Client authentication

  • Certain Google Play services require the SHA-1 of your signing certificate.

  • If you use Play App Signing, you can find your SHA-1 in the Google Play Console.

  • If you don't use Play App Signing, you can use Keytool or Gradle's signingReport to obtain your SHA-1.

  • Instructions are provided for using Keytool on a certificate or an APK/AAB to get the SHA-1.

  • Instructions are provided for using the Gradle signingReport command to get the SHA-1.

Certain Google Play services (such as Google Sign-in and App Invites) require you to provide the SHA-1 of your signing certificate so we can create an OAuth2 client and API key for your app.

Play App Signing

If you've published your app using Play App Signing, a requirement when using Android App Bundle, you can get your SHA-1 from the Google Play Console on the Release > Setup > App Integrity page.

Self-sign your application

If you're not using Play App Signing, follow the instructions in the following sections to use Keytool or Gradle's Signing Report to get your SHA-1.

Keytool on the certificate

Open a terminal and run the keytool utility provided with Java to get the SHA-1 fingerprint of the certificate. You should get both the release and debug certificate fingerprints.

To get the release certificate fingerprint:

keytool -list -v \
-alias <your-key-name> -keystore <path-to-production-keystore>

To get the debug certificate fingerprint:

Mac/Linux
keytool -list -v \
-alias androiddebugkey -keystore ~/.android/debug.keystore
Windows
keytool -list -v \
-alias androiddebugkey -keystore %USERPROFILE%\.android\debug.keystore

The keytool utility prompts you to enter a password for the keystore. The default password for the debug keystore is android. The keytool then prints the fingerprint to the terminal. For example:

Certificate fingerprint: SHA1: DA:39:A3:EE:5E:6B:4B:0D:32:55:BF:EF:95:60:18:90:AF:D8:07:09

Keytool on an APK or AAB

To get the certificate of an application binary:

# APK file
keytool -printcert