Firebase Phone Auth Not Working in Play Store AAB Build? Here's the Fix for React Native Developers

If you've built your React Native app using Firebase — including Firestore, Firebase Functions, and Firebase Auth — and everything works fine during development and even with manually installed release APKs, but suddenly Firebase Phone Authentication fails after uploading the AAB build to the Play Store, you're not alone.

This issue has frustrated many developers, and the good news is — there’s a clear fix.

✅ The Problem: Firebase Phone Auth Breaks After Play Store Upload

Your app works perfectly in debug mode. You can sign in with phone numbers using Firebase Auth when installing the APK directly to your device.

But once you upload the AAB (Android App Bundle) to the Play Store (Internal Testing or Production) and install it from there, phone number authentication fails. You get errors like:

• "This app is not authorized to use Firebase Authentication"
• "An internal error has occurred"
• The verification SMS is never sent
• Or the flow silently fails

🔍 Why This Happens

Firebase verifies your app using the SHA-1 and SHA-256 fingerprints of your signing certificate. When you're building manually or in debug, you're using a local debug keystore.

But once Google Play signs your app (especially when uploading .aab instead of .apk), the final signing key is different — and Firebase doesn't know about that key yet.

🛠 The Solution: Add the Play Store Signing SHA Keys to Firebase

✅ Step-by-Step Fix:

1. Go to Play Console

• Navigate to your app → Setup → App integrity

2. Copy Your App Signing Certificate

Under App signing, you’ll see:

• SHA-1 certificate fingerprint
• SHA-256 certificate fingerprint

👉 Copy both

3. Go to Firebase Console

• Navigate to your Firebase project → Project Settings → General
• Scroll to Your apps → Click your Android app
• Under SHA certificate fingerprints, click Add fingerprint

4. Paste SHA-1 and SHA-256 keys

Paste the keys from the Play Console here.

✅ Hit Save.

5. Rebuild App Bundle (Optional)

If you’re testing again with internal testing:

• Upload a new .aab
• Wait for it to be processed (usually 10–20 minutes)
• Reinstall the app via Play Store internal track

Bonus: If You’re Using reCAPTCHA or SafetyNet

Firebase Phone Auth may also rely on reCAPTCHA or SafetyNet Attestation, which fails silently if the keys aren’t properly set up.

Ensure:

• You’ve enabled Phone Number Authentication in Firebase Auth
• Play Integrity API / SafetyNet is enabled in Google Cloud Console

🧪 How to Test It Works

1. Upload new .aab to Internal Testing
2. Install via Google Play Internal Testing track
3. Try Phone Auth again
4. You should now:

• Receive the SMS code
• Successfully sign in
• Avoid the “app not authorized” errors

🚀 Final Thought

Firebase Phone Auth is powerful — but when deploying to the Play Store, you must register the correct app signing keys. Firebase needs to trust the key Google uses to sign your .aab before it will allow phone auth to work correctly in production.

If you’re deploying a production-grade React Native app, this is a critical deployment step — don’t skip it.

Bonus: Using the Same App Signing Key Across App Stores — What You Need to Know

If you’re distributing your app on multiple platforms (like Play Store, Amazon Appstore, or Huawei AppGallery), you may want to use the same app signing key to simplify updates and ensure a smooth user experience.

Yes — it’s still possible to use the same key, even with Google Play App Signing. Here’s how:

✅ Option 1: Upload Your Own Signing Key to Google Play

This is the recommended method if you’re launching on multiple stores simultaneously.

• Step 1: Generate your keystore locally (e.g., using keytool)
• Step 2: Use that key to sign your APKs or AAB
• Step 3: Upload a copy of that key to Google Play when setting up Play App Signing

🎯 Now you can use that same signing key for other stores like Amazon, Huawei, etc.

✅ Option 2: Use Google-Generated Key + Export Signed APKs

If you already let Google generate your app signing key, don’t worry — you can still distribute the same signed build elsewhere:

• Download the distribution APKs (already signed by Google) from Play Console
• Use these APKs for release in other stores

🔒 You’re not manually handling the signing process, but you’re still distributing the same signed APK across platforms.

🔁 Can You Use the Same Key for Older Apps (Pre-August 2021)?

Yes! For apps created before August 2021, Google supports a Key Upgrade flow:

• After the upgrade, upload:
• An AAB (for new installs via the updated key)
• A legacy APK (signed with your old key for users updating from older installs)

➡️ Over time, all users will migrate to the new key (e.g., when switching to a new device).

⚠️ Should You Use the Same Key for Multiple Apps?

Technically, yes — you can. But it’s not recommended for security reasons.

If you choose to:

• You can upload the same key during Play App Signing setup
• Or request a key upgrade to unify keys between apps

Just remember: unique keys = better security isolation.

🔐 How to Verify Google Didn’t Modify Your Code

If you’re worried about Play Store modifying your code behind the scenes, Google offers options to verify your build integrity:

• Use App Bundle Explorer to inspect final artifacts
• Download APKs from the Play Console to compare hashes
• Enable Code Transparency: a feature that cryptographically verifies code delivered to end users is exactly what you uploaded
• Play Developer API (coming soon) will let you verify APKs before pushing live

TL;DR Recap:

• Problem: Firebase Phone Auth fails after uploading AAB to Play Store
• Cause: Firebase doesn’t recognize Google Play’s signing key
• Fix: Copy SHA-1/SHA-256 keys from Play Console → Add to Firebase Project Settings