Hi @SimpleNotion,
Welcome to the Google Cloud community!
I understand that you have set up Firebase Authentication for your Flutter app, and that you recently encountered an ApiException 10 error in Google Sign-in.
The ApiException 10 error indicates two possible scenarios that could be happening in your Google Sign-in implementation:
- SHA1 misconfiguration: Though I've taken note that you've seen to it that the SHA1 fingerprints from your client app and in Firebase console are matched, could you verify if your app is registered in Google Play? In cases like this, the App Signing key from Play console needs to be the SHA1 key that's registered in Firebase console (as explained here).
- Invalid Client ID (for Android only): Another possible cause might be the fact that the OAuth client ID used for Google Sign-in implementation is incorrect. If you're on Android platform while having this issue, check if you're passing in a
clientId parameter to GoogleSignIn. If so, make sure that you're using the Web client (Auto-created for Google Sign-in) client ID. This can be found in Google Cloud console > Credentials, in the list of OAuth client 2.0 client IDs. You can also gain a better explanation of this behavior here.
If your app's OAuth consent screen is in "Pending verification" status, this will not affect your Google Sign-in flow in terms of raising an exception or causing a disruption. However, please bear in mind the following scenarios that could happen under this status:
- There will still be restrictions taking place. For instance, if your app attempts to access restricted scopes this may prompt Google to send warnings to users or even restrict them from proceeding.
- Your app may be unable to display your desired display name and icon for your project on the OAuth consent screen. This may also mean that the app could be labeled as “Not Google verified”
- If "Testing" is the current status while verification is still under evaluation, then only test users won’t encounter warnings about the app being “unverfied”. In case you have a previous OAuth configuration screen that was approved, that’s the one that will be currently in use while waiting for the new changes to be approved and take effect.
- For Firebase Authentication, this won’t matter much because it only attempts to access email and profile scopes, all of which are non-sensitive scopes. This means users won’t be blocked, but they could still encounter labels like “unverified app” when non-test users are the ones attempting to log-in.
If your app's verification status is in “Testing” mode, the workaround for this is to continue disregarding labels like “unverified app” if non-test users are involved, or you can continue managing (adding/removing) test users (limit of which is around 100). As long as you're not accessing restricted scopes, your users have a lesser chance of being warned or blocked.
For more information about the scenarios involved while your app undergoes an OAuth Consent Screen verification, you can check this documentation.
Lastly, I've noticed that the version of your google_sign_in plugin is outdated. At the time of this writing v6.2.2 is the latest version. It may be best to update your packages related to Firebase and Google Sign-in for your Flutter app.
Hope this helps.
LinkedIn
Twitter
