Firexport logo

FirexportBlog

Fix Google Sign-In error 10 and 28444 (Developer console is not set up correctly)

ApiException: 10 from the old Google Sign-In SDK and [28444] Developer console is not set up correctly from Credential Manager are the same setup problem. The app asking to sign in (its package name and the SHA-1 of the certificate that signed this build), or the Web client ID it passed, doesn’t match what’s registered in the project. You fix the registration, not the code. Start by checking that the SHA-1 of the key that signed the build you’re running is in Firebase.

In short

  • Same error, different names. 10 is the old SDK’s DEVELOPER_ERROR; 28444 is the message Credential Manager returns for the same thing. The cause is the package name, the signing SHA-1 or the Web client ID. Tell the errors apart
  • Register the SHA-1 of the key that signed the running build. The debug key, your upload key and Google Play’s app signing key are all different. SHA-1 by build
  • serverClientId takes the Web client ID. Not the Android client ID. What to pass
  • The old SDK was removed in August 2026. With Credential Manager, the same setup error can also look like the user cancelled. Migrating

Telling the errors apart

ErrorWhereMeaning
ApiException: 10The old Google Sign-In for AndroidDEVELOPER_ERROR. The app is misconfigured.
[28444] Developer console is not set up correctly.Credential Manager. In Flutter’s google_sign_in 7, it’s GoogleSignInExceptionCode.unknownErrorThe code isn’t documented. As the message says, the OAuth setup doesn’t match the app.
Cancelled without the user cancellingCredential Manager (GetCredentialCancellationException, canceled in Flutter)Setup errors are sometimes reported as a cancellation.
ApiException: 12500The old Google Sign-In for AndroidAccording to the Firebase docs, the support email isn’t set or a SHA key is missing.
NoCredentialExceptionCredential ManagerNot a setup problem. The device has no Google account, or the request only offers accounts that have signed in to the app before (below).

The first three have the same causes. The Flutter plugin’s docs (google_sign_in_android) list the common sources of setup errors as a missing or incorrect signing SHA for a build, an incorrect package name on the server side, and a missing or incorrect serverClientId. Check them in that order.

The SHA-1 of the key that signed this build

Google recognizes the app asking to sign in by its package name and the SHA-1 of the certificate that signed the APK. The package name is the applicationId in build.gradle (with any suffix a build type adds), and it must match the Android app registered in Firebase. The signature depends on how the app was installed.

Installed buildSigned withWhere to get the SHA-1
Debug build run from Android StudioThis computer’s debug keystore (different on each computer)The debug entry of signingReport
Release build you signed and installed yourselfYour upload (release) keyThe release entry of signingReport
App installed from Google Play (any track)The app signing key Google holdsThe Manage Play app signing page in the Play Console
App installed through internal app sharingPlay’s internal test certificateThe Internal test certificate on the Play Console’s internal app sharing page
# Every build variant's signing key, from the project root
./gradlew signingReport

# The debug keystore (password: android)
keytool -list -v -alias androiddebugkey -keystore ~/.android/debug.keystore

# The certificate that signed an APK or AAB you already have
keytool -printcert -jarfile app-release.aab

Add the SHA-1 under SHA certificate fingerprints for the Android app in the Firebase console’s Project settings > General > Your apps, then download google-services.json again and replace yours. Firebase creates the Android OAuth client for that fingerprint. Register every key you use, and sign-in works however the app was installed.

  • If it works when you install it yourself but fails from Play, the app signing key is missing. Play re-signs the app with the app signing key Google holds, not your upload key.
  • New apps are signed by Play with three keys by default (quantum-ready signing). Play Console Help then tells you to register all three fingerprints with your API providers.
  • A package name and SHA-1 pair can be registered in only one Firebase or Google Cloud project across all of them. If you keep separate development and production projects, give each build its own package name.

serverClientId takes the Web client ID

serverClientId takes the OAuth client ID of the Web application in your Google Cloud project. It’s used as the audience of the Google ID tokens, so the Android client ID doesn’t belong there. In a Firebase project it’s the entry with client_type 3 in google-services.json, which the google-services plugin turns into R.string.default_web_client_id.

// Android (Kotlin): the Sign in with Google button
val buttonOption = GetSignInWithGoogleOption.Builder(
    serverClientId = getString(R.string.default_web_client_id),
).build()

// Android (Kotlin): the bottom sheet, offering every account on the device
val sheetOption = GetGoogleIdOption.Builder()
    .setServerClientId(getString(R.string.default_web_client_id))
    .setFilterByAuthorizedAccounts(false)
    .build()

// Flutter (google_sign_in 7), without google-services.json
await GoogleSignIn.instance.initialize(
  serverClientId: 'YOUR_WEB_CLIENT_ID.apps.googleusercontent.com',
);
  • Flutter’s google_sign_in 7 reads that value without a serverClientId when google-services.json has a web client entry. If it doesn’t, add a web app to the Firebase project and download the file again. On Android, clientId isn’t used.
  • If 28444 first appeared after moving from 6.x to 7, suspect serverClientId. The Flutter team explains that the old SDK 6.x used didn’t always validate it, so a wrong value may have worked (flutter/flutter #174319).

Moving from the old SDK to Credential Manager

The old Google Sign-In for Android APIs were removed in play-services-auth 22.0.0 (August 26, 2026). From that version on, sign-in code built on GoogleSignInClient no longer compiles, so move to Credential Manager.

Old SDKCredential Manager
The GoogleSignInClient sign-in screenGetSignInWithGoogleOption (button) or GetGoogleIdOption (bottom sheet)
silentSignIn()GetGoogleIdOption with setFilterByAuthorizedAccounts(true) and setAutoSelectEnabled(true)
requestIdToken(webClientId)The same Web client ID as serverClientId
signOut()clearCredentialState()
ApiException: 10[28444] Developer console is not set up correctly, or a cancellation
  • setFilterByAuthorizedAccounts defaults to true. Users who have never signed in to the app get a NoCredentialException, so set it to false for sign-up and first sign-in, or use the button flow.
  • On an emulator, sign in to a Google account. Use a system image with Google APIs. With no account on the device, you get a NoCredentialException.

Sources

All posts →