firebase_auth: "Invalid PlayIntegrity token; does not pass basic integrity." on debug builds

[kirstenkoa]

Is there an existing issue for this?

• I have searched the existing issues.

Which plugins are affected?

Auth

Which platforms are affected?

Android

Description

Hello, I recently set up my Flutter project to be distributed to internal testers on Google Play following these instructions.

The main changes to our build.gradle file were adding the release signing and build configs:

    signingConfigs {
        release {
            if (keystoreProperties['storeFile']) { 
                storeFile file(keystoreProperties['storeFile'])
                storePassword keystoreProperties['storePassword']
                keyAlias keystoreProperties['keyAlias']
                keyPassword keystoreProperties['keyPassword']
            }
        }
    }

    buildTypes {
        release {
            signingConfig = signingConfigs.getByName("release")
        }
        debug {
            signingConfig = signingConfigs.debug
        }
    }

After these changes, we were able to distribute to internal testers through Google Play and login using Phone Number through those builds.

However, now we are getting the following error on Android debug builds:

"Invalid PlayIntegrity token; does not pass basic integrity."

Our individual debug SHA256 are still the same and included in our Firebase project. The package name matches as well. The SHAs are also included in App Check Settings.

Is this a bug or are we missing a key piece of setup?

Thank you!

Reproducing the issue

• Verified that package name matches the one in Firebase Project Settings.
• Verified SHA1 and SHA256 are in Firebase Project Settings and App Check Settings.
• Turned off "App Integrity - automatic protection" in Google Play Console

In our main.dart file, we are initializing Firebase along with other dependencies

Future<void> _initializeFirebase() async {
  await Firebase.initializeApp(
    options: DefaultFirebaseOptions.currentPlatform,
  );
  if (kReleaseMode) {
    _logger.d('Activating App Check in release mode');
    await FirebaseAppCheck.instance.activate(
      androidProvider: AndroidProvider.playIntegrity,
      appleProvider: AppleProvider.appAttest,
    );
  } else {
    _logger.d('Activating App Check in debug mode');
    await FirebaseAppCheck.instance.activate(
      androidProvider: AndroidProvider.debug,
      appleProvider: AppleProvider.debug,
    );
  }
}

During authentication, we are calling Firebase Auth

  Future<void> verifyPhoneNumber(
      {required String phoneNumber,
      required Function(PhoneAuthCredential credential) onVerificationCompleted,
      required Function(FirebaseAuthException e) onVerificationFailed,
      required Function(String verId, int? resendToken) onCodeSent,
      required Function(String verId) onCodeAutoRetrievalTimeout,
      int? resendToken}) async {
    await _firebaseAuth.verifyPhoneNumber(
      phoneNumber: phoneNumber,
      verificationCompleted: onVerificationCompleted,
      verificationFailed: onVerificationFailed,
      codeSent: onCodeSent,
      codeAutoRetrievalTimeout: onCodeAutoRetrievalTimeout,
      forceResendingToken: resendToken,
    );
  }

  Future<UserCredential> signInWithPhoneNumber(
      {required PhoneAuthCredential credential}) async {
    try {
      _clearTokenCache();
      return await _firebaseAuth.signInWithCredential(credential);
    } on FirebaseAuthException catch (e) {
      if (e.code == 'invalid-credential') {
        throw UnavailableEmailException();
      } else if (e.code == 'user-not-found') {
        throw UserNotFoundException();
      } else if (e.code == 'user-disabled') {
        throw UserDisabledException();
      } else if (e.code == 'invalid-verification-code') {
        throw InvalidVerificationCodeException();
      } else if (e.code == 'invalid-verification-id') {
        throw InvalidVerificationIdException();
      } else {
        throw Exception('An unexpected error occurred: ${e.code}');
      }
    }
  }

Firebase Core version

3.13.0

Flutter Version

3.29.2

Relevant Log Output

status: {
code: 3
message: "INVALID_APP_CREDENTIAL : Invalid PlayIntegrity token; does not pass basic integrity."
}

Flutter dependencies

Expand Flutter dependencies snippet

flutter pub deps -- --style=compact
Dart SDK 3.7.2
Flutter SDK 3.29.2
based 1.0.0+91

dependencies:
- async 2.12.0 [collection meta]
- cached_network_image 3.4.1 [cached_network_image_platform_interface cached_network_image_web flutter flutter_cache_manager octo_image]
- camera 0.11.0 [camera_android_camerax camera_avfoundation camera_platform_interface camera_web flutter flutter_plugin_android_lifecycle]
- camera_android_camerax 0.6.7 [async camera_platform_interface flutter meta stream_transform]
- collection 1.19.1
- connectivity_plus 6.1.3 [flutter flutter_web_plugins connectivity_plus_platform_interface web meta nm collection]
- cupertino_icons 1.0.8
- defer_pointer 0.0.2 [flutter equatable]
- device_info_plus 11.3.3 [device_info_plus_platform_interface ffi file flutter flutter_web_plugins meta web win32 win32_registry]
- firebase_analytics 11.4.4 [firebase_analytics_platform_interface firebase_analytics_web firebase_core firebase_core_platform_interface flutter]
- firebase_app_check 0.3.2+5 [firebase_app_check_platform_interface firebase_app_check_web firebase_core firebase_core_platform_interface flutter]
- firebase_auth 5.5.1 [firebase_auth_platform_interface firebase_auth_web firebase_core firebase_core_platform_interface flutter meta]
- firebase_core 3.13.0 [firebase_core_platform_interface firebase_core_web flutter meta]
- firebase_messaging 15.2.4 [firebase_core firebase_core_platform_interface firebase_messaging_platform_interface firebase_messaging_web flutter meta]
- flutter 0.0.0 [characters collection material_color_utilities meta vector_math sky_engine]
- flutter_contacts 1.1.9+2 [flutter]
- flutter_image_compress 2.4.0 [flutter flutter_image_compress_platform_interface flutter_image_compress_common flutter_image_compress_web flutter_image_compress_macos flutter_image_compress_ohos]
- flutter_image_gallery_saver 0.0.2 [flutter plugin_platform_interface]
- flutter_localizations 0.0.0 [flutter intl characters clock collection material_color_utilities meta path vector_math]
- flutter_riverpod 2.6.1 [collection flutter meta riverpod state_notifier]
- flutter_secure_storage 9.2.4 [flutter flutter_secure_storage_linux flutter_secure_storage_macos flutter_secure_storage_platform_interface flutter_secure_storage_web flutter_secure_storage_windows meta]
- flutter_svg 2.0.17 [flutter http vector_graphics vector_graphics_codec vector_graphics_compiler]
- giphy_picker 3.0.2 [flutter http]
- go_router 14.8.1 [collection flutter flutter_web_plugins logging meta]
- hive 2.2.3 [meta crypto]
- hive_flutter 1.1.0 [flutter hive path_provider path]
- http 1.3.0 [async http_parser meta web]
- image 4.5.3 [archive meta xml]
- image_cropper 9.1.0 [flutter image_cropper_platform_interface image_cropper_for_web]
- image_picker 1.1.2 [flutter image_picker_android image_picker_for_web image_picker_ios image_picker_linux image_picker_macos image_picker_platform_interface image_picker_windows]
- image_picker_android 0.8.12+22 [flutter flutter_plugin_android_lifecycle image_picker_platform_interface]
- image_picker_platform_interface 2.10.1 [cross_file flutter http plugin_platform_interface]
- intl 0.19.0 [clock meta path]
- just_audio 0.9.46 [just_audio_platform_interface just_audio_web audio_session rxdart path path_provider async uuid crypto meta flutter]
- logger 2.5.0
- mime 2.0.0
- no_screenshot 0.3.1 [flutter plugin_platform_interface]
- path 1.9.1
- path_provider 2.1.5 [flutter path_provider_android path_provider_foundation path_provider_linux path_provider_platform_interface path_provider_windows]
- permission_handler 11.4.0 [flutter meta permission_handler_android permission_handler_apple permission_handler_html permission_handler_windows permission_handler_platform_interface]
- photo_view 0.15.0 [flutter]
- protobuf 3.1.0 [collection fixnum meta]
- record 5.2.1 [flutter uuid record_platform_interface record_web record_windows record_linux record_android record_darwin]
- retry 3.1.2
- tabler_icons 2.5.0+1 [flutter]
- transparent_pointer 1.0.1 [flutter]
- url_launcher 6.3.1 [flutter url_launcher_android url_launcher_ios url_launcher_linux url_launcher_macos url_launcher_platform_interface url_launcher_web url_launcher_windows]
- uuid 4.5.1 [crypto sprintf meta fixnum]
- video_player 2.9.3 [flutter html video_player_android video_player_avfoundation video_player_platform_interface video_player_web]
- web_socket_channel 3.0.2 [async crypto stream_channel web web_socket]
- yaml 3.1.3 [collection source_span string_scanner]

dev dependencies:
- android_notification_icons 0.0.1 [checked_yaml json_annotation image path meta]
- custom_lint 0.7.5 [analyzer analyzer_plugin args async ci cli_util collection custom_lint_core freezed_annotation json_annotation meta package_config path pub_semver pubspec_parse rxdart uuid yaml]
- flutter_launcher_icons 0.14.3 [args checked_yaml cli_util image json_annotation path yaml]
- flutter_lints 5.0.0 [lints]
- flutter_native_splash 2.4.5 [args flutter flutter_web_plugins html image meta path universal_io xml yaml ansicolor]
- flutter_test 0.0.0 [flutter test_api matcher path fake_async clock stack_trace vector_math leak_tracker_flutter_testing async boolean_selector characters collection leak_tracker leak_tracker_testing material_color_utilities meta source_span stream_channel string_scanner term_glyph vm_service]
- protoc_plugin 21.1.2 [fixnum path protobuf]
- riverpod_lint 2.6.5 [analyzer analyzer_plugin collection custom_lint_builder meta path riverpod riverpod_analyzer_utils source_span yaml]

transitive dependencies:
- _fe_analyzer_shared 80.0.0 [meta]
- _flutterfire_internals 1.3.54 [collection firebase_core firebase_core_platform_interface flutter meta]
- analyzer 7.3.0 [_fe_analyzer_shared collection convert crypto glob meta package_config path pub_semver source_span watcher yaml]
- analyzer_plugin 0.13.0 [analyzer collection dart_style pub_semver yaml path]
- ansicolor 2.0.3
- archive 4.0.4 [crypto path posix]
- args 2.7.0
- audio_session 0.1.25 [flutter flutter_web_plugins rxdart meta]
- boolean_selector 2.1.2 [source_span string_scanner]
- cached_network_image_platform_interface 4.1.1 [flutter flutter_cache_manager]
- cached_network_image_web 1.3.1 [cached_network_image_platform_interface flutter flutter_cache_manager web]
- camera_avfoundation 0.9.19 [camera_platform_interface flutter stream_transform]
- camera_platform_interface 2.10.0 [cross_file flutter plugin_platform_interface stream_transform]
- camera_web 0.3.5 [camera_platform_interface flutter flutter_web_plugins stream_transform web]
- characters 1.4.0
- checked_yaml 2.0.3 [json_annotation source_span yaml]
- ci 0.1.0
- cli_util 0.4.2 [meta path]
- clock 1.1.2
- connectivity_plus_platform_interface 2.0.1 [flutter meta plugin_platform_interface]
- convert 3.1.2 [typed_data]
- cross_file 0.3.4+2 [meta web]
- crypto 3.0.6 [typed_data]
- csslib 1.0.2 [source_span]
- custom_lint_builder 0.7.5 [analyzer analyzer_plugin collection custom_lint custom_lint_core custom_lint_visitor glob hotreloader meta package_config path pubspec_parse rxdart]
- custom_lint_core 0.7.5 [analyzer analyzer_plugin collection custom_lint_visitor glob matcher meta package_config path pubspec_parse source_span uuid yaml]
- custom_lint_visitor 1.0.0+7.3.0 [analyzer]
- dart_style 3.0.1 [analyzer args collection package_config path pub_semver source_span yaml]
- dbus 0.7.11 [args ffi meta xml]
- device_info_plus_platform_interface 7.0.2 [flutter meta plugin_platform_interface]
- equatable 2.0.7 [collection meta]
- fake_async 1.3.2 [clock collection]
- ffi 2.1.4
- file 7.0.1 [meta path]
- file_selector_linux 0.9.3+2 [cross_file file_selector_platform_interface flutter]
- file_selector_macos 0.9.4+2 [cross_file file_selector_platform_interface flutter]
- file_selector_platform_interface 2.6.2 [cross_file flutter http plugin_platform_interface]
- file_selector_windows 0.9.3+4 [cross_file file_selector_platform_interface flutter]
- firebase_analytics_platform_interface 4.3.4 [_flutterfire_internals firebase_core flutter meta plugin_platform_interface]
- firebase_analytics_web 0.5.10+10 [_flutterfire_internals firebase_analytics_platform_interface firebase_core firebase_core_web flutter flutter_web_plugins]
- firebase_app_check_platform_interface 0.1.1+5 [_flutterfire_internals firebase_core flutter meta plugin_platform_interface]
- firebase_app_check_web 0.2.0+9 [_flutterfire_internals firebase_app_check_platform_interface firebase_core firebase_core_web flutter flutter_web_plugins web]
- firebase_auth_platform_interface 7.6.1 [_flutterfire_internals collection firebase_core flutter meta plugin_platform_interface]
- firebase_auth_web 5.14.1 [firebase_auth_platform_interface firebase_core firebase_core_web flutter flutter_web_plugins http_parser meta web]
- firebase_core_platform_interface 5.4.0 [collection flutter flutter_test meta plugin_platform_interface]
- firebase_core_web 2.22.0 [firebase_core_platform_interface flutter flutter_web_plugins meta web]
- firebase_messaging_platform_interface 4.6.4 [_flutterfire_internals firebase_core flutter meta plugin_platform_interface]
- firebase_messaging_web 3.10.4 [_flutterfire_internals firebase_core firebase_core_web firebase_messaging_platform_interface flutter flutter_web_plugins meta web]
- fixnum 1.1.1
- flutter_cache_manager 3.4.1 [clock collection file flutter http path path_provider rxdart sqflite uuid]
- flutter_image_compress_common 1.0.6 [flutter flutter_image_compress_platform_interface]
- flutter_image_compress_macos 1.0.3 [flutter flutter_image_compress_platform_interface]
- flutter_image_compress_ohos 0.0.3 [flutter flutter_image_compress_platform_interface]
- flutter_image_compress_platform_interface 1.0.5 [flutter plugin_platform_interface cross_file]
- flutter_image_compress_web 0.1.5 [flutter flutter_web_plugins flutter_image_compress_platform_interface web]
- flutter_plugin_android_lifecycle 2.0.27 [flutter]
- flutter_secure_storage_linux 1.2.3 [flutter flutter_secure_storage_platform_interface]
- flutter_secure_storage_macos 3.1.3 [flutter flutter_secure_storage_platform_interface]
- flutter_secure_storage_platform_interface 1.1.2 [flutter plugin_platform_interface]
- flutter_secure_storage_web 1.2.1 [flutter flutter_secure_storage_platform_interface flutter_web_plugins js]
- flutter_secure_storage_windows 3.1.2 [ffi flutter flutter_secure_storage_platform_interface path path_provider win32]
- flutter_web_plugins 0.0.0 [flutter characters collection material_color_utilities meta vector_math]
- freezed_annotation 3.0.0 [collection json_annotation meta]
- glob 2.1.3 [async collection file path string_scanner]
- hotreloader 4.3.0 [collection logging path stream_transform vm_service watcher]
- html 0.15.5 [csslib source_span]
- http_parser 4.1.2 [collection source_span string_scanner typed_data]
- image_cropper_for_web 6.1.0 [flutter flutter_web_plugins image_cropper_platform_interface web]
- image_cropper_platform_interface 7.1.0 [flutter plugin_platform_interface http]
- image_picker_for_web 3.0.6 [flutter flutter_web_plugins image_picker_platform_interface mime web]
- image_picker_ios 0.8.12+2 [flutter image_picker_platform_interface]
- image_picker_linux 0.2.1+2 [file_selector_linux file_selector_platform_interface flutter image_picker_platform_interface]
- image_picker_macos 0.2.1+2 [file_selector_macos file_selector_platform_interface flutter image_picker_platform_interface]
- image_picker_windows 0.2.1+1 [file_selector_platform_interface file_selector_windows flutter image_picker_platform_interface]
- js 0.6.7 [meta]
- json_annotation 4.9.0 [meta]
- just_audio_platform_interface 4.4.0 [flutter plugin_platform_interface]
- just_audio_web 0.4.14 [just_audio_platform_interface flutter flutter_web_plugins web]
- leak_tracker 10.0.8 [clock collection meta path vm_service]
- leak_tracker_flutter_testing 3.0.9 [flutter leak_tracker leak_tracker_testing matcher meta]
- leak_tracker_testing 3.0.1 [leak_tracker matcher meta]
- lints 5.1.1
- logging 1.3.0
- matcher 0.12.17 [async meta stack_trace term_glyph test_api]
- material_color_utilities 0.11.1 [collection]
- meta 1.16.0
- nm 0.5.0 [dbus]
- octo_image 2.1.0 [flutter]
- package_config 2.2.0 [path]
- path_parsing 1.1.0 [meta vector_math]
- path_provider_android 2.2.16 [flutter path_provider_platform_interface]
- path_provider_foundation 2.4.1 [flutter path_provider_platform_interface]
- path_provider_linux 2.2.1 [ffi flutter path path_provider_platform_interface xdg_directories]
- path_provider_platform_interface 2.1.2 [flutter platform plugin_platform_interface]
- path_provider_windows 2.3.0 [ffi flutter path path_provider_platform_interface]
- permission_handler_android 12.1.0 [flutter permission_handler_platform_interface]
- permission_handler_apple 9.4.6 [flutter permission_handler_platform_interface]
- permission_handler_html 0.1.3+5 [flutter flutter_web_plugins permission_handler_platform_interface web]
- permission_handler_platform_interface 4.3.0 [flutter meta plugin_platform_interface]
- permission_handler_windows 0.2.1 [flutter permission_handler_platform_interface]
- petitparser 6.1.0 [meta collection]
- platform 3.1.6
- plugin_platform_interface 2.1.8 [meta]
- posix 6.0.1 [ffi meta path]
- pub_semver 2.2.0 [collection]
- pubspec_parse 1.5.0 [checked_yaml collection json_annotation pub_semver yaml]
- record_android 1.3.1 [flutter record_platform_interface]
- record_darwin 1.2.2 [flutter record_platform_interface]
- record_linux 0.7.2 [flutter record_platform_interface]
- record_platform_interface 1.2.0 [flutter plugin_platform_interface]
- record_web 1.1.5 [flutter flutter_web_plugins web record_platform_interface]
- record_windows 1.0.5 [flutter record_platform_interface]
- riverpod 2.6.1 [collection meta stack_trace state_notifier]
- riverpod_analyzer_utils 0.5.10 [analyzer collection crypto custom_lint_core freezed_annotation meta path source_span]
- rxdart 0.28.0
- sky_engine 0.0.0
- source_span 1.10.1 [collection path term_glyph]
- sprintf 7.0.0
- sqflite 2.4.2 [flutter sqflite_android sqflite_darwin sqflite_platform_interface sqflite_common path]
- sqflite_android 2.4.1 [flutter sqflite_common path sqflite_platform_interface]
- sqflite_common 2.5.5 [synchronized path meta]
- sqflite_darwin 2.4.2 [flutter sqflite_platform_interface meta sqflite_common path]
- sqflite_platform_interface 2.4.0 [flutter platform sqflite_common plugin_platform_interface meta]
- stack_trace 1.12.1 [path]
- state_notifier 1.0.0 [meta]
- stream_channel 2.1.4 [async]
- stream_transform 2.1.1
- string_scanner 1.4.1 [source_span]
- synchronized 3.3.1
- term_glyph 1.2.2
- test_api 0.7.4 [async boolean_selector collection meta source_span stack_trace stream_channel string_scanner term_glyph]
- typed_data 1.4.0 [collection]
- universal_io 2.2.2 [collection meta typed_data]
- url_launcher_android 6.3.15 [flutter url_launcher_platform_interface]
- url_launcher_ios 6.3.2 [flutter url_launcher_platform_interface]
- url_launcher_linux 3.2.1 [flutter url_launcher_platform_interface]
- url_launcher_macos 3.2.2 [flutter url_launcher_platform_interface]
- url_launcher_platform_interface 2.3.2 [flutter plugin_platform_interface]
- url_launcher_web 2.4.0 [flutter flutter_web_plugins url_launcher_platform_interface web]
- url_launcher_windows 3.1.4 [flutter url_launcher_platform_interface]
- vector_graphics 1.1.18 [flutter http vector_graphics_codec]
- vector_graphics_codec 1.1.13
- vector_graphics_compiler 1.1.16 [args meta path path_parsing vector_graphics_codec xml]
- vector_math 2.1.4
- video_player_android 2.8.2 [flutter video_player_platform_interface]
- video_player_avfoundation 2.7.0 [flutter video_player_platform_interface]
- video_player_platform_interface 6.3.0 [flutter plugin_platform_interface]
- video_player_web 2.3.4 [flutter flutter_web_plugins video_player_platform_interface web]
- vm_service 14.3.1
- watcher 1.1.1 [async path]
- web 1.1.1
- web_socket 0.1.6 [web]
- win32 5.12.0 [ffi]
- win32_registry 2.1.0 [ffi meta win32]
- xdg_directories 1.1.0 [meta path]
- xml 6.5.0 [collection meta petitparser]

Additional context and comments

No response

[kirstenkoa]

I forgot to include we are trying to sign into physical Android devices, not emulators. My device is a Pixel 8 on Android 14.

Thanks again!

[SelaseKay]

Hi @kirstenkoa, thanks for the report. Did this work well with debug builds before you distributed to internal testing?

[omegaui]

@SelaseKay
Hi, I'm facing the same issue too, my customer outside India are unable to login via OTP.
I just tried enabling "App Check" and "ReCaptchaEnterprise", but it keeps on saying "app-not-authorized"

W/System  (26239): Ignoring header X-Firebase-Locale because its value was null.
E/FirebaseAuth(26239): [SmsRetrieverHelper] SMS verification code request failed: unknown status code: 17028 Invalid PlayIntegrity token; does not pass basic integrity.
D/FirebaseAuth(26239): Invoking original failure callbacks after reCAPTCHA Enterprise + phone verification failure for +919372104804, error - This app is not authorized to use Firebase Authentication. Please verify that the correct package name, SHA-1, and SHA-256 are configured in the Firebase Console. [ Invalid PlayIntegrity token; does not pass basic integrity. ]

I've have correctly setup my Debug app check token and sha's in "Firebase App Check".

[omegaui]

And I'm using a real physical device too,

[russianivysaur]

Did you guys find a solution to this?

[AnthonyJamez12]

I got that error yesterday too, and came out of the blue. It was working perfectly before.

[kirstenkoa]

Hi @kirstenkoa, thanks for the report. Did this work well with debug builds before you distributed to internal testing?

It was working with debug builds previously. We were distributing our Android app through Firebase App Distribution and I'd say 95% of our testers were able to log in using phone number.

Maybe we had bad timing but I just set up release builds on Wednesday and distributed a version through Google Play. At that point, release builds are able to log in successfully and pass the check, but now our debug builds are all getting this error.

Thanks for your help!

[kirstenkoa]

We also had a couple testers in India who have not been able to sign in. They are hitting a slightly different error, so I think it might not be related to this.

"ALTERNATE_CLIENT_IDENTIFIER_REQUIRED : Invalid PlayIntegrity token; app not Recognized by Play Store."

[russianivysaur]

We worked our way around this, might help someone if using phone authentication.

We re-created the test credentials for phone authentication on the console. This error does not occur if you use the test phone and OTP specified on the console. We were able to develop on those test credentials as dummy users and given that this happens only on debug builds, our users are able to authenticate from play store downloaded versions.

Not a fix, but helped us to push out fixes and get the wheel spinning temporarily.

[abdullahalam123]

We have also been facing this issue. It was working just fine before, and the sha keys are correctly configured