Firebase Phone Authentication Error 17028: Play Integrity Fix

What Caused Our Firebase Phone Authentication to Fail in Production?

During a recent project for a fast-growing vehicle rental SaaS platform, our engineering team was preparing a React Native Android application for a closed beta release. The system architecture relied heavily on real-time driver verification, meaning secure, frictionless user onboarding was critical. To handle this, we integrated firebase phone authentication.

While testing locally, the integration seemed flawless. Firebase test phone numbers bypassed the anti-abuse checks and authenticated immediately. However, the moment we deployed the application to the Play Store Closed Testing track and attempted to log in with real phone numbers, the process failed completely. We were met with a rigid authentication blocker, despite the application being correctly signed and distributed via official Google Play channels.

This situation was not just a minor bug; a failure in the authentication layer means a zero percent conversion rate for new user onboarding. Resolving this issue required deep-diving into Android app signing, Google Cloud project linkages and Play Integrity API configurations. We are sharing this engineering insight so that when you hire software developer teams to build scalable mobile solutions, you can avoid this specific deployment trap.

How Does Firebase Phone Authentication Integrate With Our SaaS Architecture?

In a typical React Native mobility application, verifying user identity before granting access to vehicle bookings is non-negotiable. We utilized Firebase to handle SMS-based One-Time Passwords (OTP). When a user enters their real phone number, Firebase initiates a safety check using Android’s Play Integrity API (formerly SafetyNet) or reCAPTCHA to ensure the request originates from a legitimate, untampered app binary running on an uncompromised Android device.

Once the attestation is verified, Firebase triggers the SMS delivery. If attestation fails, Firebase throws an exception to prevent SMS pumping and malicious bot activity. In our architecture, the authentication layer was designed to pass the Play Integrity token directly to Firebase backend services for validation before any OTP was dispatched.

What Were the Symptoms of the Play Integrity Token Mismatch?

The failure manifested exclusively on real devices using real phone numbers. The application immediately threw an obscure unknown status code exception. Upon inspecting the Android Logcat and Firebase crash reports, we extracted the following granular error:

Error code: unknown status code 17028

Message: This app is not authorized to use Firebase Authentication. Please verify that the correct package name, SHA-1 and SHA-256 are configured in the Firebase Console. [ A play_integrity_token was passed, but no matching SHA-256 was registered in the Firebase console. ]

The error explicitly claimed that our package name and SHA-256 pair were missing. However, we had meticulously verified our configuration multiple times:

• All signing certificates were registered in the Firebase Console (SHA-1 and SHA-256). This included the Play App Signing Classical key, the Post-quantum key, the Play Console Upload key and the local debug keystore.
• The Play Integrity API in the Play Console was linked to the correct Google Cloud Project.
• Firebase App Check indicated the app was registered with Play Integrity as the attestation provider.
• The Firebase Phone Authentication enforcement mode for reCAPTCHA was strictly set to Audit (non-blocking).
• The project had an active Blaze billing plan.

Despite waiting over 24 hours for potential DNS or config propagation delays, the issue persisted across fresh devices. The logs insisted the SHA-256 was missing, while our eyes confirmed it was present.

How Did We Approach Solving the Invalid App Info Error?

When an error message contradicts verifiable reality, the root cause usually lies in hidden linkages between distributed systems—in this case, Google Play Console, Google Cloud Platform (GCP) and Firebase. We began systematically ruling out potential failure points.

Did We Consider Updating the Google Services Configuration?

Our first hypothesis was a stale configuration. When you add new SHA fingerprints to the Firebase Console, the underlying configuration file updates. We considered whether the React Native build was using an outdated JSON file. We downloaded a fresh configuration file, cleaned the Gradle cache and triggered a new build. This did not resolve the issue, but it is a necessary baseline step.

Could It Be a Google Cloud Project Linkage Issue?

Next, we audited the Google Play Console linkages. Often, legacy systems have a default GCP project created automatically by Google Play, which differs from the active Firebase project. We verified the project numbers. They matched perfectly. The Play Console was definitively sending integrity tokens meant for the correct Firebase GCP environment.

Was Firebase App Check Interfering with the Auth Flow?

We evaluated whether Firebase App Check token validation was enforcing a strict block despite the Auth settings being in Audit mode. Sometimes, the Play Integrity API attestation fails implicitly if the specific Google Cloud APIs are not enabled on the backend. We considered turning off App Check entirely, but doing so compromises backend security. Instead, we realized we needed to investigate the API enablement at the GCP layer, independent of the Firebase UI.

How Did We Finally Implement the Fix for Error 17028?

The breakthrough came when we bypassed the Firebase Console and inspected the underlying Google Cloud Console for the linked Firebase project. The root cause was a combination of missing API activations and a mismatched App Bundle internal test track upgrade that generated an invisible secondary signing key.

First, we discovered that while the Play Integrity API was linked in the Play Console, the actual Play Integrity API was not explicitly enabled in the Google Cloud Console API Library for that specific project. Firebase attempts to automate this, but occasionally fails silently.

Second, we extracted the exact SHA-256 hash that the Play Integrity API was seeing at runtime by logging the raw attestation response. The hash returned did not match our Classical Key, Post-quantum Key or Upload Key. It turned out Google Play had quietly generated a new App Signing key during an internal App Bundle format upgrade.

Here is the exact implementation checklist we used to permanently fix the issue:

1. Navigate to Google Cloud Console > APIs & Services.
2. Search for "Play Integrity API" and explicitly click "Enable".
3. Extract the exact runtime SHA-256 via terminal using keytool on the downloaded APK from the Play Store Device Catalog.
   keytool -printcert -jarfile downloaded_app.apk
4. Add this newly discovered runtime SHA-256 to the Firebase Console.
5. Download the latest configuration JSON file.
6. Place the configuration file in the Android app directory.
7. Rebuild the application and deploy to the Play Store testing track.

Once the new configuration was bundled and the API was forcibly enabled in GCP, real phone numbers successfully received OTPs without triggering the unknown status code 17028. If your architecture involves complex Google Play app signing, it is highly recommended to hire dedicated developers for firebase integration who understand how to navigate the Google Cloud backend.

What Can Engineering Teams Learn From This Authentication Failure?

This challenge highlighted several critical lessons for mobile platform architectures:

• Do Not Trust the UI Blindly: The Firebase UI may show APIs as linked, but always verify explicit API enablement in the Google Cloud Console.
• Extract Hashes from Production Artifacts: Never rely solely on the Play Console UI for your SHA fingerprints. Download the final signed artifact distributed by Google and extract the certificate hashes manually.
• Test with Real Data Early: Firebase test phone numbers are designed to bypass anti-abuse systems. If we had not tested with real carrier numbers in the closed testing track, this would have broken production.
• Understand Play App Signing: Google Play modifies your application’s signature if you opt into certain modern App Bundle signing features. Keep your Firebase fingerprints synchronized with these changes.
• Audit Configuration Files: Anytime a new hash is added to your auth provider, CI/CD pipelines must pull the latest configuration file before building the release candidate.

When you hire android developers for enterprise security, ensure they have a deep understanding of cryptographic signing and attestation flows, as these are the exact areas where high-friction bugs occur.

How Can You Prevent Similar Authentication Bottlenecks?

Diagnosing firebase phone authentication failures requires looking beyond the application code and diving into cloud infrastructure, API linkages and app distribution pipelines. By verifying API enablement at the GCP level and extracting the true runtime signing certificates from distributed binaries, we successfully resolved error 17028 and unblocked user onboarding for the mobility platform.

Complex cloud and mobile integrations require rigorous architectural oversight. If you are looking to scale your engineering capabilities or need to hire react native developers for mobility apps who understand end-to-end security, contact us to discuss how our pre-vetted, dedicated teams can accelerate your product delivery.

Social Hashtags

#Firebase #FirebaseAuth #FirebaseAuthentication #PhoneAuthentication #Error17028 #PlayIntegrity #AndroidDevelopment #ReactNative #FirebaseOTP #GoogleCloud #MobileAppDevelopment #AndroidDevelopers #AppSecurity #SoftwareDevelopment