:

gradlew.bat clean gradlew.bat assembleDebug

Run Gradle Sync

File → Sync Project with Gradle Files

Compare Debug, Release, and Play Builds

A simple matrix often reveals the problem:

Debug Package: com.example.app SHA-1: AAAA...

Local Release
Package: com.example.app
SHA-1: BBBB...

Google Play
Package: com.example.app
SHA-1: CCCC...

Make sure every package/signature combination that needs Google Sign-In has a matching OAuth configuration.

The Legacy Google Sign-In API Is Deprecated

Google’s 2026 Android API references mark the legacy Google Sign-In and GoogleSignInClient APIs as deprecated.

Google currently directs authentication implementations toward Credential Manager and newer Google Identity APIs. :contentReference[oaicite:27]{index=27}

Legacy Google Sign-In Example

An existing Firebase Authentication app may contain:

val gso = GoogleSignInOptions.Builder( GoogleSignInOptions.DEFAULT_SIGN_IN ) .requestIdToken( getString( R.string.default_web_client_id ) ) .requestEmail() .build()

val client =
GoogleSignIn.getClient(
this,
gso
)

Verify that default_web_client_id belongs to the intended Firebase/Google Cloud project.

Google’s API reference confirms that requestIdToken() expects the server client ID that will verify the token. :contentReference[oaicite:28]{index=28}

Fastest Troubleshooting Order

1. Run ./gradlew signingReport.
2. Verify the final application ID.
3. Register the package name and SHA-1 in Firebase / OAuth configuration.
4. If the Google Play build fails, add the App Signing SHA-1.
5. Verify that the Google sign-in provider is enabled.
6. Download the latest google-services.json.
7. Check the Android OAuth client in Google Cloud Console.
8. Verify that requestIdToken() uses the correct Web/server client ID.
9. Check flavors and applicationIdSuffix.
10. Sync and clean-build the project.

If the Error Still Occurs

Check all of the following:

• The status code is actually 10.
• You verified the final applicationId.
• You did not check only namespace.
• You obtained the SHA-1 from the actual signing certificate.
• The Debug SHA-1 is registered.
• The Release SHA-1 is registered.
• The Google Play App Signing SHA-1 is registered.
• The Firebase Google provider is enabled.
• The latest google-services.json is installed.
• The Android OAuth client matches package name and SHA-1.
• The Web client ID is not being confused with the Android client ID.
• requestIdToken() uses the correct server client ID.
• Product flavors or suffixes are not changing the application identity.
• A changed keystore did not introduce a new SHA-1.
• No obsolete OAuth client ID remains hard-coded.

Summary

Android Google Sign-In “DEVELOPER_ERROR” means that the application’s Google authentication configuration is invalid or inconsistent.

Google Play services defines it as status code 10 and describes it as an application misconfiguration. :contentReference[oaicite:29]{index=29}

The key configuration chain is:

Application ID + Signing certificate SHA-1 + Android OAuth client + Web / server OAuth client + google-services.json

If Debug works but the Google Play build fails, check the Google Play App Signing certificate first.

When Firebase Authentication is involved, Firebase’s current troubleshooting documentation recommends verifying the Google provider, using the latest google-services.json, and confirming that the required OAuth 2.0 clients exist. :contentReference[oaicite:30]{index=30}

Finally, the legacy Google Sign-In API is now deprecated. Google’s current Android documentation recommends Credential Manager for modern authentication flows and newer Google Identity APIs for authorization. :contentReference[oaicite:31]{index=31}

For an existing legacy app, however, the fastest way to fix DEVELOPER_ERROR is still to verify that the current package name and the SHA-1 of the certificate that actually signed the installed app exactly match the configured Android OAuth client.